HTTPS / SSL randomly drops out

Question

Level 1

9 points

HTTPS / SSL randomly drops out

My Macbook Air (Early 2015) running 10.11.3 randomly experiences loss of access to HTTPS websites in all browsers, as well at the same time, iCloud and Mail app loses connection, and Skype also loses connection. I can still surf HTTP websites and ping any HTTP site. If I connect to VPN, I can access HTTPS, iCloud / Mail and Skype come back online. The only fix I have found (besides using VPN) is to restart the Macbook Air. Once I restart, everything is normal again for the rest of the day (usually). On rare occasions the problem happens twice a day. I'll usually just be surfing the web like normal and all of a sudden all secure connections die. Restart the machine again and everything is fine for a while.

I have a Mac Mini, running OS X 10.6.8, and an iPod running iOS 9.3, both running on the same network, and they have no problem accessing HTTPS. I have also switched to a different wi-fi network to make sure there is not something going on with my router, but the problem still exists on the new wi-fi network. So, it looks like it is isolated to my Macbook Air.

This has been going on shortly after I purchased this Macbook Air and upgraded to 10.10.3. It didn't do this with the stock OS X 10.10.2. The problem has been following since upgrading all the way to 10.11.3 (Combo Update). I keep praying that the next OS update will fix it, but it never does.

I heard there could be a problem with Keychain, but I've looked around there a bit without finding anything wrong that I can see. I did a reset of the default Keychain earlier today, but I just experienced another secure drop out a few minutes ago. God, I'm so sick of having to restart this freaking machine. I'm also sick of knowing that it is just a short matter of time before it drops out again for no reason.

MacBook Air (13-inch, Early 2015), OS X El Capitan (10.11.3)

Posted on Apr 4, 2016 4:07 PM

Reply

Answer 1

Linc Davis

Level 10

209,739 points

Apr 4, 2016 5:58 PM in response to Squid3660

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

The test works on OS X 10.8 ("Mountain Lion") and later. I don't recommend running it on older versions of OS X. It will do no harm, but it won't do much good either.

Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

2. If you don't already have a current backup, please back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.

You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.

In this case, however, there are ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone who understands the code can verify what it does.

You may not be able to understand the script yourself. But variations of it have been posted on this website many times over a period of years. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message. See, for example, this discussion.

Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.

4. Here's a general summary of what you need to do, if you choose to proceed:

☞ Copy the text of a particular web page (not this one) to the Clipboard.

☞ Paste into the window of another application.

☞ Wait for the test to run. It usually takes a few minutes.

☞ Paste the results, which will have been copied automatically, back into a reply on this page.

These are not specific instructions; just an overview. The details are in parts 7 and 8 of this comment. The sequence is: copy, paste, wait, paste again. You don't need to copy a second time.

5. Try to test under conditions that reproduce the problem, as far as possible. For example, if the computer is intermittently slow, run the test during a slowdown.

You may have started up in safe mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual before running it. If you can only test in safe mode, do that.

6. If you have more than one user, and only one user is affected by the problem,, and the affected user is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

7. Load this linked web page (on the website "Pastebin.") Press the key combination command-A to select all the text, then copy it to the Clipboard by pressing command-C.

8. Launch the built-in Terminal application in any one of the following ways:

☞ Enter the first few letters of its name ("Terminal") into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Click anywhere in the Terminal window to activate it. Paste from the Clipboard into the window by pressing command-V, then press return. The text you pasted should vanish immediately.

9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt. Again, the script will still run.

If the test is taking much longer than usual to run because the computer is very slow, you might be prompted for your password a second time. The authorization that you grant by entering it expires automatically after five minutes.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, a series of lines will appear in the Terminal window like this:

Test started

Part 1 of 4 done at: … sec
…
Part 4 of 4 done at: … sec

The test results are on the Clipboard.

Please close this window.

The intervals between parts won't be exactly equal, but they give a rough indication of progress.

Wait for the final message "Please close this window" to appear—again, usually within a few minutes. If you don't see that message within about 30 minutes, the test probably won't complete in a reasonable time. In that case, press the key combination control-C or command-period to stop it. Then go to the next step. You'll have incomplete results, but still something.

In order to get results, the test must either be allowed to complete or else manually stopped as above. If you close the Terminal window while the test is still running, the partial results won't be saved.

11. When the test is complete, or if you stopped it manually, quit Terminal. The results will have been saved to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "close this window" message. Please wait for it and try again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

12. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "The message contains invalid characters." That's a bug in the software that runs this website. Please post the test results on Pastebin, then post a link here to the page you created.

If you have an account on Pastebin, please don't select Private from the Paste Exposure menu on the page, because then no one but you will be able to see it.

13. When you're done with the test, it's gone. There is nothing to uninstall or clean up.

14. This is a public forum, and others may give you advice based on the results of the test. They speak for themselves, not for me. The test itself is harmless, but whatever else you do may not be. For others who choose to run it, I don't recommend that you post the test results on this website unless I asked you to.

15. The linked UNIX shell script bears a notice of copyright. Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

Reply

Answer 2

Squid3660 Author

Level 1

9 points

Apr 8, 2016 10:14 AM in response to Linc Davis

Hi, I thought I would run the test under "normal" conditions. I think I've been running for about 20 hours since last required reboot, so I know the trouble is going to happen sometime in the next few hours. I'll do another test when "it happens" and post those results when I get them. Thank you for your help.

1 Start time: 16:49:25 04/08/16

2

3 Revision: 1566

4

5 Model Identifier: MacBookAir7,2

6 Boot ROM Version: MBA71.0166.B09

7 System Version: OS X 10.11.3 (15D21)

8 Kernel Version: Darwin 15.3.0

9 Time since boot: 21:56

10

11 Bluetooth

12

13 Bose Color SoundLink

14

15 Energy impact, lifetime (relative)

16

17 WindowServer (UID 88): 52.53

18 Terminal (UID 501): 25.96

19 bash (UID 501): 21.38

20 firefox (UID 501): 17.47

21

22 GPU usage, lifetime (ms/s)

23

24 WindowServer (UID 88): 121.20

25

26 CPU usage, lifetime (ms/s)

27

28 Terminal (UID 501): 260.93

29 bash (UID 501): 213.84

30

31 LS schemes: No

32

33 Global prefs (system)

34

35 MultipleSessionEnabled = 1

36

37 Firewall: On

38

39 System caches/logs

40

41 1.9 GiB: /System/Library/Caches/com.apple.coresymbolicationd/data

42

43 Diagnostic reports

44

45 2016-03-29 Mail crash

46 2016-04-03 System Preferences crash

47 2016-04-04 MDCrashReportTool crash

48 2016-04-04 iTunes hang

49 2016-04-05 App Store crash

50

51 HID errors: 9

52

53 Kernel log

54

55 Apr 6 11:53:57 ASP_TCP CancelOneRequest: cancelling slot 29 error 89 reqID 733 flags 0x29 afpCmd 0x4 so 0x822cf3c5aa4f25b7

56 Apr 6 11:53:57 AFP_VFS afpfs_unmount: CloseVolume failed 0x39

57 Apr 6 11:55:39 ASP_TCP Disconnect: triggering reconnect by bumping reconnTrigger from curr value 0 on so 0x822cf3c5a8d08497

58 Apr 6 11:55:39 AFP_VFS afpfs_unmount: CloseVolume failed 0x39

59 Apr 6 11:58:21 AFP_VFS afpfs_unmount: CloseVolume failed 0x39

60 Apr 6 11:58:22 AFP_VFS afpfs_DoGetVolParms: GetVolParms failed 2, unmounting vol

61 Apr 6 11:58:22 AFP_VFS afpfs_DoGetVolParms: GetVolParms failed 2, unmounting vol

62 Apr 6 11:58:22 AFP_VFS afpfs_unmount: CloseVolume failed 0x39

63 Apr 6 11:58:22 AFP_VFS afpfs_unmount: CloseVolume failed 0x39

64 Apr 6 11:58:22 ASP_TCP Disconnect: triggering reconnect by bumping reconnTrigger from curr value 0 on so 0x822cf3c5aa32931f

65 Apr 6 16:16:49 IO80211ControllerMonitor::configureSubscriptions() failed to add subscriptionIO80211Controller::start _controller is 0x8d3cebe45f1f19ed, provider is 0x8d3cebe39ffb96ed

66 Apr 6 16:16:49 init: error getting PHY_MODE; using MODE_UNKNOWN

67 Apr 6 16:16:50 [IGPU] Scheduler Throttle Cap = 100ms.

68 Apr 7 03:54:56 ASP_TCP Disconnect: triggering reconnect by bumping reconnTrigger from curr value 0 on so 0x8806d9bcebba538d

69 Apr 7 16:15:24 vnic0: promiscuous mode enable failed

70 Apr 7 16:15:24 vnic1: promiscuous mode enable failed

71 Apr 7 18:12:04 vnic0: failed to restore 1 suspended link-layer multicast membership(s) (err=22)

72 Apr 7 18:12:04 vnic1: failed to restore 1 suspended link-layer multicast membership(s) (err=22)

73 Apr 7 18:35:10 vnic0: failed to restore 1 suspended link-layer multicast membership(s) (err=22)

74 Apr 7 18:35:10 vnic1: failed to restore 1 suspended link-layer multicast membership(s) (err=22)

75 Apr 7 18:53:30 ASP_TCP Disconnect: triggering reconnect by bumping reconnTrigger from curr value 0 on so 0x8806d9bcebbad6ed

