System unusable post 2016-001 security update

Question

Level 1

9 points

System unusable post 2016-001 security update

So I updated my system from the App Store with the El Capitan 2016-001 security update, and now my system is pretty well hosed...

To summarize the issues:

Finder windows take forever to update/refresh (spinning beach ball and gears forever)
For example, when I clicked on "Applications", the applications list was incomplete and most had generic icons
I get the following error message when trying to launch any application, including System Preferences:
"The application is damaged or incomplete"

Those are the most salient and obvious issues. I can't launch Terminal, Disk Utility, System Logs, nothing, from my primary user ID, which is an admin ID.

Steps I've taken:

I logged in using a test account and no issues.
I booted into Safe Mode with the affected ID, same issues as when booting normally.
I've run Disk Utility First Aid from the test account, and it reports the disk is fine, but I'm not sure if it's looking at the affected user account.
I've run the unified installer from the test account

I'm kind of at a total standstill. Does anyone have any ideas how I might proceed? I'm hoping Linc or Barney F15E have some ideas...

Help!

Thanks - Dave

MacBook Pro with Retina display, OS X El Capitan (10.11.3)

Posted on Jan 26, 2016 12:11 PM

Reply

Answer 1

mortarman Author

Level 1

9 points

Jan 28, 2016 6:46 AM in response to mortarman

As I said, nearly all of my application icons are generic, and anytime I try to launch an application this is the response I get - when the system finally responds:

Oddly enough, Preview is one application that actually worked, but it took something like 10 minutes for it to actually launch.

Reply

Answer 2

JimmyCMPIT

Level 7

29,223 points

Jan 28, 2016 6:56 AM in response to mortarman

if you have a time machine backup with an instance of the OS working you can roll back to that otherwise please post an etrecheck report for further analysis

Use Time Machine to back up or restore your Mac - Apple Support

etrecheck.com

Reply

Answer 3

Jan 28, 2016 7:08 AM in response to mortarman

If you've already rebooted through Safe Mode to clear caches and related, and reboot normally and that's not cleared this, and if you've used the repair partition and that's not cleared this, then you're headed toward roll in your backups. If you don't have backups, then boot from an external installer or via a cable and another Mac and Target Disk Mode, and get a backup (or two), and then reformat and reinstall and migrate your data in from the backup.

Or yes, run an Etrecheck report from that other working login, and post the data. If there've been any cache optimizers, anti-virus or anti-malware packages, performance enhancement tools or other similar add-on packages installed here, go remove the working account right now, using the package-specific removal sequences.

Etrecheck likely won't solve this, however, as this is either a local corruption or bad protections on your login. Launch Terminal.app and cut-and-past each of the two commands, and then post the output of the following two commands:

id

ls -aled@ ~/Documents ~/Library ~/Library/Preferences ~/Music

Check for any sensitive data before posting, but you should only get some short names and some identifier values, and the ownerships, sizes and protections on four directory files that exist on most every OS X system.

Reply

Answer 4

mortarman Author

Level 1

9 points

Jan 28, 2016 7:19 AM in response to JimmyCMPIT

Hi Jimmy - thanks for the response. Unfortunately, I committed the cardinal sin and did not perform a backup prior to the update...

I normally use SuperDuper on a nightly basis, however I've been having issues with my backup drive and hadn't gotten around to replacing it...so..this...

I've never used etrecheck, so my question about is this: can i run it from an account that is unaffected to test the affected account?

I ask because my normal user account is almost completely unusable, and I have no confidence I can run any applications from that account.

Thanks again.

Reply

Answer 5

JimmyCMPIT

Level 7

29,223 points

Jan 28, 2016 7:27 AM in response to mortarman

Hindsight is 20/20

I lost my entire college art portfolio before I realized I was foolish and I didn't want to be a commercial artist anyway, the big money was in IT. Hindsight being 20/20 I should have gone to vet school.

the overwhelming consensus here Etrecheck is totally safe, small and indispensable for cutting down on questions a user may or may not know the correct answer to, it's developed by a frequent contributor to these forums and it has a history of being a focal piece of software for solving many issues. A handful disagree and the may have some other insight as to why or they have a personal grudge against the developer for allowing more members of the community to readily help users in need turning this forum into a proverbial big pond with a lot more big fish.

