Mail viewer window doesn't appear

Question

Level 1

4 points

Mail viewer window doesn't appear

This started happening recently on my father's 15" Retina Macbook Pro running El Capitan 10.11.3: when he starts Mail, the main viewer window does not appear.

It's there, but invisible: I know this because selecting "Minimize" from the [Windows] menu in mail makes it appear for a fraction of a second before it zooms down to the Dock. Once there, you can click on the Dock icon and it will zoom back onto the screen, after which things operate normally.

Until you reboot the computer, or quit and start Mail again.

Curiously enough, this problem doesn't occur when I boot the machine in Safe Mode. However, I've disabled all login items and the problem still occurs with a normal boot.

I've never seen anything like this and would be grateful for any hints or suggestions...

Posted on Mar 19, 2016 9:39 AM

Reply

Answer 1

Duane

Level 10

124,293 points

Mar 19, 2016 10:49 AM in response to dramsey

Try the following:

Quit Mail
Move ~/Library/Containers/com.apple.mail to the desktop.
Restart Mail
If Mail is working properly, delete the com.apple.mail that you had previously moved to the desktop.

Reply

Answer 2

Linc Davis

Level 10

209,739 points

Mar 19, 2016 11:56 AM in response to dramsey

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

The test works on OS X 10.8 ("Mountain Lion") and later. I don't recommend running it on older versions of OS X. It will do no harm, but it won't do much good either.

Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

2. If you don't already have a current backup, please back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.

You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.

In this case, however, there are ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone who understands the code can verify what it does.

You may not be able to understand the script yourself. But variations of it have been posted on this website many times over a period of years. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message. See, for example, this discussion.

Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.

4. Here's a general summary of what you need to do, if you choose to proceed:

☞ Copy the text of a particular web page (not this one) to the Clipboard.

☞ Paste into the window of another application.

☞ Wait for the test to run. It usually takes a few minutes.

☞ Paste the results, which will have been copied automatically, back into a reply on this page.

These are not specific instructions; just an overview. The details are in parts 7 and 8 of this comment. The sequence is: copy, paste, wait, paste again. You don't need to copy a second time.

5. Try to test under conditions that reproduce the problem, as far as possible. For example, if the computer is intermittently slow, run the test during a slowdown.

You may have started up in safe mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual before running it. If you can only test in safe mode, do that.

6. If you have more than one user, and only one user is affected by the problem,, and the affected user is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

7. Load this linked web page (on the website "Pastebin.") Press the key combination command-A to select all the text, then copy it to the Clipboard by pressing command-C.

8. Launch the built-in Terminal application in any one of the following ways:

☞ Enter the first few letters of its name ("Terminal") into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Click anywhere in the Terminal window to activate it. Paste from the Clipboard into the window by pressing command-V, then press return. The text you pasted should vanish immediately.

9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt. Again, the script will still run.

If the test is taking much longer than usual to run because the computer is very slow, you might be prompted for your password a second time. The authorization that you grant by entering it expires automatically after five minutes.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, a series of lines will appear in the Terminal window like this:

Test started

Part 1 of 4 done at: … sec
…
Part 4 of 4 done at: … sec

The test results are on the Clipboard.

Please close this window.

The intervals between parts won't be exactly equal, but they give a rough indication of progress.

Wait for the final message "Please close this window" to appear—again, usually within a few minutes. If you don't see that message within about 30 minutes, the test probably won't complete in a reasonable time. In that case, press the key combination control-C or command-period to stop it. Then go to the next step. You'll have incomplete results, but still something.

In order to get results, the test must either be allowed to complete or else manually stopped as above. If you close the Terminal window while the test is still running, the partial results won't be saved.

11. When the test is complete, or if you stopped it manually, quit Terminal. The results will have been saved to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "close this window" message. Please wait for it and try again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

12. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "The message contains invalid characters." That's a bug in the software that runs this website. Please post the test results on Pastebin, then post a link here to the page you created.

If you have an account on Pastebin, please don't select Private from the Paste Exposure menu on the page, because then no one but you will be able to see it.

13. When you're done with the test, it's gone. There is nothing to uninstall or clean up.

14. This is a public forum, and others may give you advice based on the results of the test. They speak for themselves, not for me. The test itself is harmless, but whatever else you do may not be. For others who choose to run it, I don't recommend that you post the test results on this website unless I asked you to.

15. The linked UNIX shell script bears a notice of copyright. Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

Reply

Answer 3

dramsey Author

Level 1

4 points

Mar 19, 2016 4:02 PM in response to Duane

Sadly, that didn't change the behavior of Mail-- although the new Mailer window (still only visible after being minimized and restored) had the default appearance and none of the customizations that had been applied.

Reply

Answer 4

dramsey Author

Level 1

4 points

Mar 19, 2016 4:04 PM in response to Linc Davis

{\rtf1\ansi\ansicpg1252\cocoartf1404\cocoasubrtf340

{\fonttbl\f0\fswiss\fcharset0 Helvetica;}

{\colortbl;\red255\green255\blue255;}

\margl1440\margr1440\vieww21720\viewh12500\viewkind0

\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx792 0\tx8640\pardirnatural\partightenfactor0

\f0\fs24 \cf0 1 Start time: 17:47:20 03/19/16\

2 \

3 Revision: 1544\

4 \

5 Model Identifier: MacBookPro10,1\

6 Boot ROM Version: MBP101.00EE.B0A\

7 System Version: OS X 10.11.3 (15D21)\

8 Kernel Version: Darwin 15.3.0\

9 Time since boot: 6:26\

10 \

11 UID: 502\

12 \

13 FileVault 2\

14 \

15 FileVault is On.\

16 \

17 I/O out, lifetime (KiB/s)\

18 \

19 kernel_task (UID 0): 1181\

20 \

21 Energy impact, lifetime (relative)\

22 \

23 Terminal (UID 502): 19.13\

24 \

25 CPU usage, lifetime (ms/s)\

26 \

27 Terminal (UID 502): 205.25\

28 \

29 LS schemes: No\

30 \

31 Font issues: 1\

32 \

33 Global prefs (system)\

34 \

35 MultipleSessionEnabled = 1\

36 \

37 Trust settings: admin 6, user 6\

38 \

39 HID errors: 12\

40 \

41 Kernel log\

42 \

43 Mar 19 11:10:24 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1 \

44 Mar 19 11:21:03 IO80211ControllerMonitor::configureSubscriptions() failed to add subscriptionIO80211Controller::start _controller is 0x40ad082f2891ae85, provider is 0x40ad082e69a12185\

45 Mar 19 11:21:03 init: error getting PHY_MODE; using MODE_UNKNOWN\

46 Mar 19 11:21:03 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized\

47 Mar 19 11:21:13 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1 \

48 Mar 19 11:21:16 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1 \

49 Mar 19 11:21:32 pci pause: SDXC\

50 Mar 19 11:21:40 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1 \

51 Mar 19 11:22:40 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1 \

52 Mar 19 11:26:30 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1 \

53 Mar 19 11:30:34 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1 \

54 Mar 19 11:50:06 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized\

55 Mar 19 11:50:09 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1 \

56 Mar 19 12:44:24 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized\

57 Mar 19 17:35:49 USBF: 828.943 IOUSBHIDDriver(AppleUSBMultitouchDriver)::RearmInterruptRead returning error 0xe00002d8 (device is not ready), not issuing any reads to device\