76 Apr 7 18:53:42 IO80211ControllerMonitor::configureSubscriptions() failed to add subscriptionIO80211Controller::start _controller is 0x8410063e9138aff3, provider is 0x8410063dd21324f3

77 Apr 7 18:53:42 init: error getting PHY_MODE; using MODE_UNKNOWN

78 Apr 7 18:53:43 [IGPU] Scheduler Throttle Cap = 100ms.

79 Apr 8 04:22:05 ASP_TCP Disconnect: triggering reconnect by bumping reconnTrigger from curr value 0 on so 0x6a084c3b07c00ab9

80

81 System log

82

83 Apr 8 03:01:01 UserEventAgent: Failed to send message because the port couldn't be created.

84 Apr 8 04:22:00 UserEventAgent: Failed to send message because the port couldn't be created.

85 Apr 8 04:22:00 UserEventAgent: Failed to send message because the port couldn't be created.

86 Apr 8 04:22:01 fseventsd: Logging disabled completely for device:1: /Volumes/Recovery HD

87 Apr 8 04:22:03 UserEventAgent: Failed to send message because the port couldn't be created.

88 Apr 8 06:26:06 WindowServer: _CGXRemoveWindowFromWindowMovementGroup: window 0x3e is not attached to window 0x185

89 Apr 8 07:01:47 WindowServer: no sleep images for WillPowerOffWithImages

90 Apr 8 07:34:31 aslmanager: -[CacheDeleteServiceListener servicePeriodic:info:replyBlock:]:124 periodic callback is NULL

91 Apr 8 11:43:45 WindowServer: _CGXRemoveWindowFromWindowMovementGroup: window 0x3e is not attached to window 0x1bc

92 Apr 8 11:43:50 WindowServer: _CGXRemoveWindowFromWindowMovementGroup: window 0x3e is not attached to window 0x1be

93 Apr 8 11:44:21 WindowServer: _CGXRemoveWindowFromWindowMovementGroup: window 0x3e is not attached to window 0x1c0

94 Apr 8 11:44:35 WindowServer: _CGXRemoveWindowFromWindowMovementGroup: window 0x3e is not attached to window 0x1c4

95 Apr 8 11:45:40 WindowServer: _CGXRemoveWindowFromWindowMovementGroup: window 0x3e is not attached to window 0x1c8

96 Apr 8 11:52:01 WindowServer: no sleep images for WillPowerOffWithImages

97 Apr 8 11:55:43 UserEventAgent: Failed to send message because the port couldn't be created.

98 Apr 8 11:55:46 UserEventAgent: Failed to send message because the port couldn't be created.

99 Apr 8 16:35:13 WindowServer: _CGXRemoveWindowFromWindowMovementGroup: window 0x3e is not attached to window 0x1e2

100 Apr 8 16:35:34 WindowServer: _CGXRemoveWindowFromWindowMovementGroup: window 0x3e is not attached to window 0x1f0

101 Apr 8 16:35:52 WindowServer: _CGXRemoveWindowFromWindowMovementGroup: window 0x3e is not attached to window 0x1f1

102 Apr 8 16:36:11 WindowServer: _CGXRemoveWindowFromWindowMovementGroup: window 0x3e is not attached to window 0x1f4

103 Apr 8 16:36:26 WindowServer: _CGXRemoveWindowFromWindowMovementGroup: window 0x3e is not attached to window 0x1f6

104 Apr 8 16:36:35 WindowServer: _CGXRemoveWindowFromWindowMovementGroup: window 0x3e is not attached to window 0x1f8

105 Apr 8 16:37:07 WindowServer: _CGXSetWindowHasKeyAppearance: Operation on a window 0x17 requiring rights kCGSWindowRightOwner by caller Dashboard

106 Apr 8 16:37:07 WindowServer: _CGXSetWindowHasMainAppearance: Operation on a window 0x17 requiring rights kCGSWindowRightOwner by caller Dashboard

107 Apr 8 16:41:44 WindowServer: disable_update_timeout: UI updates were forcibly disabled by application "Preview" for over 1.00 seconds. Server has re-enabled them.

108

109 launchd log

110

111 Apr 4 21:40:57 : Failed to remove file or directory: name = dyld_shared_cache_x86_64h, error = 1: Operation not permitted. Further logging suppressed.

112 Apr 4 21:40:57 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose

113 Apr 4 21:41:03 com.apple.xpc.launchd.domain.system: Caller not allowed to perform action: SecurityAgent.216, action = legacy spawn, code = 1: Operation not permitted, uid = 92, euid = 92, gid = 92, egid = 92, asid = 100007

114 Apr 4 21:41:16 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not import service from caller: caller = otherbsd.239, service = com.apple.CompressorHelper-2, error = 119: Service is disabled

115 Apr 5 19:27:06 : Failed to remove file or directory: name = dyld_shared_cache_x86_64h, error = 1: Operation not permitted. Further logging suppressed.

116 Apr 5 19:27:06 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose

117 Apr 5 19:27:13 com.apple.xpc.launchd.domain.system: Caller not allowed to perform action: SecurityAgent.223, action = legacy spawn, code = 1: Operation not permitted, uid = 92, euid = 92, gid = 92, egid = 92, asid = 100007

118 Apr 5 19:27:45 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not import service from caller: caller = otherbsd.248, service = com.apple.CompressorHelper-2, error = 119: Service is disabled

119 Apr 6 02:21:32 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not read path: path = /Library/LaunchAgents/com.parallels.vm.prl_pcproxy.plist, error = 2: No such file or directory

120 Apr 6 02:28:06 : Failed to remove file or directory: name = dyld_shared_cache_x86_64h, error = 1: Operation not permitted. Further logging suppressed.

121 Apr 6 02:28:06 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose

122 Apr 6 02:28:12 com.apple.xpc.launchd.domain.system: Caller not allowed to perform action: SecurityAgent.217, action = legacy spawn, code = 1: Operation not permitted, uid = 92, euid = 92, gid = 92, egid = 92, asid = 100007

123 Apr 6 02:28:28 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not import service from caller: caller = otherbsd.239, service = com.apple.CompressorHelper-2, error = 119: Service is disabled

124 Apr 6 02:29:09 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not read path: path = /Library/LaunchAgents/com.parallels.vm.prl_pcproxy.plist, error = 2: No such file or directory

125 Apr 6 16:16:49 : Failed to remove file or directory: name = dyld_shared_cache_x86_64h, error = 1: Operation not permitted. Further logging suppressed.

126 Apr 6 16:16:49 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose

127 Apr 6 16:16:55 com.apple.xpc.launchd.domain.system: Caller not allowed to perform action: SecurityAgent.216, action = legacy spawn, code = 1: Operation not permitted, uid = 92, euid = 92, gid = 92, egid = 92, asid = 100007

128 Apr 6 16:17:08 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not import service from caller: caller = otherbsd.240, service = com.apple.CompressorHelper-2, error = 119: Service is disabled

129 Apr 7 16:15:24 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not read path: path = /Library/LaunchAgents/com.parallels.vm.prl_pcproxy.plist, error = 2: No such file or directory

130 Apr 7 18:12:04 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not read path: path = /Library/LaunchAgents/com.parallels.vm.prl_pcproxy.plist, error = 2: No such file or directory

131 Apr 7 18:35:10 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not read path: path = /Library/LaunchAgents/com.parallels.vm.prl_pcproxy.plist, error = 2: No such file or directory

132 Apr 7 18:53:42 : Failed to remove file or directory: name = dyld_shared_cache_x86_64h, error = 1: Operation not permitted. Further logging suppressed.