Reply

Answer 6

mortarman Author

Level 1

9 points

Jan 28, 2016 7:32 AM in response to MrHoffman

être report below. This was run from the 'test' account I created; not sure if it reports on the system library for the affected account as well...

EtreCheck version: 2.7.8 (238)

Report generated 2016-01-28 10:21:09

Download EtreCheck from http://etrecheck.com

Runtime 1:50

Performance: Excellent

Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.

Click the [Check files] link for help with unknown files.

Problem: Beachballing

Description:

Finder is too slow

Hardware Information:ⓘ

MacBook Pro (Retina, Mid 2012)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Pro - model: MacBookPro10,1

1 2.6 GHz Intel Core i7 CPU: 4-core

16 GB RAM Not upgradeable

BANK 0/DIMM0

8 GB DDR3 1600 MHz ok

BANK 1/DIMM0

8 GB DDR3 1600 MHz ok

Bluetooth: Good - Handoff/Airdrop2 supported

Wireless: en0: 802.11 a/b/g/n

Battery: Health = Normal - Cycle count = 272 - SN = D86236231XUDNMGA1

Video Information:ⓘ

Intel HD Graphics 4000

NVIDIA GeForce GT 650M - VRAM: 1024 MB

Color LCD 2880 x 1800

Thunderbolt Display 2560 x 1440

System Software:ⓘ

OS X El Capitan 10.11.3 (15D21) - Time since boot: less than an hour

Disk Information:ⓘ

APPLE SSD SM512E disk0 : (500.28 GB) (Solid State - TRIM: Yes)

EFI (disk0s1) <not mounted> : 210 MB

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB

HDD (disk1) / : 499.05 GB (67.30 GB free)

Core Storage: disk0s2 499.42 GB Online

USB Information:ⓘ

Apple Inc. FaceTime HD Camera (Built-in)

Apple Inc. Apple Internal Keyboard / Trackpad

Apple Inc. BRCM20702 Hub

Apple Inc. Bluetooth USB Host Controller

Logitech USB Receiver

Tablet PTZ-630

Apple Inc. FaceTime HD Camera (Display)

Apple Inc. Apple Thunderbolt Display

Apple Inc. Display Audio

SanDisk Cruzer Glide 128.04 GB

EFI (disk2s1) <not mounted> : 210 MB

SanDisk (disk2s2) /Volumes/SanDisk : 95.86 GB (45.55 GB free)

OS X Recovery (disk2s3) /Volumes/OS X Recovery : 31.19 GB (9.82 GB free)

Recovery HD (disk2s4) <not mounted> [Recovery]: 650 MB

Thunderbolt Information:ⓘ

Apple Inc. thunderbolt_bus

Apple Inc. Thunderbolt Display

Gatekeeper:ⓘ

Mac App Store and identified developers

Unknown Files:ⓘ

/Library/LaunchAgents/com.netgear.switchTool.plist

/Library/LaunchDaemons/openbase.plist

/Library/LaunchAgents/com.hp.devicemonitor.plist

3 unknown files found. [Check files]

Kernel Extensions:ⓘ

/Applications/Parallels Desktop.app

[not loaded] com.parallels.kext.hypervisor (11.1.1 32312 - SDK 10.9) [Support]

[not loaded] com.parallels.kext.netbridge (11.1.1 32312 - SDK 10.9) [Support]

[not loaded] com.parallels.kext.usbconnect (11.1.1 32312 - SDK 10.9) [Support]

[not loaded] com.parallels.kext.vnic (11.1.1 32312 - SDK 10.9) [Support]

/Applications/Toast 7.1/Toast Titanium.app

[not loaded] com.roxio.BluRaySupport (1.0.0) [Support]

[not loaded] com.roxio.TDIXController (1.6) [Support]

/Incompatible Software/Parallels Access.app

[not loaded] com.parallels.virtualsound (1.0 22731.929773 - SDK 10.6) [Support]