58 Mar 19 17:35:49 000829.142346 PRT1@1d181000: AppleUSB20HubPort::clearPipeStallGated: unable to raise port power state from 1\

59 Mar 19 17:35:49 000829.644423 PRT1@1d181000: AppleUSB20HubPort::clearPipeStallGated: unable to raise port power state from 1\

60 Mar 19 17:35:49 000829.644796 PRT1@1d181000: AppleUSB20HubPort::clearPipeStallGated: unable to raise port power state from 0\

61 Mar 19 17:35:50 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized\

62 Mar 19 17:36:24 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1 \

63 Mar 19 17:38:31 AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized\

64 Mar 19 17:39:16 pci pause: SDXC\

65 Mar 19 17:40:12 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1 \

66 Mar 19 17:43:49 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1 \

67 Mar 19 17:45:51 **** [IOBluetoothHostControllerUSBTransport][InterruptReadHandler] -- Received kIOReturnNotResponding error - retrying: 1 \

68 \

69 System log\

70 \

71 Mar 19 17:46:52 Finder: CGContextDrawPath: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

72 Mar 19 17:46:52 Finder: CGContextRestoreGState: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

73 Mar 19 17:46:52 Finder: CGContextConcatCTM: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

74 Mar 19 17:46:52 Finder: CGContextSaveGState: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

75 Mar 19 17:46:52 Finder: CGContextGetCTM: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

76 Mar 19 17:46:52 Finder: CGContextGetDefaultUserSpaceToDeviceSpaceTransform: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

77 Mar 19 17:46:52 Finder: CGContextDrawImage: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

78 Mar 19 17:46:52 Finder: CGContextRestoreGState: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

79 Mar 19 17:46:52 Finder: CGContextSetCMYKFillColor: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

80 Mar 19 17:46:52 Finder: CGContextSetCMYKStrokeColor: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

81 Mar 19 17:46:52 Finder: CGContextSaveGState: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

82 Mar 19 17:46:52 Finder: CGContextSetFlatness: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

83 Mar 19 17:46:52 Finder: CGContextMoveToPoint: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

84 Mar 19 17:46:52 Finder: CGContextAddLineToPoint: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

85 Mar 19 17:46:52 Finder: CGContextAddCurveToPoint: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

86 Mar 19 17:46:52 Finder: CGContextAddLineToPoint: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

87 Mar 19 17:46:52 Finder: CGContextAddCurveToPoint: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

88 Mar 19 17:46:52 Finder: CGContextAddLineToPoint: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

89 Mar 19 17:46:52 Finder: CGContextAddCurveToPoint: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

90 Mar 19 17:46:52 Finder: CGContextAddLineToPoint: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

91 Mar 19 17:46:52 Finder: CGContextAddCurveToPoint: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

92 Mar 19 17:46:52 Finder: CGContextClosePath: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

93 Mar 19 17:46:52 Finder: CGContextMoveToPoint: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

94 Mar 19 17:46:52 Finder: CGContextDrawPath: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

95 Mar 19 17:46:52 Finder: CGContextRestoreGState: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.\

96 \

97 launchd log\

98 \

99 Mar 19 10:56:04 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose\

100 Mar 19 10:57:51 : Failed to remove file or directory: name = dyld_shared_cache_x86_64, error = 1: Operation not permitted. Further logging suppressed.\

101 Mar 19 10:57:51 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose\

102 Mar 19 10:57:58 com.apple.xpc.launchd.user.domain.502.100007.Aqua: Could not import service from caller: caller = otherbsd.275, service = com.garmin.renu.service, error = 119: Service is disabled\

103 Mar 19 10:58:02 com.jdibackup.ZipCloud.autostart: Service could not initialize: 15D21: xpcproxy + 12644 [1472][UUID]: 0xd\

104 Mar 19 10:59:58 : Failed to remove file or directory: name = dyld_shared_cache_x86_64, error = 1: Operation not permitted. Further logging suppressed.\

105 Mar 19 10:59:58 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose\

106 Mar 19 11:00:05 com.apple.xpc.launchd.user.domain.502.100007.Aqua: Could not import service from caller: caller = otherbsd.274, service = com.garmin.renu.service, error = 119: Service is disabled\

107 Mar 19 11:00:07 com.jdibackup.ZipCloud.autostart: Service could not initialize: 15D21: xpcproxy + 12644 [1472][UUID]: 0xd\

108 Mar 19 11:01:13 : Failed to remove file or directory: name = dyld_shared_cache_x86_64, error = 1: Operation not permitted. Further logging suppressed.\

109 Mar 19 11:01:13 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose\

110 Mar 19 11:01:19 com.apple.xpc.launchd.user.domain.502.100007.Aqua: Could not import service from caller: caller = otherbsd.271, service = com.garmin.renu.service, error = 119: Service is disabled\

111 Mar 19 11:01:22 com.jdibackup.ZipCloud.autostart: Service could not initialize: 15D21: xpcproxy + 12644 [1472][UUID]: 0xd\

112 Mar 19 11:02:37 : Failed to remove file or directory: name = dyld_shared_cache_x86_64, error = 1: Operation not permitted. Further logging suppressed.\

113 Mar 19 11:02:37 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose\

114 Mar 19 11:02:43 com.apple.xpc.launchd.user.domain.502.100007.Aqua: Could not import service from caller: caller = otherbsd.269, service = com.garmin.renu.service, error = 119: Service is disabled\

115 Mar 19 11:02:45 com.jdibackup.ZipCloud.autostart: Service could not initialize: 15D21: xpcproxy + 12644 [1472][UUID]: 0xd\

116 Mar 19 11:05:41 : Failed to remove file or directory: name = dyld_shared_cache_x86_64, error = 1: Operation not permitted. Further logging suppressed.\

117 Mar 19 11:05:41 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose\

118 Mar 19 11:05:48 com.apple.xpc.launchd.user.domain.502.100007.Aqua: Could not import service from caller: caller = otherbsd.248, service = com.garmin.renu.service, error = 119: Service is disabled\

119 Mar 19 11:05:52 com.jdibackup.ZipCloud.autostart: Service could not initialize: 15D21: xpcproxy + 12644 [1472][UUID]: 0xd\

120 Mar 19 11:21:03 : Failed to remove file or directory: name = dyld_shared_cache_x86_64, error = 1: Operation not permitted. Further logging suppressed.\

121 Mar 19 11:21:03 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose\

122 Mar 19 11:21:09 com.apple.xpc.launchd.user.domain.502.100007.Aqua: Could not import service from caller: caller = otherbsd.244, service = com.garmin.renu.service, error = 119: Service is disabled\