133 Apr 7 18:53:42 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose

134 Apr 7 18:53:48 com.apple.xpc.launchd.domain.system: Caller not allowed to perform action: SecurityAgent.234, action = legacy spawn, code = 1: Operation not permitted, uid = 92, euid = 92, gid = 92, egid = 92, asid = 100007

135 Apr 7 18:54:04 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not import service from caller: caller = otherbsd.308, service = com.apple.CompressorHelper-2, error = 119: Service is disabled

136

137 Loaded kernel extensions

138

139 com.protech.NoSleep (1.4.0)

140

141 System services loaded

142

143 com.adobe.fpsaud

144 com.apple.csrutil.report

145 - status: 71

146 com.apple.logd

147 - status: 1

148 com.apple.watchdogd

149 com.malwarebytes.MBAMHelperTool

150 com.timesoftware.timemachineeditor.backup-auto

151 com.timesoftware.timemachineeditor.helper

152 net.tunnelblick.tunnelblick.tunnelblickd

153

154 System services disabled

155

156 com.apple.mtmfs

157

158 Login services loaded

159

160 2BUA8C4S2C.com.agilebits.onepassword-osx-helper

161 net.tunnelblick.tunnelblick.LaunchAtLogin

162 - status: 78

163

164 Global login items

165

166 $HELPER_PATH

167 $HELPER_PATH

168

169 Contents of /Library/LaunchDaemons/com.malwarebytes.MBAMHelperTool.plist

170 - mod date: Mar 31 19:30:08 2016

171 - size (B): 584

172 - checksum: 2299099766

173

174 <?xml version="1.0" encoding="UTF-8"?>

175 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

176 <plist version="1.0">

177 <dict>

178 <key>Label</key>

179 <string>com.malwarebytes.MBAMHelperTool</string>

180 <key>MachServices</key>

181 <dict>

182 <key>com.malwarebytes.MBAMHelperTool</key>

183 <true/>

184 </dict>

185 <key>Program</key>

186 <string>/Library/PrivilegedHelperTools/com.malwarebytes.MBAMHelperTool</string>

187 <key>ProgramArguments</key>

188 <array>

189 <string>/Library/PrivilegedHelperTools/com.malwarebytes.MBAMHelperTool</string>

190 </array>

191 </dict>

192 </plist>

193

194 Contents of /Library/LaunchDaemons/com.timesoftware.timemachineeditor.backup-auto.plist

195 - mod date: Apr 4 14:46:56 2016

196 - size (B): 609

197 - checksum: 2610317601

198

199 <?xml version="1.0" encoding="UTF-8"?>

200 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

201 <plist version="1.0">

202 <dict>

203 <key>Label</key>

204 <string>com.timesoftware.timemachineeditor.backup-auto</string>

205 <key>ProgramArguments</key>

206 <array>

207 <string>/Library/PrivilegedHelperTools/com.timesoftware.timemachineeditor.helpe r</string>

208 <string>--backup</string>

209 <string>--allow-battery</string>

210 </array>

211 <key>StartCalendarInterval</key>

212 <dict>

213 <key>Hour</key>

214 <integer>3</integer>

215 <key>Minute</key>

216 <integer>0</integer>

217 </dict>

218 </dict>

219 </plist>

220

221 Contents of /Library/LaunchDaemons/com.timesoftware.timemachineeditor.helper.plist

222 - mod date: Aug 24 16:39:08 2015

223 - size (B): 624

224 - checksum: 933387316

225

226 <?xml version="1.0" encoding="UTF-8"?>

227 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

228 <plist version="1.0">

229 <dict>

230 <key>Label</key>

231 <string>com.timesoftware.timemachineeditor.helper</string>

232 <key>MachServices</key>

233 <dict>

234 <key>com.timesoftware.timemachineeditor.helper</key>

235 <true/>

236 </dict>

237 <key>Program</key>

238 <string>/Library/PrivilegedHelperTools/com.timesoftware.timemachineeditor.helpe r</string>

239 <key>ProgramArguments</key>

240 <array>

241 <string>/Library/PrivilegedHelperTools/com.timesoftware.timemachineeditor.helpe r</string>

242 </array>

243 </dict>

244 </plist>

245

246 Contents of /Library/LaunchDaemons/net.tunnelblick.tunnelblick.tunnelblickd.plist

247 - mod date: Feb 29 16:00:22 2016

248 - size (B): 876

249 - checksum: 53037824

250

251 <?xml version="1.0" encoding="UTF-8"?>

252 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

253 <plist version="1.0">

254 <dict>

255 <key>GroupName</key>

256 <string>wheel</string>

257 <key>Label</key>

258 <string>net.tunnelblick.tunnelblick.tunnelblickd</string>

259 <key>Program</key>

260 <string>/Applications/Tunnelblick.app/Contents/Resources/tunnelblickd</string>

261 <key>Sockets</key>

262 <dict>

263 <key>Listener</key>

264 <dict>

265 <key>SockFamily</key>

266 <string>Unix</string>

267 <key>SockPathMode</key>

268 <integer>438</integer>

269 <key>SockPathName</key>

270 <string>/var/run/net.tunnelblick.tunnelblick.tunnelblickd.socket</string>

271 <key>SockType</key>

272 <string>Stream</string>

273 </dict>

274 </dict>

275 <key>StandardErrorPath</key>

276

277 ...and 5 more line(s)

278

279 Contents of Library/LaunchAgents/net.tunnelblick.tunnelblick.LaunchAtLogin.plist

280 - mod date: Feb 18 21:28:49 2016

281 - size (B): 618

282 - checksum: 2295440304

283

284 <?xml version="1.0" encoding="UTF-8"?>

285 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

286 <plist version="1.0">

287 <dict>

288 <key>Label</key>

289 <string>net.tunnelblick.tunnelblick.LaunchAtLogin</string>

290 <key>ProgramArguments</key>

291 <array>

292 <string>/Applications/Tunnelblick.app/Contents/Resources/launchAtLogin.sh</stri ng>

293 </array>

294 <key>LimitLoadToSessionType</key>

295 <string>Aqua</string>

296 <key>RunAtLoad</key>

297 <true/>

298 <key>OnDemand</key>

299 <true/>

300 <key>ExitTimeOut</key>

301 <integer>0</integer>

302 <key>ProcessType</key>

303 <string>Interactive</string>

304 </dict>

305 </plist>

306

307 User login items

308

309 NoSleep

310 - /Applications/Utilities/NoSleep.app

311 iTunesHelper

312 - /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

313 Activity Monitor

314 - /Applications/Utilities/Activity Monitor.app

315 Yahoo! Widgets

316 - /Applications/Yahoo! Widgets.app

317

318 Safari extensions

319

320 1Password

321 - com.agilebits.onepassword4-safari

322

323 Firefox extensions

324

325 Video DownloadHelper

326 Privacy Badger

327 NoScript Security Suite

328 Disconnect

329 Download Flash and Video

330 Adblock Edge

331 Firefox Hello Beta

332 DownThemAll!

333 Stefano Verna

334 Flashblock

335

336 iCloud services

337

338 MOBILE_DOCUMENTS

339 MAIL_AND_NOTES

340 CONTACTS

341 REMINDERS

342 NOTES

343

344 iCloud errors

345

346 cloudd 97

347 Photos 36

348 Finder 11

349 comapple.CloudPhotosConfiguration 9

350

351 Continuity errors

352

353 sharingd 72

354 comapple.appkit.xpc.openAndSavePanelService 17

355

356 Restrictive permissions: 99

357

358 Lockfiles: 12

359

360 Global prefs (user)

361

362 AppleICUForce24HourTime = 1

363 AppleInterfaceStyle = Dark

364 "Canon MX430 series FAX" = 1

365

366 Accessibility

367

368 Scroll Zoom: On

369

370 Extensions

371

372 /System/Library/Extensions/JMicronATA.kext

373 - com.jmicron.JMicronATA

374 /System/Library/Extensions/NoSleep.kext

375 - com.protech.NoSleep

376 - Pavel Prokofiev (RR43DU5BN9)

377

378 Applications

379

380 /Applications/Art Text 2.app

381 - com.belightsoft.ArtText2

382 - Belight Software, ltd

383 /Applications/Hex Fiend.app

384 - com.ridiculousfish.HexFiend

385 - Hex Fiend

386 /Applications/Malwarebytes Anti-Malware.app

387 - com.malwarebytes.antimalware

388 - Malwarebytes Corporation (GVZRY6KDKR)

389 /Applications/NameChanger.app

390 - com.mrrsoftware.NameChanger

391 - Mickey Roberson

392 /Applications/RipIt.app

393 - com.thelittleappfactory.RipIt

394 - The Little App Factory Pty. Ltd.

395 /Applications/TimeMachineEditor.app

396 - com.timesoftware.timemachineeditor.application

397 - Thomas CLEMENT

398 /Applications/Utilities/NoSleep.app

399 - com.protech.NoSleep

400 - Pavel Prokofiev (RR43DU5BN9)

401 /Applications/coconutBattery.app

402 - com.coconut-flavour.coconutBattery

403 - Christoph Sinai

404 /Applications/smcFanControl.app

405 - com.eidac.smcFanControl2

406 - Hendrik Holtmann

407

408 PrefPane

409

410 /Library/PreferencePanes/Cuckoo.prefPane

411 - com.toastycode.Cuckoo

412 - Toastycode Signing Certificate

413 /Library/PreferencePanes/Flash Player.prefPane

414 - com.adobe.flashplayerpreferences

415 /Library/PreferencePanes/NoSleep.prefPane

416 - com.protech.NoSleepPref

417 - Pavel Prokofiev (RR43DU5BN9)

418 /Library/PreferencePanes/Perian.prefPane

419 - org.perian.PerianPane

420

421 Bundles

422

423 /Library/Internet Plug-Ins/Flash Player.plugin

424 - com.macromedia.Flash Player.plugin

425 - Adobe Systems, Inc.