/Library/Extensions

[loaded] at.obdev.nke.LittleSnitch (4356 - SDK 10.8) [Support]

[loaded] com.Logitech.Control Center.HID Driver (3.9.1 - SDK 10.8) [Support]

[loaded] com.Logitech.Unifying.HID Driver (1.3.1 - SDK 10.8) [Support]

[loaded] com.logitech.manager.kernel.driver (5.40.1 - SDK 10.8) [Support]

[not loaded] com.wacom.kext.ftdi (1 - SDK 10.10) [Support]

[not loaded] com.wacom.kext.wacomtablet (6.3.13 - SDK 10.10) [Support]

/System/Library/Extensions

[not loaded] com.ibm.mobileconnect.driver.VirtualNetworkController (1.0.0) [Support]

[loaded] com.logmein.driver.LogMeInSoundDriver (1.0.3 - SDK 10.5) [Support]

[not loaded] com.netgear.driver.NetgearFSRSupport (3.0.0 - SDK 10.6) [Support]

[not loaded] com.netgear.driver.NetgearHSRSupport (3.0.0 - SDK 10.6) [Support]

[not loaded] com.netgear.driver.NetgearQMISupport (1.1.0 - SDK 10.6) [Support]

[not loaded] com.netgear.driver.qmiNetDriver (1.2.4 - SDK 10.6) [Support]

[not loaded] com.palm.ClassicNotSeizeDriver (3.2) [Support]

[not loaded] com.sierrawireless.driver.SierraDIPSupport (1.0.0 - SDK 10.6) [Support]

[not loaded] com.sierrawireless.driver.SierraIPDirect (1.1.5 - SDK 10.6) [Support]

[not loaded] com.sierrawireless.driver.SierraVSP (1.1 - SDK 10.6) [Support]

Startup Items:ⓘ

ParallelsTransporter: Path: /Library/StartupItems/ParallelsTransporter

Startup items are obsolete in OS X Yosemite

Launch Agents:ⓘ

[running] at.obdev.LittleSnitchUIAgent.plist [Support]

[running] com.Logitech.Control Center.Daemon.plist [Support]

[loaded] com.adobe.AAM.Updater-1.0.plist [Support]

[running] com.canon.MFManager.plist [Support]

[loaded] com.google.keystone.agent.plist [Support]

[running] com.hp.devicemonitor.plist [Support]

[loaded] com.hp.messagecenter.launcher.plist [Support]

[running] com.logitech.manager.daemon.plist [Support]

[failed] com.logmein.LMILaunchAgentFixer.plist [Support] [Details]

[loaded] com.logmein.logmeingui.plist [Support]

[loaded] com.logmein.logmeinguiagent.plist [Support]

[loaded] com.logmein.logmeinguiagentatlogin.plist [Support]

[running] com.netgear.switchTool.plist [Support]

[loaded] com.oracle.java.Java-Updater.plist [Support]

[loaded] com.teamviewer.teamviewer.plist [Support]

[loaded] com.teamviewer.teamviewer_desktop.plist [Support]

[running] com.wacom.wacomtablet.plist [Support]

Launch Daemons:ⓘ

[running] at.obdev.littlesnitchd.plist [Support]

[loaded] com.adobe.SwitchBoard.plist [Support]

[loaded] com.adobe.fpsaud.plist [Support]

[loaded] com.barebones.authd.plist [Support]

[loaded] com.google.keystone.daemon.plist [Support]

[loaded] com.logmein.logmeinblanker.plist [Support]

[loaded] com.logmein.logmeinserver.plist [Support]

[loaded] com.logmein.raupdate.plist [Support]

[loaded] com.microsoft.autoupdate.helpertool.plist [Support]

[loaded] com.microsoft.office.licensingV2.helper.plist [Support]

[loaded] com.oracle.java.Helper-Tool.plist [Support]

[loaded] com.sonos.smbbump.plist [Support]

[loaded] com.teamviewer.teamviewer_service.plist [Support]

[running] openbase.plist [Support]

User Login Items:ⓘ

Dropbox Application (/Applications/Dropbox.app)

