I have an app called 'bin' It just won't go away. Every time I 'shut down' . The app 'bin' needs to be 'force quit'.

Question

I have an app called 'bin' It just won't go away. Every time I 'shut down' . The app 'bin' needs to be 'force quit'.

Posted on Apr 7, 2016 4:38 AM

Reply

Answer 1

thomas_r.

Level 7

31,989 points

Apr 19, 2016 1:39 PM in response to Leopardus

Leopardus wrote:

There should be a hidden directory in the root called bin which contains a lot of binary files. Try moving this 'app' of yours to the root.

No, don't do that. The hidden /bin directory would not show up anywhere as an application, and if you move something with the same name to the root level of the hard drive and are somehow able to actually make it replace /bin (which I think would take some special gymnastics to do), you would bork your entire system.

Reply

Answer 2

cdhw

Level 4

3,588 points

Apr 19, 2016 2:24 PM in response to ReallyHateApple

You've got a lot of adware and are also running Avid and bittorrent and have a load of extensions and other third-party stuff that will not help your Mac run well or securely.

Anyway, focusing on your actual question, when the unwanted 'bin' process is running, please open

Utilities > Terminal.app

and paste this command at the prompt,

ps ax | grep bin

enter it by pressing the return key, and then post the results here.

C.

Reply

Answer 3

Apr 20, 2016 3:36 AM in response to cdhw

Here are the results from pasting "ps ax | grep bin" into Terminal ...and "pressing the return key."

Last login: Wed Apr 20 19:43:52 on console

declan-ogallaghers-imac-5:~ declanogallagher$ ps ax | grep bin

1 ?? Ss 0:01.60 /sbin/launchd

11 ?? Ss 0:00.91 /usr/sbin/DirectoryService

12 ?? Ss 0:00.13 /usr/sbin/notifyd

13 ?? Ss 0:00.10 /usr/sbin/diskarbitrationd

15 ?? Ss 0:00.14 /usr/sbin/syslogd

16 ?? Ss 0:00.13 /usr/sbin/distnoted

17 ?? Ss 0:00.83 /usr/sbin/blued

20 ?? Ss 0:00.20 /usr/sbin/mDNSResponder -launchd

26 ?? Ss 0:00.19 /usr/sbin/securityd -i

30 ?? Ss 0:00.08 /usr/sbin/ntpd -c /private/etc/ntp-restrict.conf -n -g -p /var/run/ntpd.pid -f /var/db/ntp.drift

31 ?? Ss 0:00.21 /usr/sbin/cupsd -l

32 ?? Ss 0:00.22 /usr/sbin/krb5kdc -n

37 ?? Ss 0:00.02 /sbin/SystemStarter

44 ?? Ss 0:00.01 /usr/sbin/KernelEventAgent

49 ?? Ss 0:00.20 /sbin/dynamic_pager -F /private/var/vm/swapfile

107 ?? S 0:00.33 /usr/sbin/qmasterd

115 ?? S 0:00.09 /usr/sbin/qmasterd -child

146 ?? Ss 0:00.06 /usr/sbin/coreaudiod

170 ?? Ss 0:00.20 /sbin/launchd

234 ?? S 0:00.01 /usr/sbin/pboard

342 ?? Ss 0:00.00 /bin/bash /usr/share/addressBookServerEnterpriseEdition/startAddressBookServer.sh

343 ?? S 0:09.71 /System/Library/Frameworks/JavaVM.framework/Home/bin/java -Xmx512M -Xms64M -XX:MaxPermSize=384M -Dfile.encoding=UTF-8 -DH2_TCP_PORT=48081 -DH2_WEB_PORT=48082 -Dorg.apache.el.parser.COERCE_TO_ZERO=false -Dcom.addressbookserver.ENABLE_BONJOUR=true -Dcom.addressbookserver.ENABLE_H2=true -Dcom.addressbookserver.H2_DATABASE=../db -Dcom.addressbookserver.H2_BACKUPS=../backups -Dcom.sun.management.jmxremote -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.util.logging.config.file=/usr/share/addressBookServerEnterpriseEdition/a pache-tomcat-6.0.18/conf/logging.properties -Djava.endorsed.dirs=/usr/share/addressBookServerEnterpriseEdition/apache-tomca t-6.0.18/endorsed -classpath :/usr/share/addressBookServerEnterpriseEdition/apache-tomcat-6.0.18/bin/bootstr ap.jar -Dcatalina.base=/usr/share/addressBookServerEnterpriseEdition/apache-tomcat-6.0 .18 -Dcatalina.home=/usr/share/addressBookServerEnterpriseEdition/apache-tomcat-6.0 .18 -Djava.io.tmpdir=/usr/share/addressBookServerEnterpriseEdition/apache-tomcat-6. 0.18/temp org.apache.catalina.startup.Bootstrap start