426 /Library/Internet Plug-Ins/Quartz Composer.webplugin

427 - com.apple.QuartzComposer.webplugin

428 - Software Signing

429 /Library/Internet Plug-Ins/Yahoo! Installer 3.plugin

430 - com.yahoo.installer.3

431 /Users/USER/Library/Address Book Plug-Ins/SkypeABCaller.bundle

432 - com.skype.SkypeABCaller

433 /Users/USER/Library/Address Book Plug-Ins/SkypeABChatter.bundle

434 - com.skype.SkypeABChatter

435 /Users/USER/Library/Address Book Plug-Ins/SkypeABDialer.bundle

436 - com.skype.skypeabdialer

437 /Users/USER/Library/Address Book Plug-Ins/SkypeABSMS.bundle

438 - com.skype.skypeabsms

439

440 Bundles (new)

441

442 /Library/Internet Plug-Ins/Flash Player.plugin

443 - com.macromedia.Flash Player.plugin

444 - Adobe Systems, Inc.

445 /Library/PreferencePanes/Flash Player.prefPane

446 - com.adobe.flashplayerpreferences

447

448 Library paths

449

450 /Users/USER/Library/Application Support/Firefox/Profiles/arud9lo0.default/gmp-gmpopenh264/1.1/libgmpopenh264.dy lib

451 /Users/USER/Library/Application Support/Firefox/Profiles/arud9lo0.default/gmp-gmpopenh264/1.5.3/libgmpopenh264. dylib

452

453 App extensions

454

455 com.agilebits.onepassword-osx.safariextensioncompanion

456 com.parallels.desktop.console.Resource-Monitor

457 com.pixelmatorteam.pixelmator.Repair-Tool-Action-Extension

458 com.pixelmatorteam.pixelmator.photos-distort-extension

459

460 Signatures

461

462 /Library/Application Support/iPhoto/iPhoto Library Upgrader.app: bundle format unrecognized, invalid, or unsuitable

463

464 Non-loading kernel extensions

465

466 /System/Library/Extensions/AppleOSXUSBNCM.kext

467 - com.apple.driver.AppleOSXUSBNCM

468 - Software Signing

469

470 Installations

471

472 Adobe Flash Player: 4/8/16, 11:55

473 1Password: 4/5/16, 00:20

474 1Password: 4/1/16, 06:51

475 Adobe Flash Player: 3/24/16, 00:27

476 Adobe Flash Player: 3/11/16, 08:19

477

478 Elapsed time (sec): 586

Reply

Answer 3

Squid3660 Author

Level 1

9 points

Apr 9, 2016 4:51 AM in response to Squid3660

Ok, so it just happened again this morning, all secure network activity failed (except when connected to VPN). I ran the test during this time and here are the results:

1 Start time: 10:37:20 04/09/16

2

3 Revision: 1566

4

5 Model Identifier: MacBookAir7,2

6 Boot ROM Version: MBA71.0166.B09

7 System Version: OS X 10.11.3 (15D21)

8 Kernel Version: Darwin 15.3.0

9 Time since boot: 1 day 15:44

10

11 Bluetooth

12

13 Bose Color SoundLink

14

15 Energy impact, lifetime (relative)

16

17 WindowServer (UID 88): 76.75

18 kernel_task (UID 0): 26.52

19 bash (UID 501): 22.60

20 com.apple.WebKit.WebContent (UID 501): 16.15

21

22 GPU usage, lifetime (ms/s)

23

24 WindowServer (UID 88): 179.21

25

26 CPU usage, lifetime (ms/s)

27

28 bash (UID 501): 225.97

29

30 Memory (MB)

31

32 kernel_task (UID 0): 1067

33

34 LS schemes: No

35

36 Global prefs (system)

37

38 MultipleSessionEnabled = 1

39

40 Firewall: On

41

42 System caches/logs

43

44 1.9 GiB: /System/Library/Caches/com.apple.coresymbolicationd/data

45

46 Diagnostic reports

47

48 2016-03-29 Mail crash

49 2016-04-03 System Preferences crash

50 2016-04-04 MDCrashReportTool crash

51 2016-04-04 iTunes hang

52 2016-04-05 App Store crash

53

54 HID errors: 9

55

56 Kernel log

57

58 Apr 6 11:53:57 AFP_VFS afpfs_unmount: CloseVolume failed 0x39

59 Apr 6 11:55:39 ASP_TCP Disconnect: triggering reconnect by bumping reconnTrigger from curr value 0 on so 0x822cf3c5a8d08497

60 Apr 6 11:55:39 AFP_VFS afpfs_unmount: CloseVolume failed 0x39

61 Apr 6 11:58:21 AFP_VFS afpfs_unmount: CloseVolume failed 0x39

62 Apr 6 11:58:22 AFP_VFS afpfs_DoGetVolParms: GetVolParms failed 2, unmounting vol

63 Apr 6 11:58:22 AFP_VFS afpfs_DoGetVolParms: GetVolParms failed 2, unmounting vol

64 Apr 6 11:58:22 AFP_VFS afpfs_unmount: CloseVolume failed 0x39

65 Apr 6 11:58:22 AFP_VFS afpfs_unmount: CloseVolume failed 0x39

66 Apr 6 11:58:22 ASP_TCP Disconnect: triggering reconnect by bumping reconnTrigger from curr value 0 on so 0x822cf3c5aa32931f

67 Apr 6 16:16:49 IO80211ControllerMonitor::configureSubscriptions() failed to add subscriptionIO80211Controller::start _controller is 0x8d3cebe45f1f19ed, provider is 0x8d3cebe39ffb96ed

68 Apr 6 16:16:49 init: error getting PHY_MODE; using MODE_UNKNOWN

69 Apr 6 16:16:50 [IGPU] Scheduler Throttle Cap = 100ms.

70 Apr 7 03:54:56 ASP_TCP Disconnect: triggering reconnect by bumping reconnTrigger from curr value 0 on so 0x8806d9bcebba538d

71 Apr 7 16:15:24 vnic0: promiscuous mode enable failed

72 Apr 7 16:15:24 vnic1: promiscuous mode enable failed

73 Apr 7 18:12:04 vnic0: failed to restore 1 suspended link-layer multicast membership(s) (err=22)

74 Apr 7 18:12:04 vnic1: failed to restore 1 suspended link-layer multicast membership(s) (err=22)

75 Apr 7 18:35:10 vnic0: failed to restore 1 suspended link-layer multicast membership(s) (err=22)

76 Apr 7 18:35:10 vnic1: failed to restore 1 suspended link-layer multicast membership(s) (err=22)

77 Apr 7 18:53:30 ASP_TCP Disconnect: triggering reconnect by bumping reconnTrigger from curr value 0 on so 0x8806d9bcebbad6ed

78 Apr 7 18:53:42 IO80211ControllerMonitor::configureSubscriptions() failed to add subscriptionIO80211Controller::start _controller is 0x8410063e9138aff3, provider is 0x8410063dd21324f3

79 Apr 7 18:53:42 init: error getting PHY_MODE; using MODE_UNKNOWN

80 Apr 7 18:53:43 [IGPU] Scheduler Throttle Cap = 100ms.

81 Apr 8 04:22:05 ASP_TCP Disconnect: triggering reconnect by bumping reconnTrigger from curr value 0 on so 0x6a084c3b07c00ab9

82 Apr 9 03:04:24 ASP_TCP Disconnect: triggering reconnect by bumping reconnTrigger from curr value 0 on so 0x6a084c3b00e50349

83

84 System log

85

86 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextSetFontSmoothingStyle: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

87 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextGetCTM: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

88 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextGetDefaultUserSpaceToDeviceSpaceTransform: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

89 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextSaveGState: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

90 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextConcatCTM: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

91 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextSaveGState: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

92 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextClipToRect: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

93 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextGetClipBoundingBox: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

94 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextDrawImages: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

95 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextRestoreGState: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

96 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextRestoreGState: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

97 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextSetCMYKFillColor: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

98 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextSetCMYKStrokeColor: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

99 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextGetCompositeOperation: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

100 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextSetCompositeOperation: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

101 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextFillRects: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

102 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextSetCompositeOperation: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

103 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextGetShouldSmoothFonts: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

104 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextGetFontSmoothingStyle: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

105 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextGetFontAntialiasingStyle: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

106 Apr 9 09:31:50 com.apple.preferences.internetaccounts.remoteservice: CGContextSetFontSmoothingStyle: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

107 Apr 9 09:32:20 WindowServer: _CGXRemoveWindowFromWindowMovementGroup: window 0x3e is not attached to window 0x2ac

108 Apr 9 09:32:25 WindowServer: _CGXRemoveWindowFromWindowMovementGroup: window 0x3e is not attached to window 0x2ae

109 Apr 9 09:32:29 WindowServer: _CGXRemoveWindowFromWindowMovementGroup: window 0x3e is not attached to window 0x2b0

110 Apr 9 09:51:18 fseventsd: Logging disabled completely for device:1: /Volumes/Recovery HD

111

112 launchd log

113

114 Apr 4 21:40:57 : Failed to remove file or directory: name = dyld_shared_cache_x86_64h, error = 1: Operation not permitted. Further logging suppressed.

115 Apr 4 21:40:57 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose

116 Apr 4 21:41:03 com.apple.xpc.launchd.domain.system: Caller not allowed to perform action: SecurityAgent.216, action = legacy spawn, code = 1: Operation not permitted, uid = 92, euid = 92, gid = 92, egid = 92, asid = 100007

117 Apr 4 21:41:16 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not import service from caller: caller = otherbsd.239, service = com.apple.CompressorHelper-2, error = 119: Service is disabled

118 Apr 5 19:27:06 : Failed to remove file or directory: name = dyld_shared_cache_x86_64h, error = 1: Operation not permitted. Further logging suppressed.