123 Mar 19 11:21:14 com.jdibackup.ZipCloud.autostart: Service could not initialize: 15D21: xpcproxy + 12644 [1472][UUID]: 0xd\

124 \

125 Loaded kernel extensions\

126 \

127 com.avast.AvastFileShield (3.0.0)\

128 com.avast.PacketForwarder (2.0)\

129 \

130 System services loaded\

131 \

132 com.adobe.ARMDC.Communicator\

133 com.adobe.ARMDC.SMJobBlessHelper\

134 com.adobe.fpsaud\

135 com.apple.logd\

136 - status: 1\

137 com.apple.watchdogd\

138 com.avast.crashreport\

139 com.avast.daemon\

140 com.avast.fileshield\

141 com.avast.init\

142 com.avast.proxy\

143 com.avast.service\

144 com.avast.uninstall\

145 com.avast.update\

146 com.microsoft.office.licensing.helper\

147 com.period.searchprotectd\

148 - status: 78\

149 \

150 Login services loaded\

151 \

152 2BUA8C4S2C.com.agilebits.onepassword-osx-helper\

153 com.adobe.ARMDCHelper.UUID\

154 - status: 111\

155 com.avast.helper\

156 com.avast.home.userinit\

157 com.avast.update-agent\

158 com.avast.userinit\

159 com.epson.eventmanager.agent\

160 com.hp.printerAgent\

161 com.jdibackup.ZipCloud.autostart\

162 - status: 78\

163 com.rcg.ForecastBarHelper\

164 - status: 78\

165 \

166 Login services disabled\

167 \

168 com.genieo.completer.ltvbit\

169 com.genieo.completer.download\

170 com.genieo.completer.update\

171 \

172 User services disabled\

173 \

174 com.genieo.completer.ltvbit\

175 com.genieo.completer.download\

176 com.genieo.completer.update\

177 \

178 Contents of /Library/LaunchAgents/com.adobe.ARMDCHelper.UUID.plist\

179 - mod date: Oct 13 15:44:50 2015\

180 - size (B): 577\

181 - checksum: 2197523146\

182 \

183 <?xml version="1.0" encoding="UTF-8"?>\

184 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\

185 <plist version="1.0">\

186 <dict>\

187 <key>Label</key>\

188 <string>com.adobe.ARMDCHelper.UUID</string>\

189 <key>ProgramArguments</key>\

190 <array>\

191 <string>/Library/Application Support/Adobe/ARMDC/Application/Acrobat Update Helper.app/Contents/MacOS/Acrobat Update Helper</string>\

192 </array>\

193 <key>RunAtLoad</key>\

194 <true/>\

195 <key>StartInterval</key>\

196 <integer>12600</integer>\

197 </dict>\

198 </plist>\

199 \

200 Contents of /Library/LaunchAgents/com.avast.update-agent.plist\

201 - mod date: Feb 19 11:33:31 2016\

202 - size (B): 693\

203 - checksum: 2727993476\

204 \

205 <?xml version="1.0" encoding="UTF-8"?>\

206 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\

207 <plist version="1.0">\

208 <dict>\

209 <key>KeepAlive</key>\

210 <true/>\

211 <key>Label</key>\

212 <string>com.avast.update-agent</string>\

213 <key>Program</key>\

214 <string>/Library/Application Support/Avast/components/update/com.avast.update-agent</string>\

215 <key>RunAtLoad</key>\

216 <true/>\

217 <key>AbandonProcessGroup</key>\

218 <true/>\

219 <key>StandardErrorPath</key>\

220 <string>/dev/null</string>\

221 <key>StandardOutPath</key>\

222 <string>/dev/null</string>\

223 </dict>\

224 </plist>\

225 \

226 Contents of /Library/LaunchAgents/com.avast.userinit.plist\

227 - mod date: Feb 19 11:33:31 2016\

228 - size (B): 436\

229 - checksum: 84920623\

230 \

231 <?xml version="1.0" encoding="UTF-8"?>\

232 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\

233 <plist version="1.0">\

234 <dict>\

235 <key>Label</key>\

236 <string>com.avast.userinit</string>\

237 <key>Program</key>\

238 <string>/Library/Application Support/Avast/hub/userinit.sh</string>\

239 <key>KeepAlive</key>\

240 <false/>\

241 <key>RunAtLoad</key>\

242 <true/>\

243 <key>AbandonProcessGroup</key>\

244 <true/>\

245 </dict>\

246 </plist>\

247 \

248 Contents of /Library/LaunchDaemons/com.avast.init.plist\

249 - mod date: Feb 19 11:33:31 2016\

250 - size (B): 571\

251 - checksum: 17654464\

252 \

253 <?xml version="1.0" encoding="UTF-8"?>\

254 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\

255 <plist version="1.0">\

256 <dict>\

257 <key>KeepAlive</key>\

258 <false/>\

259 <key>AbandonProcessGroup</key>\

260 <true/>\

261 <key>Label</key>\

262 <string>com.avast.init</string>\

263 <key>ProgramArguments</key>\

264 <array>\

265 <string>/Library/Application Support/Avast/hub/init.sh</string>\

266 </array>\

267 <key>RunAtLoad</key>\

268 <true/>\

269 <key>StandardErrorPath</key>\

270 <string>/dev/null</string>\

271 <key>StandardOutPath</key>\

272 <string>/dev/null</string>\

273 </dict>\

274 </plist>\

275 \

276 Contents of /Library/LaunchDaemons/com.avast.uninstall.plist\

277 - mod date: Feb 19 11:33:31 2016\

278 - size (B): 685\

279 - checksum: 3425227779\

280 \

281 <?xml version="1.0" encoding="UTF-8"?>\

282 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\

283 <plist version="1.0">\

284 <dict>\

285 <key>KeepAlive</key>\

286 <dict>\

287 <key>PathState</key>\

288 <dict>\

289 <key>/Applications/Avast.app</key>\

290 <false/>\

291 </dict>\

292 </dict>\

293 <key>AbandonProcessGroup</key>\

294 <true/>\

295 <key>Label</key>\

296 <string>com.avast.uninstall</string>\

297 <key>ProgramArguments</key>\

298 <array>\

299 <string>/Library/Application Support/Avast/hub/autouninstall.sh</string>\

300 </array>\

301 <key>RunAtLoad</key>\

302 <false/>\

303 <key>StandardErrorPath</key>\

304 <string>/dev/null</string>\

305 <key>StandardOutPath</key>\

306 \

307 ...and 3 more line(s)\

308 \

309 Contents of /Library/LaunchDaemons/com.avast.update.plist\

310 - mod date: Feb 19 11:33:31 2016\

311 - size (B): 694\

312 - checksum: 3870293393\

313 \

314 <?xml version="1.0" encoding="UTF-8"?>\

315 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\

316 <plist version="1.0">\

317 <dict>\

318 <key>KeepAlive</key>\

319 <false/>\

320 <key>AbandonProcessGroup</key>\

321 <true/>\

322 <key>Label</key>\

323 <string>com.avast.update</string>\

324 <key>ProgramArguments</key>\

325 <array>\

326 <string>/Library/Application Support/Avast/components/update/update.sh</string>\

