MacBook Pro Suddenly Running Slowly

Question

Level 1

0 points

MacBook Pro Suddenly Running Slowly

I was browsing the internet last night and my computer suddenly began running very slowly. I've attached an EtreCheck and will try getting rid of the adware. I'm a complete novice at these things, so any help would be greatly appreciated! Thanks!

EtreCheck version: 2.9.9 (260)

Report generated 2016-03-12 15:15:01

Download EtreCheck from https://etrecheck.com

Runtime 61:50

Performance: Poor

Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.

Click the [Remove] links to remove adware.

Problem: Computer is too slow

Hardware Information: ⓘ

MacBook Pro (15-inch, Mid 2012)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Pro - model: MacBookPro9,1

1 2.3 GHz Intel Core i7 CPU: 4-core

4 GB RAM Upgradeable - [Instructions]

BANK 0/DIMM0

2 GB DDR3 1600 MHz ok

BANK 1/DIMM0

2 GB DDR3 1600 MHz ok

Bluetooth: Good - Handoff/Airdrop2 supported

Wireless: en1: 802.11 a/b/g/n

Battery: Health = Normal - Cycle count = 454

Video Information: ⓘ

Intel HD Graphics 4000

Color LCD 1440 x 900

NVIDIA GeForce GT 650M - VRAM: 512 MB

System Software: ⓘ

OS X El Capitan 10.11.3 (15D21) - Time since boot: about 15 hours

Disk Information: ⓘ

APPLE HDD TOSHIBA MK5065GSXF disk0 : (500.11 GB) (Rotational)

EFI (disk0s1) <not mounted> : 210 MB

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB

Macintosh HD (disk1) / : 498.88 GB (409.15 GB free)

Core Storage: disk0s2 499.25 GB Online

MATSHITADVD-R UJ-8A8 ()

USB Information: ⓘ

Apple Inc. FaceTime HD Camera (Built-in)

Apple Inc. Apple Internal Keyboard / Trackpad

Apple Computer, Inc. IR Receiver

Apple Inc. BRCM20702 Hub

Apple Inc. Bluetooth USB Host Controller

Logitech USB Receiver

Thunderbolt Information: ⓘ

Apple Inc. thunderbolt_bus

Gatekeeper: ⓘ

Mac App Store and identified developers

Adware: ⓘ

~/Library/Caches/com.apple.Safari/Extensions/Omnibar.safariextension

One adware file found. [Remove]

Kernel Extensions: ⓘ

/System/Library/Extensions

[not loaded] com.xxxchurch.x3nke (1.0.2 - SDK 10.7 - 2016-02-26) [Support]

System Launch Agents: ⓘ

[not loaded] 5 Apple tasks

[loaded] 162 Apple tasks

[running] 69 Apple tasks

System Launch Daemons: ⓘ

[not loaded] 46 Apple tasks

[loaded] 151 Apple tasks

[running] 90 Apple tasks

Launch Agents: ⓘ

[loaded] com.google.keystone.agent.plist (2016-03-02) [Support]

Launch Daemons: ⓘ

[loaded] com.adobe.fpsaud.plist (2016-03-07) [Support]

[loaded] com.google.keystone.daemon.plist (2016-03-02) [Support]

[loaded] com.microsoft.office.licensing.helper.plist (2012-04-02) [Support]

[loaded] com.x3.x3daemon.plist (2013-04-15) [Support]

User Login Items: ⓘ

None

Other Apps: ⓘ

[running] com.etresoft.EtreCheck.78112

[loaded] 392 Apple tasks

[running] 168 Apple tasks

Internet Plug-ins: ⓘ

FlashPlayer-10.6: 21.0.0.182 - SDK 10.6 (2016-03-10) [Support]

QuickTime Plugin: 7.7.3 (2016-01-13)

Flash Player: 21.0.0.182 - SDK 10.6 (2016-03-10) [Support]

net.juniper.DSSafariExtensions: Unknown (2013-09-03) [Support]

o1dbrowserplugin: 5.41.3.0 - SDK 10.8 (2015-12-17) [Support]

Default Browser: 601 - SDK 10.11 (2016-01-13)

SharePointBrowserPlugin: 14.6.0 - SDK 10.6 (2016-02-08) [Support]

PepperFlashPlayer: 21.0.0.182 - SDK 10.6 (2016-03-11) [Support]

googletalkbrowserplugin: 5.41.3.0 - SDK 10.8 (2015-12-11) [Support]

Safari Extensions: ⓘ

Omnibar (cache only) (2014-03-19) Adware! [Remove]

3rd Party Preference Panes: ⓘ

Flash Player (2016-03-07) [Support]

x3macpane (2013-04-17) [Support]

Time Machine: ⓘ

Time Machine not configured!