AirPort Base Station Agent Application (/System/Library/CoreServices/AirPort Base Station Agent.app)

Dropbox Application (/Applications/Dropbox.app)

Other Apps:ⓘ

[running] com.apple.xpc.launchd.oneshot.0x10000005.Little Snitch Network Monitor

[running] com.apple.xpc.launchd.oneshot.0x10000008.EtreCheck

[running] com.wacom.TabletDriver.179872

[running] com.wacom.WacomTouchDriver.167712

Internet Plug-ins:ⓘ

AdobePDFViewerNPAPI: Version: 10.1.16 [Support]

Flash Player: Version: 20.0.0.267 - SDK 10.6 Outdated! Update

AdobePDFViewer: Version: 10.1.16 [Support]

LogMeInSafari32: Version: 1.0.586 [Support]

iPhotoPhotocast: Version: 7.0

QuickTime Plugin: Version: 7.7.3

LogMeInSafari64: Version: 1.0.586 [Support]

FlashPlayer-10.6: Version: 20.0.0.267 - SDK 10.6 [Support]

CitrixICAClientPlugIn: Version: 11.2.0 [Support]

GarminGpsControl: Version: 4.2.0.0 - SDK 10.8 [Support]

Silverlight: Version: 5.1.30514.0 - SDK 10.6 [Support]

MeetingJoinPlugin: Version: Unknown - SDK 10.2 [Support]

DivXBrowserPlugin: Version: 1.0 [Support]

LogMeIn: Version: 1.0.586 [Support]

Default Browser: Version: 601 - SDK 10.11

Flip4Mac WMV Plugin: Version: 3.0.0.85 BETA - SDK 10.7 [Support]

WacomTabletPlugin: Version: WacomTabletPlugin 2.1.0.6 - SDK 10.9 [Support]

SharePointBrowserPlugin: Version: 14.5.3 - SDK 10.6 [Support]

anywhereAppshare: Version: 7.0.1.0 - SDK 10.10 [Support]

JavaAppletPlugin: Version: Java 8 Update 66 build 17 Check version

Safari Extensions:ⓘ

Open in Internet Explorer

3rd Party Preference Panes:ⓘ

Citrix Online Plug-in [Support]

Déjà Vu [Support]

Flash Player [Support]

Java [Support]

Logitech Control Center [Support]

Logi Options Launcher [Support]

MacFUSE [Support]

OpenBasePreferences [Support]

WacomTablet [Support]

Time Machine:ⓘ

Time Machine not configured!

Top Processes by CPU:ⓘ

2% WindowServer

2% fontd

1% kernel_task

0% Dock

0% com.apple.WebKit.WebContent(9)

Top Processes by Memory:ⓘ

1.22 GB com.apple.WebKit.WebContent(9)

1.20 GB kernel_task

442 MB mds_stores

229 MB iconservicesagent(2)

164 MB Finder

Virtual Memory Information:ⓘ

10.00 GB Free RAM

5.88 GB Used RAM (1.84 GB Cached)

0 B Swap Used

Diagnostics Information:ⓘ

Jan 28, 2016, 09:34:20 AM Self test - passed

Jan 28, 2016, 12:21:50 AM /Library/Logs/DiagnosticReports/lsd_2016-01-28-002150_[redacted].crash

/usr/libexec/lsd

Jan 27, 2016, 09:26:41 PM /Library/Logs/DiagnosticReports/lsd_2016-01-27-212641_[redacted].crash

Jan 27, 2016, 07:44:07 PM /Library/Logs/DiagnosticReports/lsd_2016-01-27-194407_[redacted].crash

Jan 27, 2016, 10:07:43 AM /Library/Logs/DiagnosticReports/WacomTabletDriver_2016-01-27-100743_[redacted]. crash

PRODUCT_IDENTIFIER - /Library/Application Support/Tablet/WacomTabletDriver.app/Contents/MacOS/WacomTabletDriver

Reply

Answer 7

mortarman Author

Level 1

9 points

Jan 28, 2016 7:38 AM in response to JimmyCMPIT

"Hindsight is 20/20"

That, it is...