327 </array>\

328 <key>StartInterval</key>\

329 <integer>600</integer>\

330 <key>ThrottleInterval</key>\

331 <integer>10800</integer>\

332 <key>RunAtLoad</key>\

333 <false/>\

334 <key>StandardErrorPath</key>\

335 <string>/dev/null</string>\

336 <key>StandardOutPath</key>\

337 <string>/dev/null</string>\

338 </dict>\

339 \

340 ...and 1 more line(s)\

341 \

342 Contents of /Library/LaunchDaemons/com.perion.searchprotectd.plist\

343 - mod date: Nov 1 18:10:08 2014\

344 - size (B): 571\

345 - checksum: 1209345832\

346 \

347 <?xml version="1.0" encoding="UTF-8"?>\

348 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\

349 <plist version="1.0">\

350 <dict>\

351 <key>AbandonProcessGroup</key>\

352 <true/>\

353 <key>EnableTransactions</key>\

354 <false/>\

355 <key>ProgramArguments</key>\

356 <array>\

357 <string>/Applications/SearchProtect/SearchProtect.app/Contents/MacOS/SearchProt ect</string>\

358 <string>-execv_instance</string>\

359 </array>\

360 <key>KeepAlive</key>\

361 <true/>\

362 <key>RunAtLoad</key>\

363 <true/>\

364 <key>Label</key>\

365 <string>com.period.searchprotectd</string>\

366 </dict>\

367 </plist>\

368 \

369 Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist\

370 - mod date: Nov 1 10:33:26 2014\

371 - size (B): 603\

372 - checksum: 394026997\

373 \

374 <?xml version="1.0" encoding="UTF-8"?>\

375 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\

376 <plist version="1.0">\

377 <dict>\

378 <key>Label</key>\

379 <string>com.adobe.ARM.UUID</string>\

380 <key>ProgramArguments</key>\

381 <array>\

382 <string>/Applications/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper</string>\

383 <string>semi-auto</string>\

384 </array>\

385 <key>RunAtLoad</key>\

386 <true/>\

387 <key>StartInterval</key>\

388 <integer>12600</integer>\

389 </dict>\

390 </plist>\

391 \

392 Contents of Library/LaunchAgents/com.apple.MobileMeSyncClientAgent.plist\

393 - mod date: Feb 27 17:10:20 2011\

394 - size (B): 581\

395 - checksum: 1629790972\

396 \

397 <?xml version="1.0" encoding="UTF-8"?>\

398 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\

399 <plist version="1.0">\

400 <dict>\

401 <key>Label</key>\

402 <string>com.apple.MobileMeSyncClientAgent</string>\

403 <key>LimitLoadToSessionType</key>\

404 <string>Aqua</string>\

405 <key>ProgramArguments</key>\

406 <array>\

407 <string>/System/Library/PrivateFrameworks/DotMacSyncManager.framework/Resources /mobilemesyncclient</string>\

408 <string>--sync</string>\

409 <string>--periodic</string>\

410 </array>\

411 <key>StartInterval</key>\

412 <integer>3600</integer>\

413 </dict>\

414 </plist>\

415 \

416 Contents of Library/LaunchAgents/com.apple.SafariBookmarksSyncer.plist\

417 - mod date: Feb 14 17:58:45 2009\

418 - size (B): 815\

419 - checksum: 1060411572\

420 \

421 <?xml version="1.0" encoding="UTF-8"?>\

422 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\

423 <plist version="1.0">\

424 <dict>\

425 <key>Label</key>\

426 <string>com.apple.Safari</string>\

427 <key>LimitLoadToSessionType</key>\

428 <string>Aqua</string>\

429 <key>ProgramArguments</key>\

430 <array>\

431 <string>/Applications/Safari.app/Contents/SafariSyncClient.app/Contents/MacOS/S afariSyncClient</string>\

432 <string>--sync</string>\

433 <string>com.apple.Safari</string>\

434 <string>--entitynames</string>\

435 <string>com.apple.bookmarks.Bookmark,com.apple.bookmarks.Folder</string>\

436 </array>\

437 <key>RunAtLoad</key>\

438 <false/>\

439 <key>ThrottleInterval</key>\

440 <integer>60</integer>\

441 <key>WatchPaths</key>\

442 <array>\

443 <string>/Users/USER/Library/Safari/Bookmarks.plist</string>\

444 </array>\

445 </dict>\

446 \

447 ...and 1 more line(s)\

448 \

449 Contents of Library/LaunchAgents/com.avast.home.userinit.plist\

450 - mod date: Feb 19 11:33:31 2016\

451 - size (B): 485\

452 - checksum: 286408078\

453 \

454 <?xml version="1.0" encoding="UTF-8"?>\

455 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\

456 <plist version="1.0">\

457 <dict>\

458 <key>Label</key>\

459 <string>com.avast.home.userinit</string>\

460 <key>ProgramArguments</key>\

461 <array>\

462 <string>/Users/USER/Library/Application Support/Avast/hub/userinit.sh</string>\

463 </array>\

464 <key>KeepAlive</key>\

465 <false/>\

466 <key>RunAtLoad</key>\

467 <true/>\

468 <key>AbandonProcessGroup</key>\

469 <true/>\

470 </dict>\

471 </plist>\

472 \

473 Contents of Library/LaunchAgents/com.hp.printerAgent.plist\

474 - mod date: Aug 30 04:10:29 2011\

475 - size (B): 724\

476 - checksum: 2038933932\

477 \

478 <?xml version="1.0" encoding="UTF-8"?>\

479 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\

480 <plist version="1.0">\

481 <dict>\

482 <key>Label</key>\

483 <string>com.hp.printerAgent</string>\

484 <key>OnDemand</key>\

485 <false/>\

486 <key>Program</key>\

487 <string>/Library/Printers/hp/laserjet/P1100_1560_1600Series/printerAgent</strin g>\

488 <key>ProgramArguments</key>\

489 <array>\

490 <string>/Library/Printers/hp/laserjet/P1100_1560_1600Series/printerAgent</strin g>\

491 </array>\

492 <key>RunAtLoad</key>\

493 <true/>\

494 <key>ServiceIPC</key>\

495 <true/>\

496 <key>Sockets</key>\

497 <dict>\

498 <key>MyListenerSocket</key>\

499 <dict>\

500 <key>SockServiceName</key>\

501 <string>51100</string>\

502 </dict>\

503 \

504 ...and 3 more line(s)\

505 \

506 Contents of Library/LaunchAgents/com.jdibackup.ZipCloud.autostart.plist\

507 - mod date: Feb 19 10:41:06 2015\

508 - size (B): 870\

509 - checksum: 2452494858\

510 \

511 <?xml version="1.0" encoding="UTF-8"?>\

512 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\

513 <plist version="1.0">\

514 <dict>\

515 <key>Label</key>\

516 <string>com.jdibackup.ZipCloud.autostart</string>\

517 <key>ProgramArguments</key>\

518 <array>\

519 <string>open</string>\

520 <string>/Applications/ZipCloud.app/Contents/Resources/Utility.app</string>\

521 <string>-n</string>\

522 <string>--args</string>\

523 <string>9</string>\

524 <string>-l</string>\

525 </array>\

526 <key>StandardOutPath</key>\

527 <string>/Applications/ZipCloud.app/Contents/Resources/lib/python2.7/logs/launch agent_out.log</string>\