Top Processes by CPU: ⓘ

1% kernel_task

0% cloudpaird

Top Processes by Memory: ⓘ

566 MB kernel_task

483 MB softwareupdated

98 MB mds_stores

98 MB WindowServer

78 MB ocspd

Virtual Memory Information: ⓘ

449 MB Free RAM

3.55 GB Used RAM (1.05 GB Cached)

0 B Swap Used

Diagnostics Information: ⓘ

Mar 12, 2016, 02:40:15 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-144015_[redacted].crash

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/ suggestd

Mar 12, 2016, 02:39:15 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-143915_[redacted].crash

Mar 12, 2016, 02:37:31 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-143731_[redacted].crash

Mar 12, 2016, 02:35:31 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-143531_[redacted].crash

Mar 12, 2016, 02:34:28 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-143428_[redacted].crash

Mar 12, 2016, 02:33:27 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-143327_[redacted].crash

Mar 12, 2016, 02:32:26 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-143226_[redacted].crash

Mar 12, 2016, 02:31:22 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-143122_[redacted].crash

Mar 12, 2016, 02:30:21 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-143021_[redacted].crash

Mar 12, 2016, 02:29:19 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-142919_[redacted].crash

Mar 12, 2016, 02:28:17 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-142817_[redacted].crash

Mar 12, 2016, 02:26:37 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-142637_[redacted].crash

Mar 12, 2016, 02:25:36 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-142536_[redacted].crash

Mar 12, 2016, 02:24:34 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-142434_[redacted].crash

Mar 12, 2016, 02:23:33 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-142333_[redacted].crash

Mar 12, 2016, 02:22:31 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-142231_[redacted].crash

Mar 12, 2016, 02:20:47 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-142047_[redacted].crash

Mar 12, 2016, 02:17:14 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-141714_[redacted].crash

Mar 12, 2016, 02:15:33 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-141533_[redacted].crash

Mar 12, 2016, 02:14:31 PM ~/Library/Logs/DiagnosticReports/suggestd_2016-03-12-141431_[redacted].crash

Mar 12, 2016, 08:36:14 AM ~/Library/Logs/DiagnosticReports/quicklookd_2016-03-12-083614_[redacted].crash

/System/Library/Frameworks/QuickLook.framework/Versions/A/Resources/quicklookd. app/Contents/MacOS/quicklookd

Mar 11, 2016, 11:09:51 PM Self test - passed

Mar 10, 2016, 03:32:48 PM ~/Library/Logs/DiagnosticReports/Pokemon Trading _2016-03-10-153248_[redacted].crash

unity.The Pokémon Company International.Pokemon Trading Card Game Online - /Applications/The Pokémon Online Trading Card Game/Pokemon Trading Card Game Online.app/Contents/MacOS/Pokemon Trading Card Game Online

Mar 9, 2016, 03:07:44 PM ~/Library/Logs/DiagnosticReports/Pokemon Trading _2016-03-09-150744_[redacted].crash

MacBook Pro, OS X El Capitan (10.11.3)

Posted on Mar 12, 2016 12:53 PM

Reply

Answer 1

Mar 12, 2016 2:12 PM in response to acm206

It took 61 minutes to complete EtreCheck.

It sounds like your hard drive may be failing. You have not rebooted in 15 hours. Will your computer start up?

If you do not have a current backup, this would be a good time to make one.

Try booing into the Recovery Partition by holding down the Command and R keys at startup. OS X Recovery

After the Recovery menu appears, select Disk Utility.

See the following link: Check Hard Drive Health of a Mac with Disk Utility: Check Hard Drive Health of a Mac with Disk Utility

See running Disk Utility to check your startup disk: Using Disk Utility to verify or repair disks

Kim

Reply

Answer 2

Mar 12, 2016 2:32 PM in response to acm206

There are a few unusual things:

Adware: ⓘ

~/Library/Caches/com.apple.Safari/Extensions/Omnibar.safariextension

One adware file found. [Remove]

also this extension did not load. Its driver is likely outdated, this can cause internal hangs waiting for things that cannot happen, because there is no driver:

Kernel Extensions: ⓘ

/System/Library/Extensions

[not loaded] com.xxxchurch.x3nke (1.0.2 - SDK 10.7 - 2016-02-26) [Support]

you also have a lot of app crashes due to suggestd. This is related to spotlight suggestions. you may want to use system preferences > spotlight to reduce the number and type of solutions it is making.

Reply

Answer 3

Linc Davis

Level 10

209,739 points

Mar 12, 2016 4:56 PM in response to acm206

When you see a beachball cursor or the slowness is especially bad, note the exact time: hour, minute, second.