I just downloaded EtreCheck and it seems like a pretty nifty little utility. I certainly discovered a bunch of old system stuff I no longer need - probably because I haven't done a clean install since my 2006 MB Pro...

Reply

Answer 8

JimmyCMPIT

Level 7

29,223 points

Jan 28, 2016 7:47 AM in response to mortarman

My suggestion is to remove the following apps to test system integrity.

If the system behavior improves trying adding them back one by one to see if pattern can be developed as to which one may be causing interruptions.

at a glance I would say remove Little Snitch from your system, it's a busy app and can be system intensive.

remove Déjà Vu, and any other application you have have downloaded from Softsonic as they are notorious in bundling bloat/crap ware with with they host.

remove LogMeIn and Teamviwer from startup

remove openbase, it has been reported to be a cause of slowing down some users macs

remove the garmin gps application

remove the HP application, it shouldn't be problem but HP writes some very resource intensive apps for MFP devices that can get a bit chatty.

Reply

Answer 9

mortarman Author

Level 1

9 points

Jan 28, 2016 8:02 AM in response to JimmyCMPIT

Hi Jimmy,

Thanks again for the response.

I appreciate the suggestions, but in case I wasn't clear in my original post, I'm not experiencing intermittent interruptions, slowdowns, etc., but a systematic lack of responsiveness from the system in my normal user account.

After applying the 2016-001 security update and attempting to log in, my system is nearly unusable immediately after getting to the Finder because it's so incredibly slow.

I'm not even sure how long it took for my desktop to display initially because I walked away from the system, but when I open a new Finder window it takes on the order of at least 20 to 30 minutes for the window contents to display, and all the while I get the spinning beachball and the spinning gear in the newly opened Finder window.

When I clicked on the Apple icon in the menu bar to log out, it took ~20 minutes for the menu to drop down, and then another 10 minutes of hovering for the 'log out' menu item to select.

Finally, I have generic icons, with a few exceptions, and consistently get the error dialog displayed above.

Reply

Answer 10

JimmyCMPIT

Level 7

29,223 points

Jan 28, 2016 8:09 AM in response to mortarman

I'd still go with the suggestions I posted. Also turn off FileVault if it is enabled.

theses are tests to see if there is an incompatibility as many have downloaded and installed the patch but not reported the issues you have. It could be on or more of those apps is very unhappy with the patch or vice versa.

Reply

Answer 11

mortarman Author

Level 1

9 points

Jan 28, 2016 8:19 AM in response to JimmyCMPIT

Thanks Jimmy - i'll give it a shot.

Could you please let me know if I can do that from the test account, and if so how?

Reply

Answer 12

JimmyCMPIT

Level 7

29,223 points

Jan 28, 2016 8:27 AM in response to mortarman

the test account works?

does it have adminstiravie rights?

does you day-to-day account have them?

Reply

Answer 13

mortarman Author

Level 1

9 points

Jan 28, 2016 9:01 AM in response to JimmyCMPIT

yes, the test account works and i've set it up as an admin

Sorry, but I'm not sure what you're asking here: "does you day-to-day account have them?"

Reply

Answer 14

mortarman Author

Level 1

9 points

Jan 28, 2016 9:08 AM in response to mortarman

ok...just stopped being thick - yes, the day-to-day account also has admin rights

Reply

Answer 15

JimmyCMPIT

Level 7

29,223 points

Jan 28, 2016 9:40 AM in response to mortarman

I've seen where an account gets corrupt to the point of not being able to recover functionality to an acceptable level (when a new account suddenly is working beautifully on the same system with the same apparent settings), in some instances (for me) I have never gotten full advantage of the badly behaving account without a tremendous amount of deleting testing and rebooting and in some cases just killing it off was the most humane thing to do (for me and my experience with this)

if this is the case my personal advice to you is backup your data now with Time Machine and make a copy of the user folder contents into the shard folder then consider migrating over to the new account. From the shared account you can access and migrate the shard content back to you new account and have a backup in the event you need it.

Other users may have a very simple solution to this and if that seems like an option Im sure they will specificify what can be done outside of what I suggest.

Reply