528 <key>StandardErrorPath</key>\

529 <string>/Applications/ZipCloud.app/Contents/Resources/lib/python2.7/logs/launch agent_err.log</string>\

530 <key>RunAtLoad</key>\

531 <true/>\

532 </dict>\

533 </plist>\

534 \

535 Unreadable plists\

536 \

537 /Library/Preferences/com.epson.Epson Event Manager.UnInstallList.plist\

538 /Library/Preferences/com.epson.Epson Scanner ICA Driver.UnInstallList.plist\

539 /Library/Preferences/com.epson.Inkjet Printer Driver.UnInstallList.plist\

540 /Library/Preferences/com.epson.PC-FAX Driver.UnInstallList.plist\

541 Library/Preferences/ByHost/com.apple.Classic.001b6394514a.plist\

542 Library/Preferences/ByHost/com.apple.networkConnect.001b6394514a.plist\

543 Library/Preferences/ByHost/com.apple.print.PrintCenter.001b6394514a.plist\

544 \

545 User login items\

546 \

547 Activity Monitor\

548 - /Applications/Utilities/Activity Monitor.app\

549 \

550 Safari extensions\

551 \

552 1Password\

553 - com.agilebits.onepassword4-safari\

554 Open in Internet Explorer\

555 - com.parallels.openinie\

556 \

557 Widgets\

558 \

559 RadarInMotion\

560 \

561 iCloud services\

562 \

563 MOBILE_DOCUMENTS\

564 PHOTO_STREAM\

565 MAIL_AND_NOTES\

566 CONTACTS\

567 CALENDAR\

568 REMINDERS\

569 BOOKMARKS\

570 NOTES\

571 KEYCHAIN_SYNC\

572 FIND_MY_MAC\

573 \

574 iCloud errors\

575 \

576 comapple.CloudPhotosConfiguration 13\

577 cloudphotosd 10\

578 Finder 8\

579 cloudd 6\

580 bird 5\

581 \

582 Continuity errors\

583 \

584 sharingd 47\

585 \

586 Restrictive permissions: 42\

587 \

588 Lockfiles: 138\

589 \

590 Global prefs (user)\

591 \

592 NSTimeFormatString = "%1I:%M:%S"\

593 "NSWindow Frame NXOpenPanel" = "257 212 430 372 0 0 1280 832 "\

594 "NSWindow Frame NXSavePanel" = "425 335 430 407 0 0 1280 832 "\

595 \

596 Accessibility\

597 \

598 Keyboard Zoom: On\

599 Scroll Zoom: On\

600 \

601 Extensions\

602 \

603 /Library/Extensions/BJUSBLoad.kext\

604 - jp.co.canon.bj.print.BJUSBLoad\

605 - Canon Inc. (XE2XNRRXZ5)\

606 /Library/Extensions/CIJUSBLoad.kext\

607 - jp.co.canon.ij.print.CIJUSBLoad\

608 - Canon Inc. (XE2XNRRXZ5)\

609 /Library/Extensions/EPSONUSBPrintClass.kext\

610 - com.epson.print.kext.USBPrintClass\

611 - EPSON (TXAEAV5RN4)\

612 /Library/Extensions/hp_io_enabler_compound.kext\

613 - com.hp.kext.io.enabler.compound\

614 - Hewlett Packard (6HB5Y2QTA3)\

615 /System/Library/Extensions/BJUSBLoad.kext\

616 - jp.co.canon.bj.print.BJUSBLoad\

617 /System/Library/Extensions/JMicronATA.kext\

618 - com.jmicron.JMicronATA\

619 /System/Library/Extensions/Lexmark X422.kext\

620 - com.lexmark.iokit.x422scanner\

621 /System/Library/Extensions/USBGenericPrinterClass.kext\

622 - com.marvell.kext.USBGenericPrinterClass\

623 /System/Library/Extensions/hp_Inkjet3_io_enabler.kext\

624 - com.hp.print.hpio.Inkjet3.kext\

625 /System/Library/Extensions/hp_Inkjet_io_enabler.kext\

626 - com.hp.print.hpio.Inkjet.kext\

627 /System/Library/Extensions/hp_Photosmart_io_enabler.kext\

628 - com.hp.print.hpio.Photosmart.kext\

629 /System/Library/Extensions/hp_fax_io.kext\

630 - com.hp.kext.hp-fax-io\

631 \

632 Applications\

633 \

634 /Applications/Avast.app\

635 - com.avast.AAFM\

636 - AVAST Software a.s. (6H4HRTU5E3)\

637 /Library/Application Support/Avast/components/helper/com.avast.helper.app\

638 - com.avast.helper\

639 - AVAST Software a.s. (6H4HRTU5E3)\

640 /Library/Application Support/Avast/components/uninstall/com.avast.uninstall.app\

641 - com.avast.uninstall\

642 - AVAST Software a.s. (6H4HRTU5E3)\

643 \

644 Frameworks\

645 \

646 /Library/Frameworks/Adobe AIR.framework\

647 - com.adobe.AIR\

648 /Library/Frameworks/FxPlug.framework\

649 - com.apple.fxplugframework\

650 /Library/Frameworks/HPSmartX.framework\

651 - com.hp.hpio.SmartX\

652 /Library/Frameworks/MacFUSE.framework\

653 - com.google.MacFUSE\

654 /Library/Frameworks/ProFX.framework\

655 - com.apple.ProFX\

656 /Library/Frameworks/StuffIt.framework\

657 - com.stuffit.sdk\

658 /Library/Frameworks/XPrint2ModemCtrAPI.framework\

659 - XPri\

660 /Library/Frameworks/iMoviePluginAPI.framework\

661 - com.apple.iMoviePluginAPI\

662 \

663 PrefPane\

664 \

665 /Library/PreferencePanes/Flash Player.prefPane\

666 - com.adobe.flashplayerpreferences\

667 /Library/PreferencePanes/Flip4Mac WMV.prefPane\

668 - net.telestream.wmv.prefpane\

669 /Library/PreferencePanes/MacFUSE.prefPane\

670 - com.google.MacFUSE\

671 \

672 Bundles\

673 \

674 /Library/Application Support/Hewlett-Packard/Widgets/HP Ink Widget.wdgt\

675 - com.hp.widget.inkwidget\

676 /Library/Application Support/ProApps/Internal Plug-Ins/ProFX/FxPlugWrapper.plugin\