119 Apr 5 19:27:06 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose

120 Apr 5 19:27:13 com.apple.xpc.launchd.domain.system: Caller not allowed to perform action: SecurityAgent.223, action = legacy spawn, code = 1: Operation not permitted, uid = 92, euid = 92, gid = 92, egid = 92, asid = 100007

121 Apr 5 19:27:45 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not import service from caller: caller = otherbsd.248, service = com.apple.CompressorHelper-2, error = 119: Service is disabled

122 Apr 6 02:21:32 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not read path: path = /Library/LaunchAgents/com.parallels.vm.prl_pcproxy.plist, error = 2: No such file or directory

123 Apr 6 02:28:06 : Failed to remove file or directory: name = dyld_shared_cache_x86_64h, error = 1: Operation not permitted. Further logging suppressed.

124 Apr 6 02:28:06 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose

125 Apr 6 02:28:12 com.apple.xpc.launchd.domain.system: Caller not allowed to perform action: SecurityAgent.217, action = legacy spawn, code = 1: Operation not permitted, uid = 92, euid = 92, gid = 92, egid = 92, asid = 100007

126 Apr 6 02:28:28 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not import service from caller: caller = otherbsd.239, service = com.apple.CompressorHelper-2, error = 119: Service is disabled

127 Apr 6 02:29:09 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not read path: path = /Library/LaunchAgents/com.parallels.vm.prl_pcproxy.plist, error = 2: No such file or directory

128 Apr 6 16:16:49 : Failed to remove file or directory: name = dyld_shared_cache_x86_64h, error = 1: Operation not permitted. Further logging suppressed.

129 Apr 6 16:16:49 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose

130 Apr 6 16:16:55 com.apple.xpc.launchd.domain.system: Caller not allowed to perform action: SecurityAgent.216, action = legacy spawn, code = 1: Operation not permitted, uid = 92, euid = 92, gid = 92, egid = 92, asid = 100007

131 Apr 6 16:17:08 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not import service from caller: caller = otherbsd.240, service = com.apple.CompressorHelper-2, error = 119: Service is disabled

132 Apr 7 16:15:24 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not read path: path = /Library/LaunchAgents/com.parallels.vm.prl_pcproxy.plist, error = 2: No such file or directory

133 Apr 7 18:12:04 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not read path: path = /Library/LaunchAgents/com.parallels.vm.prl_pcproxy.plist, error = 2: No such file or directory

134 Apr 7 18:35:10 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not read path: path = /Library/LaunchAgents/com.parallels.vm.prl_pcproxy.plist, error = 2: No such file or directory

135 Apr 7 18:53:42 : Failed to remove file or directory: name = dyld_shared_cache_x86_64h, error = 1: Operation not permitted. Further logging suppressed.

136 Apr 7 18:53:42 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose

137 Apr 7 18:53:48 com.apple.xpc.launchd.domain.system: Caller not allowed to perform action: SecurityAgent.234, action = legacy spawn, code = 1: Operation not permitted, uid = 92, euid = 92, gid = 92, egid = 92, asid = 100007

138 Apr 7 18:54:04 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not import service from caller: caller = otherbsd.308, service = com.apple.CompressorHelper-2, error = 119: Service is disabled

139

140 Loaded kernel extensions

141

142 com.protech.NoSleep (1.4.0)

143

144 System services loaded

145

146 com.adobe.fpsaud

147 com.apple.csrutil.report

148 - status: 71

149 com.apple.logd

150 - status: 1

151 com.apple.watchdogd

152 com.malwarebytes.MBAMHelperTool

153 com.timesoftware.timemachineeditor.backup-auto

154 com.timesoftware.timemachineeditor.helper

155 net.tunnelblick.tunnelblick.tunnelblickd

156

157 System services disabled

158

159 com.apple.mtmfs

160

161 Login services loaded

162

163 2BUA8C4S2C.com.agilebits.onepassword-osx-helper

164 com.apple.Finder

165 - status: -15

166 net.tunnelblick.tunnelblick.LaunchAtLogin

167 - status: 78

168

169 Global login items

170

171 $HELPER_PATH

172 $HELPER_PATH

173

174 Contents of /Library/LaunchDaemons/com.malwarebytes.MBAMHelperTool.plist

175 - mod date: Mar 31 19:30:08 2016

176 - size (B): 584

177 - checksum: 2299099766

178

179 <?xml version="1.0" encoding="UTF-8"?>

180 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

181 <plist version="1.0">

182 <dict>

183 <key>Label</key>

184 <string>com.malwarebytes.MBAMHelperTool</string>

185 <key>MachServices</key>

186 <dict>

187 <key>com.malwarebytes.MBAMHelperTool</key>

188 <true/>

189 </dict>

190 <key>Program</key>

191 <string>/Library/PrivilegedHelperTools/com.malwarebytes.MBAMHelperTool</string>

192 <key>ProgramArguments</key>

193 <array>

194 <string>/Library/PrivilegedHelperTools/com.malwarebytes.MBAMHelperTool</string>

195 </array>

196 </dict>

197 </plist>

198

199 Contents of /Library/LaunchDaemons/com.timesoftware.timemachineeditor.backup-auto.plist

200 - mod date: Apr 4 14:46:56 2016

201 - size (B): 609

202 - checksum: 2610317601

203

204 <?xml version="1.0" encoding="UTF-8"?>

205 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

206 <plist version="1.0">

207 <dict>

208 <key>Label</key>

209 <string>com.timesoftware.timemachineeditor.backup-auto</string>

210 <key>ProgramArguments</key>

211 <array>

212 <string>/Library/PrivilegedHelperTools/com.timesoftware.timemachineeditor.helpe r</string>

213 <string>--backup</string>

214 <string>--allow-battery</string>

215 </array>

216 <key>StartCalendarInterval</key>

217 <dict>

218 <key>Hour</key>

219 <integer>3</integer>

220 <key>Minute</key>

221 <integer>0</integer>

222 </dict>

223 </dict>

224 </plist>

225

226 Contents of /Library/LaunchDaemons/com.timesoftware.timemachineeditor.helper.plist

227 - mod date: Aug 24 16:39:08 2015

228 - size (B): 624

229 - checksum: 933387316

230

231 <?xml version="1.0" encoding="UTF-8"?>

232 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

233 <plist version="1.0">

234 <dict>

235 <key>Label</key>

236 <string>com.timesoftware.timemachineeditor.helper</string>

237 <key>MachServices</key>

238 <dict>

239 <key>com.timesoftware.timemachineeditor.helper</key>

240 <true/>

241 </dict>

242 <key>Program</key>

243 <string>/Library/PrivilegedHelperTools/com.timesoftware.timemachineeditor.helpe r</string>

244 <key>ProgramArguments</key>

245 <array>

246 <string>/Library/PrivilegedHelperTools/com.timesoftware.timemachineeditor.helpe r</string>

247 </array>

248 </dict>

249 </plist>

250

251 Contents of /Library/LaunchDaemons/net.tunnelblick.tunnelblick.tunnelblickd.plist

252 - mod date: Feb 29 16:00:22 2016

253 - size (B): 876

254 - checksum: 53037824

255

256 <?xml version="1.0" encoding="UTF-8"?>

257 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

258 <plist version="1.0">

259 <dict>

260 <key>GroupName</key>

261 <string>wheel</string>

262 <key>Label</key>

263 <string>net.tunnelblick.tunnelblick.tunnelblickd</string>

264 <key>Program</key>

265 <string>/Applications/Tunnelblick.app/Contents/Resources/tunnelblickd</string>

266 <key>Sockets</key>

267 <dict>

268 <key>Listener</key>

269 <dict>

270 <key>SockFamily</key>

271 <string>Unix</string>

272 <key>SockPathMode</key>

273 <integer>438</integer>

274 <key>SockPathName</key>

275 <string>/var/run/net.tunnelblick.tunnelblick.tunnelblickd.socket</string>

276 <key>SockType</key>

277 <string>Stream</string>

278 </dict>

279 </dict>

280 <key>StandardErrorPath</key>

281

282 ...and 5 more line(s)

283

284 Contents of Library/LaunchAgents/net.tunnelblick.tunnelblick.LaunchAtLogin.plist

285 - mod date: Feb 18 21:28:49 2016

286 - size (B): 618

287 - checksum: 2295440304

288

289 <?xml version="1.0" encoding="UTF-8"?>

290 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

291 <plist version="1.0">

292 <dict>

293 <key>Label</key>

294 <string>net.tunnelblick.tunnelblick.LaunchAtLogin</string>

295 <key>ProgramArguments</key>

296 <array>

297 <string>/Applications/Tunnelblick.app/Contents/Resources/launchAtLogin.sh</stri ng>