These instructions must be carried out as an administrator. If you have only one user account, you are the administrator.

Launch the Console application in any one of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

The title of the Console window should be All Messages. If it isn't, select

SYSTEM LOG QUERIES ▹ All Messages

from the log list on the left. If you don't see that list, select

View ▹ Show Log List

from the menu bar at the top of the screen.

Each message in the log begins with the date and time when it was entered. Scroll back to the time you noted above.

Select the messages entered from then until the end of the episode, or until they start to repeat, whichever comes first.

Copy the messages to the Clipboard by pressing the key combination command-C. Paste into a reply to this message by pressing command-V.

The log contains a vast amount of information, almost all of it useless for solving any particular problem. When posting a log extract, be selective. A few dozen lines are almost always more than enough.

Please don't indiscriminately dump thousands of lines from the log into this discussion.

Please don't post screenshots of log messages—post the text.

Some private information, such as your name, may appear in the log. Anonymize before posting.

When you post the log extract, you might see an error message on the web page: "You have included content in your post that is not permitted," or "The message contains invalid characters." That's a bug in the forum software. Please post the text on Pastebin, then post a link here to the page you created.

If you have an account on Pastebin, please don't select Private from the Paste Exposure menu on the page, because then no one but you will be able to see it.

Reply

Answer 4

etresoft

Level 9

56,990 points

Mar 12, 2016 5:22 PM in response to Grant Bennet-Alder

Hello Grant,

Early on, I had modified EtreCheck's adware detection so that it would be more compatible with AdwareMedic. I didn't want people to run EtreCheck, detect adware, and then have AdwareMedic say there wasn't any adware. But as I enhanced EtreCheck's adware capabilities, it diverged significantly from AdwareMedic/MalwareBytes so there was no point in trying to be compatible MalwareBytes' detection logic anymore.

So, I have restored some of EtreCheck's original adware detection functionality. In this case, it is detecting an adware Safari extension that only exists in cache. It probably isn't loaded in Safari anymore, but there is no way for EtreCheck to say for sure without digging into the user's keychain, and I don't want to go there. This isn't an EtreCheck vs. MalwareBytes issue either. I'm confident that MalwareBytes would have correctly removed the adware. But there are lots more anti-malware apps and many of them are just scam-ware.

So, EtreCheck now plays it safe. If it sees adware that it thinks it can delete safely, it will offer to do so. At this point, it may be just a harmless file on the user's hard disk, but deleting it may help avoid confusion in the future.

Reply

Answer 5

Mar 12, 2016 6:30 PM in response to etresoft

hey, etresoft!

So, EtreCheck now plays it safe. If it sees adware that it thinks it can delete safely, it will offer to do so.

Thanks for the extra explanation. I like your tool and I think it has a lot to offer, especially in uncovering what may be added to a system and a quick look at how its performing that does not require a degree in computer science.

I see this and several other tools as detective's helpers. The decisions and actions are still left to the user. Usually one adware will not kill performance or anything else, But I saw mention of adware in the report and wanted to point out that it had been seen.

I am more concerned that a Driver has not been loaded, and as KimUserName suggested, 61 minutes to run this really does suggest drive problems.

acm206 may also benefit from Linc Davis's offer to read a log from when the system is especially slow, which can sometimes zoom in on the issue at hand. in some cases, even better than all the other tools combined. But sometimes those logs are just baffling.

Reply

Answer 6

etresoft

Level 9

56,990 points

Mar 13, 2016 9:02 AM in response to Grant Bennet-Alder

Grant Bennet-Alder wrote:

But I saw mention of adware in the report and wanted to point out that it had been seen.

Yes. This is one of those situations where EtreCheck just reports what it finds. There is a possibility that it could cause some problems, but, in this case, isn't related to the primary issue.

I am more concerned that a Driver has not been loaded, and as KimUserName suggested, 61 minutes to run this really does suggest drive problems.

Yes. Unfortunately, as is typically the case, acm206 doesn't have a Time Machine backup. Kudos to KimUserName for jumping on that.

After making a backup, I think the next step would be to remove that X3Watch (http://x3watch.com/) software. acm206 says the problem happened suddenly. Maybe the hard drive failed. But maybe the driver failed. A low-level system modification like that can cause all kinds of problems.

acm206 may also benefit from Linc Davis's offer to read a log from when the system is especially slow, which can sometimes zoom in on the issue at hand. in some cases, even better than all the other tools combined. But sometimes those logs are just baffling.

Yes. Hopefully acm206 can pinpoint exactly when the problem happened.

Reply