677 - com.apple.QuartzComposer.FxPlugWrapper\

678 /Library/Filesystems/fusefs.fs\

679 - com.google.filesystems.fusefs\

680 /Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/AdobeCP.plugin\

681 - com.adobe.adobecp\

682 /Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/Flash Player.plugin\

683 - com.macromedia.Flash Player.plugin\

684 /Library/Frameworks/HPSmartX.framework/Versions/A/Plugins/CifsPlugins/HPCifsSer vice.plugin\

685 - com.hp.aio.smartx.plugin.DefaultCifsService\

686 /Library/Frameworks/HPSmartX.framework/Versions/A/Plugins/CopyPlugins/CIACopy.p lugin\

687 - com.hp.CIACopy\

688 /Library/Frameworks/HPSmartX.framework/Versions/A/Plugins/DeviceDetailsPlugins/ CIAPMLService.plugin\

689 - com.hp.CIAPMLService\

690 /Library/Frameworks/HPSmartX.framework/Versions/A/Plugins/DeviceDetailsPlugins/ HPHDTPlugin.plugin\

691 - com.hp.aio.smartx.plugin.DeviceDetailsDefault\

692 /Library/Frameworks/HPSmartX.framework/Versions/A/Plugins/DeviceManagerPlugins/ BonjourDiscoveryManager.plugin\

693 - com.hp.aio.smartx.plugin.bonjourdiscoverymanager\

694 /Library/Frameworks/HPSmartX.framework/Versions/A/Plugins/DeviceManagerPlugins/ HPDeviceManager.plugin\

695 - com.hp.aio.smartx.plugin.DeviceManager\

696 /Library/Frameworks/HPSmartX.framework/Versions/A/Plugins/FaxPlugins/HPDot4Scan .plugin\

697 - com.hp.HPDot4Scan\

698 /Library/Frameworks/HPSmartX.framework/Versions/A/Plugins/FaxPlugins/HPFaxPlugi n.plugin\

699 - com.hp.aio.HPFaxPlugin\

700 /Library/Frameworks/HPSmartX.framework/Versions/A/Plugins/ScanPlugins/HPDot4Sca n.plugin\

701 - com.hp.HPDot4Scan\

702 /Library/Frameworks/HPSmartX.framework/Versions/A/Plugins/ScanPlugins/XorbScan. plugin\

703 - com.hp.XorbScan\

704 /Library/Frameworks/HPSmartX.framework/Versions/A/Plugins/WifiPlugins/HPWifiPlu gin_CIA.plugin\

705 - com.hp.aio.smartx.plugin.HPWifiPlugin_CIA\

706 /Library/Internet Plug-Ins (Disabled)/Flash Player.plugin\

707 - com.macromedia.Flash Player.plugin\

708 - Software Signing\

709 /Library/Internet Plug-Ins/AdobePDFViewer.plugin\

710 - com.adobe.acrobat.pdfviewer\

711 - Adobe Systems, Inc.\

712 /Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin\

713 - com.adobe.acrobat.pdfviewerNPAPI\

714 - Adobe Systems, Inc.\

715 /Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin\

716 - net.telestream.wmv.plugin\

717 /Library/Internet Plug-Ins/GarminGpsControl.plugin\

718 - com.garmin.GarminGpsControl\

719 /Library/Internet Plug-Ins/OfficeLiveBrowserPlugin.plugin\

720 - com.microsoft.officelive.browserplugin\

721 /Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin\

722 - com.microsoft.sharepoint.browserplugin\

723 /Library/Internet Plug-Ins/Silverlight.plugin\

724 - com.microsoft.SilverlightPlugin\

725 /Library/Internet Plug-Ins/iPhotoPhotocast.plugin\

726 - com.apple.plugin.iPhotoPhotocast\

727 - Software Signing\

728 /Library/Spotlight/Microsoft Entourage.mdimporter\

729 - com.microsoft.entourageMDImporter\

730 /Library/Spotlight/iWeb.mdimporter\

731 - com.apple.MDImporter.iWeb\

732 - Software Signing\

733 /Users/USER/Library/Address Book Plug-Ins/SkypeABDialer.bundle\

734 - com.skype.skypeabdialer\

735 /Users/USER/Library/Address Book Plug-Ins/SkypeABSMS.bundle\

736 - com.skype.skypeabsms\

737 /Users/USER/Library/Application Support/MacKeeper Helper/NoticeEngine.plugin\

738 - com.zeobit.MacKeeper.plugin.NoticeEngine\

739 - ZeoBIT LLC\

740 /Users/USER/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin\

741 - com.conduit.ConduitNPAPIPlugin\

742 /Users/USER/Library/Widgets/Air Traffic Control.wdgt\

743 - com.spintriplet.widget.airtrafficcontrol\

744 /Users/USER/Library/Widgets/EasyEnvelopes.wdgt\

745 - com.ambrosiasw.widget.easyenvelopes\

746 /Users/USER/Library/Widgets/HP Ink Widget.wdgt\

747 - com.hp.widget.inkwidget\

748 /Users/USER/Library/Widgets/QuickEntry.wdgt\

749 - com.intuit.widget.quickentry\

750 /Users/USER/Library/Widgets/RadarInMotion.wdgt\

751 - com.kamalaboulhosn.radarinmotion\

752 \

753 Bundles (new)\

754 \

755 /Library/Internet Plug-Ins/Flash Player.plugin\

756 - com.macromedia.Flash Player.plugin\

757 - Adobe Systems, Inc.\

758 /Library/PreferencePanes/Flash Player.prefPane\

759 - com.adobe.flashplayerpreferences\

760 /System/Library/Intelligent Suggestions/Assets.suggestionsassets\

761 - com.apple.MobileAsset.CoreSuggestions\

762 - Software Signing\

763 /Users/USER/Documents/Jack's Stuff/My Documents/Quicken/Quicken 2006\

764 - com.intuit.quicken\

765 /Users/USER/Documents/Jack's Stuff/My Documents/Quicken/Quicken 2006/Contents/Frameworks/DotMacKit.framework\

766 - com.apple.DotMacKit\

767 /Users/USER/Documents/Jack's Stuff/My Documents/Quicken/Quicken 2006/Contents/SupportApps/Emergency Records Organizer\

768 - com.intuit.ero\

769 /Users/USER/Documents/Jack's Stuff/My Documents/Quicken/Quicken 2006/Contents/SupportApps/Emergency Records Organizer/Contents/Resources/EROCurl.bundle\

770 - com.intuit.ero.EROCurl\

771 /Users/USER/Documents/Jack's Stuff/My Documents/computer/INSTALLERS/OS X HP Inkjet Installer\

772 - com.MindVision.InstallerVISE\

773 \

774 Library paths\

775 \

776 /Library/Application Support/Avast/components/proxy/certutil/libfreebl3.dylib\

777 - com.avast.libfreebl3\

778 - AVAST Software a.s. (6H4HRTU5E3)\

779 /Library/Application Support/Avast/components/proxy/certutil/libnspr4.dylib\

780 - com.avast.libnspr4\

781 - AVAST Software a.s. (6H4HRTU5E3)\

782 /Library/Application Support/Avast/components/proxy/certutil/libnss3.dylib\

783 - com.avast.libnss3\

784 - AVAST Software a.s. (6H4HRTU5E3)\

785 /Library/Application Support/Avast/components/proxy/certutil/libnssdbm3.dylib\