298 </array>

299 <key>LimitLoadToSessionType</key>

300 <string>Aqua</string>

301 <key>RunAtLoad</key>

302 <true/>

303 <key>OnDemand</key>

304 <true/>

305 <key>ExitTimeOut</key>

306 <integer>0</integer>

307 <key>ProcessType</key>

308 <string>Interactive</string>

309 </dict>

310 </plist>

311

312 User login items

313

314 NoSleep

315 - /Applications/Utilities/NoSleep.app

316 iTunesHelper

317 - /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

318 Activity Monitor

319 - /Applications/Utilities/Activity Monitor.app

320 Yahoo! Widgets

321 - /Applications/Yahoo! Widgets.app

322

323 Safari extensions

324

325 1Password

326 - com.agilebits.onepassword4-safari

327

328 Firefox extensions

329

330 Video DownloadHelper

331 Privacy Badger

332 NoScript Security Suite

333 Disconnect

334 Download Flash and Video

335 Adblock Edge

336 Firefox Hello Beta

337 DownThemAll!

338 Stefano Verna

339 Flashblock

340

341 iCloud services

342

343 MOBILE_DOCUMENTS

344 MAIL_AND_NOTES

345 CONTACTS

346 REMINDERS

347 NOTES

348

349 iCloud errors

350

351 cloudd 95

352 Photos 36

353 Finder 11

354 comapple.CloudPhotosConfiguration 9

355 bird 1

356

357 Continuity errors

358

359 sharingd 69

360 comapple.appkit.xpc.openAndSavePanelService 17

361

362 Restrictive permissions: 99

363

364 Lockfiles: 12

365

366 Global prefs (user)

367

368 AppleICUForce24HourTime = 1

369 AppleInterfaceStyle = Dark

370 "Canon MX430 series FAX" = 1

371

372 Accessibility

373

374 Scroll Zoom: On

375

376 Extensions

377

378 /System/Library/Extensions/JMicronATA.kext

379 - com.jmicron.JMicronATA

380 /System/Library/Extensions/NoSleep.kext

381 - com.protech.NoSleep

382 - Pavel Prokofiev (RR43DU5BN9)

383

384 Applications

385

386 /Applications/Art Text 2.app

387 - com.belightsoft.ArtText2

388 - Belight Software, ltd

389 /Applications/Hex Fiend.app

390 - com.ridiculousfish.HexFiend

391 - Hex Fiend

392 /Applications/Malwarebytes Anti-Malware.app

393 - com.malwarebytes.antimalware

394 - Malwarebytes Corporation (GVZRY6KDKR)

395 /Applications/NameChanger.app

396 - com.mrrsoftware.NameChanger

397 - Mickey Roberson

398 /Applications/RipIt.app

399 - com.thelittleappfactory.RipIt

400 - The Little App Factory Pty. Ltd.

401 /Applications/TimeMachineEditor.app

402 - com.timesoftware.timemachineeditor.application

403 - Thomas CLEMENT

404 /Applications/Utilities/NoSleep.app

405 - com.protech.NoSleep

406 - Pavel Prokofiev (RR43DU5BN9)

407 /Applications/coconutBattery.app

408 - com.coconut-flavour.coconutBattery

409 - Christoph Sinai

410 /Applications/smcFanControl.app

411 - com.eidac.smcFanControl2

412 - Hendrik Holtmann

413

414 PrefPane

415

416 /Library/PreferencePanes/Cuckoo.prefPane

417 - com.toastycode.Cuckoo

418 - Toastycode Signing Certificate

419 /Library/PreferencePanes/Flash Player.prefPane

420 - com.adobe.flashplayerpreferences

421 /Library/PreferencePanes/NoSleep.prefPane

422 - com.protech.NoSleepPref

423 - Pavel Prokofiev (RR43DU5BN9)

424 /Library/PreferencePanes/Perian.prefPane

425 - org.perian.PerianPane

426

427 Bundles

428

429 /Library/Internet Plug-Ins/Flash Player.plugin

430 - com.macromedia.Flash Player.plugin

431 - Adobe Systems, Inc.

432 /Library/Internet Plug-Ins/Quartz Composer.webplugin

433 - com.apple.QuartzComposer.webplugin

434 - Software Signing

435 /Library/Internet Plug-Ins/Yahoo! Installer 3.plugin

436 - com.yahoo.installer.3

437 /Users/USER/Library/Address Book Plug-Ins/SkypeABCaller.bundle

438 - com.skype.SkypeABCaller

439 /Users/USER/Library/Address Book Plug-Ins/SkypeABChatter.bundle

440 - com.skype.SkypeABChatter

441 /Users/USER/Library/Address Book Plug-Ins/SkypeABDialer.bundle

442 - com.skype.skypeabdialer

443 /Users/USER/Library/Address Book Plug-Ins/SkypeABSMS.bundle

444 - com.skype.skypeabsms

445

446 Bundles (new)

447

448 /Library/Internet Plug-Ins/Flash Player.plugin

449 - com.macromedia.Flash Player.plugin

450 - Adobe Systems, Inc.

451 /Library/PreferencePanes/Flash Player.prefPane

452 - com.adobe.flashplayerpreferences

453

454 Library paths

455

456 /Users/USER/Library/Application Support/Firefox/Profiles/arud9lo0.default/gmp-gmpopenh264/1.1/libgmpopenh264.dy lib

457 /Users/USER/Library/Application Support/Firefox/Profiles/arud9lo0.default/gmp-gmpopenh264/1.5.3/libgmpopenh264. dylib

458

459 App extensions

460

461 com.agilebits.onepassword-osx.safariextensioncompanion

462 com.parallels.desktop.console.Resource-Monitor

463 com.pixelmatorteam.pixelmator.Repair-Tool-Action-Extension

464 com.pixelmatorteam.pixelmator.photos-distort-extension

465

466 Signatures

467

468 /Library/Application Support/iPhoto/iPhoto Library Upgrader.app: bundle format unrecognized, invalid, or unsuitable

469

470 Non-loading kernel extensions

471

472 /System/Library/Extensions/AppleOSXUSBNCM.kext

473 - com.apple.driver.AppleOSXUSBNCM

474 - Software Signing

475

476 Installations

477

478 Adobe Flash Player: 4/8/16, 11:55

479 1Password: 4/5/16, 00:20

480 1Password: 4/1/16, 06:51

481 Adobe Flash Player: 3/24/16, 00:27

482 Adobe Flash Player: 3/11/16, 08:19

483

484 Elapsed time (sec): 608

Reply

Answer 4

Linc Davis

Level 10

209,739 points

Apr 9, 2016 12:59 PM in response to Squid3660

A

"Tunnelblick" is throwing errors. I suggest that you remove it and test. If the problem is resolved and you still want to use it, refer to the developer for support or an update.

Any third-party software that doesn't install from the App Store or by drag-and-drop into the Applications folder, and uninstall by drag-and-drop to the Trash, is a system modification.

Whenever you remove system modifications, they must be removed completely, and the only way to do that is to use the uninstallation tool, if any, provided by the developers, or to follow their instructions. If the software has been incompletely removed, you may have to re-download or even reinstall it in order to finish the job.

I never install system modifications myself, and except as stated in this comment, I don't know how to uninstall them. You'll have to do your own research to find that information.

Here are some general guidelines to get you started. Suppose you want to remove something called “BrickMyMac” (a hypothetical example.) First, consult the product's Help menu, if there is one, for instructions. Finding none there, look on the developer's website, say www.brickmymac.com. (That may not be the actual name of the site; if necessary, search the Web for the product name.) If you don’t find anything on the website or in your search, contact the developer. While you're waiting for a response, download BrickMyMac.dmg and open it. There may be an application in there such as “Uninstall BrickMyMac.” If not, open “BrickMyMac.pkg” and look for an Uninstall button. The uninstaller might also be accessed by clicking the Customize button, if there is one.

Back up all data before making any changes.

You will generally have to restart the computer in order to complete an uninstallation. Until you do that, there may be no effect, or unpredictable effects.

If you can’t remove software in any other way, you’ll have to erase and install OS X. Never install any third-party software unless you're sure you know how to uninstall it; otherwise you may create problems that are very hard to solve.

Trying to remove complex system modifications by hunting for files by name often will not work and may make the problem worse. The same goes for "utilities" such as "AppCleaner" and the like that purport to remove software.

B

This procedure will delete certain temporary and cache files. The files are automatically generated and don't contain any of your data. Occasionally they can become corrupt and cause problems such as yours.

Please back up all data and read this whole message before doing anything.

Triple-click anywhere in the line below on this page to select it:

/var/folders/zz

Right-click or control-click the highlighted line and select

Services ▹ Open

from the contextual menu.* A folder named "zz" should open. Inside it are several subfolders, each with a long name beginning in "zyx". One of them has this name:

zyxvpxvq6csfxvn_n0000000000000

Note that the name ends in a series of zeros. Leave that one alone, and move all the other subfolders of "zz" to the Trash. You may be prompted for your administrator login password. Restart the computer and empty the Trash.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

C

You should update to the current version of OS X (10.11.4) in the App Store. It's supposed to include bug fixes related to networking.