786 - com.avast.libnssdbm3\

787 - AVAST Software a.s. (6H4HRTU5E3)\

788 /Library/Application Support/Avast/components/proxy/certutil/libnssutil3.dylib\

789 - com.avast.libnssutil3\

790 - AVAST Software a.s. (6H4HRTU5E3)\

791 /Library/Application Support/Avast/components/proxy/certutil/libplc4.dylib\

792 - com.avast.libplc4\

793 - AVAST Software a.s. (6H4HRTU5E3)\

794 /Library/Application Support/Avast/components/proxy/certutil/libplds4.dylib\

795 - com.avast.libplds4\

796 - AVAST Software a.s. (6H4HRTU5E3)\

797 /Library/Application Support/Avast/components/proxy/certutil/libsmime3.dylib\

798 - com.avast.libsmime3\

799 - AVAST Software a.s. (6H4HRTU5E3)\

800 /Library/Application Support/Avast/components/proxy/certutil/libsoftokn3.dylib\

801 - com.avast.libsoftokn3\

802 - AVAST Software a.s. (6H4HRTU5E3)\

803 /Library/Application Support/Avast/components/proxy/certutil/libssl3.dylib\

804 - com.avast.libssl3\

805 - AVAST Software a.s. (6H4HRTU5E3)\

806 /Library/Application Support/Avast/lib/libcrypto.1.0.0.dylib\

807 - libcrypto.1\

808 - AVAST Software a.s. (6H4HRTU5E3)\

809 /Library/Application Support/Avast/lib/libprotobuf-lite.8.dylib\

810 - libprotobuf-lite.8\

811 - AVAST Software a.s. (6H4HRTU5E3)\

812 /Library/Application Support/Avast/lib/libssl.1.0.0.dylib\

813 - libssl.1\

814 - AVAST Software a.s. (6H4HRTU5E3)\

815 /Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/WebKit.dylib\

816 /Library/Frameworks/MacFUSE.framework/Versions/A/Resources/Debug/libfuse.dylib. dSYM/Contents/Resources/DWARF/libfuse.dylib\

817 /Library/Frameworks/MacFUSE.framework/Versions/A/Resources/Debug/libfuse_ino64. dylib.dSYM/Contents/Resources/DWARF/libfuse_ino64.dylib\

818 /Library/Frameworks/StuffIt.framework/Versions/A/StuffItCore.dylib\

819 /Library/Frameworks/StuffIt.framework/Versions/A/StuffItSupport.dylib\

820 /Library/Frameworks/libZJBIG.dylib\

821 /Users/USER/Library/Application Support/Avast/nss/libfreebl3.dylib\

822 - com.avast.libfreebl3\

823 - AVAST Software a.s. (6H4HRTU5E3)\

824 /Users/USER/Library/Application Support/Avast/nss/libnspr4.dylib\

825 - com.avast.libnspr4\

826 - AVAST Software a.s. (6H4HRTU5E3)\

827 /Users/USER/Library/Application Support/Avast/nss/libnss3.dylib\

828 - com.avast.libnss3\

829 - AVAST Software a.s. (6H4HRTU5E3)\

830 /Users/USER/Library/Application Support/Avast/nss/libnssdbm3.dylib\

831 - com.avast.libnssdbm3\

832 - AVAST Software a.s. (6H4HRTU5E3)\

833 /Users/USER/Library/Application Support/Avast/nss/libnssutil3.dylib\

834 - com.avast.libnssutil3\

835 - AVAST Software a.s. (6H4HRTU5E3)\

836 /Users/USER/Library/Application Support/Avast/nss/libplc4.dylib\

837 - com.avast.libplc4\

838 - AVAST Software a.s. (6H4HRTU5E3)\

839 /Users/USER/Library/Application Support/Avast/nss/libplds4.dylib\

840 - com.avast.libplds4\

841 - AVAST Software a.s. (6H4HRTU5E3)\

842 /Users/USER/Library/Application Support/Avast/nss/libsmime3.dylib\

843 - com.avast.libsmime3\

844 - AVAST Software a.s. (6H4HRTU5E3)\

845 /Users/USER/Library/Application Support/Avast/nss/libsoftokn3.dylib\

846 - com.avast.libsoftokn3\

847 - AVAST Software a.s. (6H4HRTU5E3)\

848 /Users/USER/Library/Application Support/Avast/nss/libssl3.dylib\

849 - com.avast.libssl3\

850 - AVAST Software a.s. (6H4HRTU5E3)\

851 /usr/local/lib/libfuse.2.dylib\

852 /usr/local/lib/libfuse_ino64.2.dylib\

853 \

854 App extensions\

855 \

856 com.agilebits.onepassword-osx.safariextensioncompanion\

857 com.parallels.desktop.console.Resource-Monitor\

858 \

859 Signatures\

860 \

861 /System/Library/Extensions/hp_designjet_series.kext: code object is not signed at all\

862 \

863 Non-loading kernel extensions\

864 \

865 /System/Library/Extensions/AppleOSXUSBNCM.kext\

866 - com.apple.driver.AppleOSXUSBNCM\

867 - Software Signing\

868 /System/Library/Extensions/Lexmark X422.kext\

869 - com.lexmark.iokit.x422scanner\

870 \

871 Installations\

872 \

873 Adobe Flash Player: 3/14/16, 3:19 PM\

874 Adobe Reader XI (11.0.15): 3/13/16, 8:43 PM\

875 Adobe Acrobat Reader DC (15.010.20060): 3/13/16, 8:41 PM\

876 Office 2011 14.6.1 Update: 2/20/16, 10:30 AM\

877 1Password: 2/19/16, 9:05 PM\

878 \

879 Elapsed time (sec): 627\

}

Reply

Answer 5

Linc Davis

Level 10

209,739 points

Mar 19, 2016 5:09 PM in response to dramsey

A

"Avast" is the worst of the whole wretched lot of commercial "security" products for the Mac. Not only does it fail to protect you from any real danger, it may send personal data (such as web browsing history and the contents of email messages) back to the developer without your knowledge, give false warnings, destabilize and slow down the computer, expose you to network attack, and corrupt the network settings and the permissions of files in your home folder. Removing it may not repair all the damage.

Some versions of the product also inject advertising into web pages. In short, apart from the fine print in the license agreement, Avast is indistinguishable from malware, and is arguably worse than any known malware now in circulation.

Please back up all data, then remove Avast according to the developer's instructions. Restart. Never install any "anti-virus" or "anti-malware" software again.

If you tried to remove Avast by dragging an application to the Trash, you'll have to reinstall it and then follow the instructions linked above.

B

You installed, and then incompletely removed, the "SearchProtect" and "ZipCloud" malware.

Triple-click anywhere in the line below on this page to select it:

~/Library/LaunchAgents

Right-click or control-click the highlighted line and select

Services ▹ Open

from the contextual menu.* A folder named "LaunchAgents" should open.

In the folder, there may be one or more files with a name beginning as follows:

com.jdibackup.

Move all such files to the Trash.

Open this folder in the same way:

/Library/LaunchDaemons

Move this file to the Trash:

com.perion.searchprotectd.plist

You may be prompted for your password.

Restart the computer and empty the Trash.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

Reply

Answer 6

dramsey Author

Level 1

4 points

Mar 19, 2016 6:15 PM in response to Linc Davis

(Actually, this is my dad's computer, not mine...)

Thanks for the analysis. I've removed the indicated items-- Avast!, and the remnants of ZipCloud and SearchProtect-- but that sadly has not made any difference in the operation of Mail: the Mail Viewer window still is invisible until it's minimized to the Dock.

The only clue I have is that the problem doesn't occur when the computer is booted in Safe mode.

I may start killed processes I don't recognize in the vain hope I'll miraculously find whatever's causing this.

Reply

Answer 7

Linc Davis

Level 10

209,739 points

Mar 19, 2016 6:28 PM in response to dramsey

Please quit Mail. Force quit if necessary.

Back up all data before proceeding.

If you're running OS X 10.11 ("El Capitan") or later, triple-click anywhere in the line below on this page to select it:

~/Library/Mail/V3/MailData

If you're running an older version of OS X, use this line:

~/Library/Mail/V2/MailData

Copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder

from the menu bar. Paste into the box that opens by pressing command-V, then press return.

A folder window will open. Inside it there should be files with names as follows:

Envelope Index

ExternalUpdates.storedata

Move those files to the Desktop, leaving the window open. Other files in the folder may have longer names that begin as above. Move those files, if any, to the Trash.

Relaunch Mail. It should prompt you to re-import your messages. You may get a warning that the index is damaged and that Mail has to quit. Click OK. Typically, the process takes a few minutes, but it may take hours if you have gigantic mailboxes. In that case, you may be able to speed things up by temporarily adding your home folder to the Privacy list in the Spotlight preference pane. Remove it when Mail has finished importing.

If the import operation stalls or fails with an error message, quit Mail, delete the two new index files (keeping the original ones that you moved to the Desktop), and try again. According to many reports, the second attempt may succeed after the first one has failed.

Test. If Mail now works as expected, you can delete the files you moved to the Desktop. Otherwise, post your results.

Reply

Answer 8

dramsey Author

Level 1

4 points

Mar 19, 2016 6:36 PM in response to Linc Davis

Well, that was interesting. I quit Mail and moved the specified files to the desktop. In both cases there were two additional files whose names started with the names of the files you gave me-- Envelope Index and ExternalUpdates.storedata-- and I deleted those.

When I started Mail, as before the menu bar for Mail appeared, but no visible window. Most menu items, including "Minimize" in the [Windows] menu, were disabled. I made the assumption that there was an invisible dialog asking to re-import my messages, so I pressed Return a few times. After 30 seconds or so the expected menu items re-enabled, but there was still no window visible. At this point the "Minimize" trick worked to make the viewer window visible for a fraction of a second before it zoomed down to the Dock.

So: No change. However, it now seems that the problem is more general: Mail won't display any window initially, not just the Viewer window.

Reply

Answer 9

Linc Davis

Level 10

209,739 points

Mar 19, 2016 7:03 PM in response to dramsey

A

Please take these steps to delete the Mail "sandbox" folders.

Step 1

Back up all data.

Triple-click anywhere in the line below on this page to select it:

~/Library/Containers/com.apple.mail

Right-click or control-click the highlighted line and select

Services ▹ Reveal

from the contextual menu.* A Finder window should open with a folder named "com.apple.mail" selected. If it does, move the selected folder—not just its contents—to the Desktop. Leave the Finder window open for now.

Restart the computer. Launch Mail and test. If the problem is resolved, you may have to recreate some of your Mail settings. Any custom stationery that you created may be lost. Ask for instructions if you want to preserve that data. You can then delete the folder you moved and close the Finder window.

Caution: If you change any of the contents of the sandbox, but leave the folder itself in place, Mail may crash or not launch at all. Deleting the whole sandbox will cause it to be rebuilt automatically.

Step 2

If Step 1 doesn't solve the problem, repeat with this line:

~/Library/Containers/com.apple.MailServiceAgent

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

B

Although it's not related to the original question, I overlooked another malware component that you should remove. It's in this folder:

~/Library/Internet Plug-Ins

and the name is this:

TroviNPAPIPlugin.plugin

Reply

Answer 10

dramsey Author

Level 1

4 points

Mar 19, 2016 7:10 PM in response to Linc Davis

Sadly, still no change (except that the still-initially-invisible Viewer window goes back to its default display settings).

Malware fragment removed.

Reply

Answer 11

Linc Davis

Level 10

209,739 points

Mar 19, 2016 7:19 PM in response to dramsey

Do you have more than one space in Mission Control?

OS X El Capitan: See open windows and spaces in Mission Control

Reply

Answer 12

dramsey Author

Level 1

4 points

Mar 19, 2016 7:26 PM in response to Linc Davis

No, except....wait. Dad's configured his Dashboard as a separate space rather than an overlay. So there's always a minimum of two Spaces open: a default desktop and the Dashboard.

But that couldn't possibly make any difference. Apps can't put their windows in the Dashboard's space.

NONETHELESS, making Dashboard an overlay cured the problem. And what's more, the problem stayed gone when I re-enabled Dashboard as a space.

Can you say "Terribly obscure bug in the Quartz graphics layer?" I knew you could!

Reply

Answer 13

May 12, 2016 3:50 PM in response to Linc Davis

1 Start time: 15:11:01 05/12/16

2

3 Revision: 1597

4

5 Model Identifier: iMac12,2

6 Boot ROM Version: IM121.0047.B23

7 System Version: OS X 10.11.4 (15E65)

8 Kernel Version: Darwin 15.4.0

9 Time since boot: 7 minutes

10

11 UID: 502

12

13 Memory

14

15 BANK 0/DIMM0

16

17 Size: 2 GB

18 Speed: 1333 MHz

19 Status: OK

20 Manufacturer: 0x02FE

21

22 BANK 1/DIMM0

23

24 Size: 2 GB

25 Speed: 1333 MHz

26 Status: OK

27 Manufacturer: 0x02FE

28

29 BANK 0/DIMM1

30

31 Size: 8 GB

32 Speed: 1333 MHz

33 Status: OK

34 Manufacturer: 0x859B

35

36 BANK 1/DIMM1

37

38 Size: 8 GB

39 Speed: 1333 MHz

40 Status: OK

41 Manufacturer: 0x802C

42

43 SerialATA

44

45 WDC WD1001FALS-403AA0

46

47 FireWire

48

49 LaCie Hard Drive FireWire+ (LaCie Group SA)

50

51 USB

52

53 HD-PCFU3 (Melco, Inc.)

54

55 Bluetooth

56

57 Apple Magic Mouse

58

59 CPU usage (%)

60

61 mds (UID 0): 30.0

Reply