Reply

Answer 5

Squid3660 Author

Level 1

9 points

Apr 10, 2016 4:09 AM in response to Linc Davis

Linc, I did steps A and B, rebooted, but the problem still exists. I'm just going to try a fresh install of El Capitan. Thanks for your time though!

Reply

Answer 6

jkbull

Level 1

86 points

Apr 12, 2016 6:08 AM in response to Linc Davis

Sorry, but I didn't see this until earlier today, and then the Apple Support Communities website was down.

Linc Davis wrote:

"Tunnelblick" is throwing errors. I suggest that you remove it and test. If the problem is resolved and you still want to use it, refer to the developer for support or an update.

Why do you say that, Linc? There are no error messages implicating Tunnelblick.

In fact, as Squid3660 writes, Tunnelblick fixes his problem (assuming "connect to VPN" means "use Tunnelblick to connect to a VPN").

Reply

Answer 7

jkbull

Level 1

86 points

Apr 12, 2016 6:17 AM in response to Squid3660

Your computer may be undergoing a Man in the Middle ("MITM") attack. That would fit all of the symptoms:

The computer works fine for a while (while the attacker is collecting data and determining whether or not and how to attack);
The computer loses access to https: connections because the attacker cannot spoof certificates used by https:;
The computer maintains access to http: connections because
The computer regains access to https: when it reboots (gets a new IP address, perhaps, or changes packet counters and other networking info such that it takes the attacker time to analyze traffic for the attack).

Note: symptom #2 indicates the attacker is probably not be a state-level player (China/NSA/etc.) because such entities are presumed to be able to spoof https: certificates by using compromised or captive certificates authorities.

ISPs have been known to have performed MITM attacks to inject advertising; perhaps your ISP is trying to do that but is incompetent and is disabling https: in error!

One of the purposes of a VPN is to thwart MITM attacks; perhaps your VPN is just doing it's job!

Reply

Answer 8

Linc Davis

Level 10

209,739 points

Apr 12, 2016 8:25 AM in response to jkbull

There are no error messages implicating Tunnelblick.

166 net.tunnelblick.tunnelblick.LaunchAtLogin

167 - status: 78 [Function not implemented]

Reply

Answer 9

jkbull

Level 1

86 points

Apr 12, 2016 9:06 AM in response to Linc Davis

Linc Davis wrote:

There are no error messages implicating Tunnelblick.

166 net.tunnelblick.tunnelblick.LaunchAtLogin

167 - status: 78 [Function not implemented]

Harmless and has no effect.

The "unimplemented function" is the "OnDemand" item in the .plist. It is required for proper functioning on OS X 10.4, but is ignored on later versions of OS X, which use the more powerful "KeepAlive" item (but which Tunnelblick does not need). To reduce complexity Tunnelblick uses the same .plist for all versions of OS X that Tunnelblick supports (10.4 and up).

This "LaunchAtLogin" login item runs once (only) per login session and does very little: it checks a Tunnelblick preference and returns unless the default is "true". If the default is "true", it attempts to launch Tunnelblick, and then returns. This helps implement Tunnelblick's behavior as a status bar item: if Tunnelblick was running when the user logged out (or the computer shut down), then it is launched when the user logs in; otherwise it isn't launched when the user logs in.

Reply

Answer 10

Squid3660 Author

Level 1

9 points

Apr 12, 2016 12:19 PM in response to jkbull

Sorry, I should have clarified, the problem existed months before I installed tunnelblick or any VPN. The only reason I started using VPN is because I was studying for an IT exam and so was just experimenting. I could never get tunnelblick to work (lack of understanding) so just abandoned it.

So this past Sunday, I performed a clean install of El Capitan from the original installer (Oct 2015) and upgraded with the combo update to 10.11.3. I migrated a few trusted applications and documents. It wasn't long before the original symptoms returned and has been dropping secure connections at least once a day.

In regards to MitM, when I think about my network setup, my MacBook Air is connected via Wi-Fi (WPA2-PSK) with strong password on a NAT firewall router which is behind a DSL modem/router with NAT as well. So, I'm wondering why other machines on the same network don't experience any secure drop outs. How would a MitM attack tell my MacBook Air's traffic from any other device's traffic? Now I'm paranoid.

One other observation, I was recently on holiday and staying at a hotel for a week. During that time, my MacBook Air never experienced the secure drop outs while on the hotel's network. Now that I am back home and on my home network 100% of the time, the daily random dropouts returned. Edit: Then again, I may have just been using VPN during my entire hotel stay, which is obviously the safe thing to do. Sorry to confuse the issue.

Reply

Answer 11

Linc Davis

Level 10

209,739 points

Apr 12, 2016 12:20 PM in response to Squid3660

NAT firewall router which is behind a DSL modem/router with NAT as well

That's double NAT, which won't work reliably. One of those devices should be in bridge mode and the other in routing mode.

Reply

Answer 12

Squid3660 Author

Level 1

9 points

Apr 12, 2016 12:47 PM in response to Linc Davis

Linc, I agree, I can see that as a possible issue, but, none of my other network devices are effected. They have never had any issues connecting secure. I have also connected this MacBook Air directly to the DSL modem/router when the secure connections drop out, to weed out the possibility of an issue with double NAT, but that did not resolve the problem.

Something new to the puzzle, I have recently noticed that secure connections restore themselves if I wait them out long enough (without rebooting). I've been trying so many things lately to try and resolve this, that I have put off rebooting for an hour or so, and I'll notice that my secure connections are restored (Mail, Skype).

Shrug

Reply

Answer 13

Linc Davis

Level 10

209,739 points

Apr 12, 2016 1:49 PM in response to Squid3660

Please repeat the test you ran. I'd like to see what has changed.

Reply

Answer 14

Squid3660 Author

Level 1

9 points

Apr 12, 2016 2:19 PM in response to Linc Davis

Linc, this test was done a few minutes ago under normal conditions.

1 Start time: 21:02:57 04/12/16

2

3 Revision: 1569

4

5 Model Identifier: MacBookAir7,2

6 Boot ROM Version: MBA71.0166.B09

7 System Version: OS X 10.11.3 (15D21)

8 Kernel Version: Darwin 15.3.0

9 Time since boot: 23:21

10

11 Energy impact, lifetime (relative)

12

13 WindowServer (UID 88): 5334.34

14 kernel_task (UID 0): 43.73

15 bash (UID 501): 16.39

16

17 GPU usage, lifetime (ms/s)

18

19 WindowServer (UID 88): 13329.01

20

21 CPU usage, lifetime (ms/s)

22

23 bash (UID 501): 163.95

24

25 LS schemes: No

26

27 Firewall: On

28

29 Active MTU: 1492 (Current Setting: 1492)

30

31 Diagnostic reports

32

33 2016-04-11 Solitaire Plus! crash

34 2016-04-12 com.apple.WebKit.Networking crash

35

36 HID errors: 5

37

38 Kernel log

39

40 Apr 12 17:43:28 Limiting closed port RST response from 260 to 250 packets per second

41 Apr 12 17:43:30 Limiting closed port RST response from 254 to 250 packets per second

42 Apr 12 17:43:32 Limiting closed port RST response from 259 to 250 packets per second

43 Apr 12 17:43:34 Limiting closed port RST response from 264 to 250 packets per second

44 Apr 12 17:43:36 Limiting closed port RST response from 255 to 250 packets per second

45 Apr 12 17:43:38 Limiting closed port RST response from 257 to 250 packets per second

46 Apr 12 17:43:40 Limiting closed port RST response from 270 to 250 packets per second

47 Apr 12 17:43:42 Limiting closed port RST response from 256 to 250 packets per second

48 Apr 12 17:43:44 Limiting closed port RST response from 262 to 250 packets per second

49 Apr 12 17:43:46 Limiting closed port RST response from 257 to 250 packets per second

50 Apr 12 17:43:48 Limiting closed port RST response from 254 to 250 packets per second

51 Apr 12 17:43:50 Limiting closed port RST response from 256 to 250 packets per second

52 Apr 12 17:43:53 Limiting closed port RST response from 257 to 250 packets per second

53 Apr 12 17:43:54 Limiting closed port RST response from 253 to 250 packets per second

54 Apr 12 17:43:56 Limiting closed port RST response from 256 to 250 packets per second

55 Apr 12 17:43:58 Limiting closed port RST response from 251 to 250 packets per second

56 Apr 12 17:44:00 Limiting closed port RST response from 253 to 250 packets per second

57 Apr 12 17:44:02 Limiting closed port RST response from 256 to 250 packets per second

58 Apr 12 17:44:04 Limiting closed port RST response from 257 to 250 packets per second

59 Apr 12 17:44:06 Limiting closed port RST response from 253 to 250 packets per second

60 Apr 12 17:44:08 Limiting closed port RST response from 255 to 250 packets per second

61 Apr 12 17:44:10 Limiting closed port RST response from 253 to 250 packets per second

62 Apr 12 17:44:12 Limiting closed port RST response from 252 to 250 packets per second

63 Apr 12 17:44:14 Limiting closed port RST response from 252 to 250 packets per second

64 Apr 12 17:44:17 Limiting closed port RST response from 257 to 250 packets per second

65

66 System log

67

68 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextScaleCTM: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

69 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextScaleCTM: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

70 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextGetCTM: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

71 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextScaleCTM: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

72 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextScaleCTM: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

73 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextGetCTM: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

74 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextGetShouldSmoothFonts: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

75 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextGetFontSmoothingStyle: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

76 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextGetFontAntialiasingStyle: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

77 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextSetFontSmoothingStyle: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

78 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextGetShouldSmoothFonts: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

79 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextGetFontSmoothingStyle: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

80 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextGetFontAntialiasingStyle: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

81 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextSetFontSmoothingStyle: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

82 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextScaleCTM: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

83 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextScaleCTM: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

84 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextGetCTM: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

85 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextGetShouldSmoothFonts: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

86 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextGetFontSmoothingStyle: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

87 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextGetFontAntialiasingStyle: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

88 Apr 12 20:19:20 com.apple.preference.security.remoteservice: CGContextSetFontSmoothingStyle: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.

89 Apr 12 20:21:15 ntpd: sigio_handler: sigio_handler_active != 1

90 Apr 12 20:21:15 ntpd: sigio_handler: sigio_handler_active != 0

91 Apr 12 20:33:40 com.apple.appkit.xpc.openAndSavePanelService: [default] Failed to create bookmark with error: Error Domain=NSCocoaErrorDomain Code=260 "The file couldn’t be opened because it doesn’t exist."

92 Apr 12 21:01:05 AppleSpell: Lexicon creation failed: Lexicon resources not found

93

94 launchd log

95

96 Apr 10 15:26:32 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose

97 Apr 10 19:24:21 com.apple.xpc.launchd.domain.system: Could not read path: path = //System/Library/LaunchDaemons/com.apple.stackshot.plist, error = 2: No such file or directory

98 Apr 10 19:25:05 : Failed to remove file or directory: name = dyld_shared_cache_x86_64h, error = 1: Operation not permitted. Further logging suppressed.

99 Apr 10 19:25:41 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose

100 Apr 10 20:45:47 : Failed to remove file or directory: name = dyld_shared_cache_x86_64h, error = 1: Operation not permitted. Further logging suppressed.

101 Apr 10 20:45:47 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose

102 Apr 10 21:28:04 : Failed to remove file or directory: name = dyld_shared_cache_x86_64h, error = 1: Operation not permitted. Further logging suppressed.

103 Apr 10 21:28:04 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose

104 Apr 11 03:18:36 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not read path: path = /Library/LaunchAgents/com.parallels.vm.prl_pcproxy.plist, error = 2: No such file or directory

105 Apr 11 03:28:38 com.apple.xpc.launchd.user.domain.501.100007.Aqua: Could not read path: path = /Library/LaunchAgents/com.parallels.vm.prl_pcproxy.plist, error = 2: No such file or directory

106 Apr 11 21:42:05 : Failed to remove file or directory: name = dyld_shared_cache_x86_64h, error = 1: Operation not permitted. Further logging suppressed.

107 Apr 11 21:42:05 com.apple.airplaydiagnostics.server: Unrecognized MachService property: ResetAtClose

108

109 Console log

110

111 Apr 10 15:46:51 fontd: Failed to open read-only database, regenerating DB

112 Apr 10 19:25:57 fontd: Failed to open read-only database, regenerating DB

113

114 System services loaded

115

116 com.apple.logd

117 - status: 1

118 com.apple.watchdogd

119 com.timesoftware.timemachineeditor.backup-auto

120 com.timesoftware.timemachineeditor.helper

121

122 System services disabled

123

124 com.apple.mtmfs

125

126 Login services loaded

127

128 2BUA8C4S2C.com.agilebits.onepassword-osx-helper

129 com.apalonapps.myalarmclockhelper

130

131 Contents of /Library/LaunchDaemons/com.timesoftware.timemachineeditor.backup-auto.plist

132 - mod date: Apr 11 13:29:29 2016

133 - size (B): 618

134 - checksum: 713678761

135

136 <?xml version="1.0" encoding="UTF-8"?>

137 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

138 <plist version="1.0">

139 <dict>

140 <key>Label</key>

141 <string>com.timesoftware.timemachineeditor.backup-auto</string>

142 <key>ProgramArguments</key>

143 <array>

144 <string>/Library/PrivilegedHelperTools/com.timesoftware.timemachineeditor.helpe r</string>

145 <string>--backup</string>

146 </array>

147 <key>StartCalendarInterval</key>

148 <dict>

149 <key>Hour</key>

150 <integer>0</integer>

151 <key>Minute</key>

152 <integer>5</integer>

153 <key>Weekday</key>

154 <integer>5</integer>

155 </dict>

156 </dict>

157 </plist>

158

159 Contents of /Library/LaunchDaemons/com.timesoftware.timemachineeditor.helper.plist

160 - mod date: Apr 11 03:53:17 2016

161 - size (B): 624

162 - checksum: 933387316

163

164 <?xml version="1.0" encoding="UTF-8"?>

165 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

166 <plist version="1.0">

167 <dict>

168 <key>Label</key>

169 <string>com.timesoftware.timemachineeditor.helper</string>

170 <key>MachServices</key>

171 <dict>

172 <key>com.timesoftware.timemachineeditor.helper</key>

173 <true/>

174 </dict>

175 <key>Program</key>

176 <string>/Library/PrivilegedHelperTools/com.timesoftware.timemachineeditor.helpe r</string>

177 <key>ProgramArguments</key>

178 <array>

179 <string>/Library/PrivilegedHelperTools/com.timesoftware.timemachineeditor.helpe r</string>

180 </array>

181 </dict>

182 </plist>

183

184 User login items

185

186 iTunesHelper

187 - /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

188 Activity Monitor

189 - /Applications/Utilities/Activity Monitor.app

190 My Alarm Clock

191 - /Applications/My Alarm Clock.app

192

193 Safari extensions

194

195 1Password

196 - com.agilebits.onepassword4-safari

197

198 Firefox extensions

199

200 Firefox Hello Beta

201 Adblock Edge

202 Flashblock

203 NoScript Security Suite

204 Adblock Plus

205 Video DownloadHelper

206 DownThemAll!

207 Stefano Verna

208 Privacy Badger

209 Disconnect

210 Download Flash and Video

211

212 iCloud services

213

214 MOBILE_DOCUMENTS

215 PHOTO_STREAM

216 MAIL_AND_NOTES

217 CONTACTS

218 CALENDAR

219 REMINDERS

220 NOTES

221 FIND_MY_MAC

222

223 iCloud errors

224

225 Photos 28

226 comapple.CloudPhotosConfiguration 20

227 cloudd 18

228 bird 7

229 cloudphotosd 5

230 Finder 3

231 comapple.InputMethodKit.TextReplacementService 1

232

233 Continuity errors

234

235 sharingd 28

236 TextEdit 27

237 sharedfilelistd 14

238 comapple.appkit.xpc.openAndSavePanelService 4

239

240 Restrictive permissions: 3

241

242 Applications

243

244 /Applications/Art Text 2.app

245 - com.belightsoft.ArtText2

246 - Belight Software, ltd

247 /Applications/TimeMachineEditor.app

248 - com.timesoftware.timemachineeditor.application

249 - Thomas CLEMENT

250

251 Bundles

252

253 /Library/Internet Plug-Ins/Quartz Composer.webplugin

254 - com.apple.QuartzComposer.webplugin

255 - Software Signing

256 /Users/USER/Library/Address Book Plug-Ins/SkypeABCaller.bundle

257 - com.skype.SkypeABCaller

258 /Users/USER/Library/Address Book Plug-Ins/SkypeABChatter.bundle

259 - com.skype.SkypeABChatter

260 /Users/USER/Library/Address Book Plug-Ins/SkypeABDialer.bundle

261 - com.skype.SkypeABDialer

262 /Users/USER/Library/Address Book Plug-Ins/SkypeABSMS.bundle

263 - com.skype.SkypeABSMS

264

265 Library paths

266

267 /Users/USER/Library/Application Support/Firefox/Profiles/e9qa5cc3.default/gmp-gmpopenh264/1.5.3/libgmpopenh264. dylib

268

269 App extensions

270

271 com.agilebits.onepassword-osx.safariextensioncompanion

272 com.parallels.desktop.console.Resource-Monitor

273

274 Non-loading kernel extensions

275

276 /System/Library/Extensions/AppleOSXUSBNCM.kext

277 - com.apple.driver.AppleOSXUSBNCM

278 - Software Signing

279

280 Installations

281

282 My Alarm Clock: 4/11/16, 8:44 PM

283

284 Elapsed time (sec): 449

Reply

Answer 15

Linc Davis

Level 10

209,739 points

Apr 12, 2016 2:58 PM in response to Squid3660

I don't know what you're using as an installer, but the latest OS X is version 10.11.4. You have 10.11.3. I suggest that you either download the installer from the App Store and run it, or else start up in Recovery mode to reinstall.

Also, I see that you changed the MTU in the network settings. Did that have any effect? It should never be necessary to change that parameter unless you're connecting to the Internet through a VPN or PPP tunnel that doesn't work very well, or you have some other unusual network configuration.

Reply