360 ?? Ss 0:00.06 /usr/sbin/nmbd -F

402 ?? Ss 0:00.02 /usr/sbin/ocspd

437 s000 U+ 0:00.00 grep bin

declan-ogallaghers-imac-5:~ declanogallagher$

Reply

Answer 4

Apr 20, 2016 3:59 AM in response to Leopardus

Re ANSWER

Leopardus Apr 19, 2016 6:15 AM
in response to ReallyHateApple

You can also follow the instructions in Stop pop-up ads and adware in Safari - Apple Support to manually remove the adware if you don't find the program

I tried removing adware and found none of the files listed in library or application root.

ie files listed below..

/System/Library/Frameworks/v.framework

```
/System/Library/Frameworks/v.framework
```

/System/Library/Frameworks/VSearch.framework

```
/Library/PrivilegedHelperTools/Jack
```
```
/Library/InputManagers/CTLoader/
```
```
/Library/Application Support/Conduit/
```

~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin

~/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin

```
/Applications/SearchProtect.app
```
```
/Applications/WebTools.app
```
```
/Applications/cinemapro1-2.app
```
```
~/App
```
```
lications/cinemapro1-2.app
```
```
/Applications/PremierOpinion
```
```
/Applications/EasyShopper
```

Reply

Answer 5

SeaPapp

Level 7

26,486 points

Apr 20, 2016 4:50 AM in response to ReallyHateApple

Which is a good reason to run MalwareBytes to remove the adware easily http://www.adwaremedic.com/index.php Manual file removal isn't always easy.

Reply

Answer 6

seventy one

Level 7

27,430 points

Apr 20, 2016 5:01 AM in response to ReallyHateApple

I am wondering if all this has come from an App store app called 'Bin it' ... but which is also given away by some rogue sites like Softonic, Macupdate and the like. Which could then explain where the adware came from. And which is where Mike Sombrio's Malwarebytes suggestion comes into play to help rid the nuisance..

Reply

Answer 7

Apr 20, 2016 5:04 AM in response to SeaPapp

Cheers Mike.. I'm after one for 10.6. I'll keep looking unless you have a url handy?

Reply

Answer 8

Leopardus

Level 4

1,303 points

Apr 20, 2016 6:06 AM in response to ReallyHateApple

You will have to look in Thomas archives http://www.thesafemac.com/arg/ as the present Malwarebytes are for OS X 10.8 and later. Your other alternative would be to look for Linc Davis process to remove it.

Incidentally, the output from your grep command looks quite normal for what happens as far as I can remember. (comparing it to my own), but mine has far more lines.

Leo

Reply

Answer 9

SeaPapp

Level 7

26,486 points

Apr 20, 2016 2:14 PM in response to ReallyHateApple

ReallyHateApple wrote:

Cheers Mike.. I'm after one for 10.6. I'll keep looking unless you have a url handy?

Sorry, didn't realize. Maybe something here can help http://www.thesafemac.com/arg-identification/

Reply

Answer 10

cdhw

Level 4

3,588 points

Apr 20, 2016 2:36 PM in response to ReallyHateApple

Okay. I suspect, but am not yet sure, that your 'bin' process is the autolaunched process that is setup by 'addressBookServerEnterpriseEdition' to keep your address books in sync.

In Activity Monitor, can you identify the 'bin' process and then the PID associated with it, which will be a number, say 1234 for example. Then in Terminal.app:

ps x 1234 | cat

, which will show the process details. (Replace 1234 with the correct value.) Copy and paste the results of this ps command here.

C.

Reply

Answer 11

May 1, 2016 8:30 PM in response to cdhw

In the Activity Monitor "Open Files and Ports" I can see no reference to the word 'bin'. The sample text refers to "Analysis of sampling Activity Monitor (pid 3420) every 1 millisecond" in the third line. I used "px x 3240 | cat" in the Terminal App and the result was..

Last login: Mon May 2 12:49:48 on ttys000

declan-ogallaghers-imac-5:~ declanogallagher$ ps x 3420 | cat

PID TT STAT TIME COMMAND

3420 ?? S 0:12.88 /Applications/Utilities/Activity Monitor.app/Contents/MacOS/Activity Monitor -psn_0_639132

declan-ogallaghers-imac-5:~ declanogallagher$

Much appreciated any help.

Reply

Answer 12

cdhw

Level 4

3,588 points

May 2, 2016 2:17 AM in response to ReallyHateApple

Just to confirm, make sure that:

Activity Monitor > View > All Processes

is checked. Then click the 'Process Name' column and see if there is a process called 'bin'.

C.

Reply

Answer 13

May 2, 2016 2:55 AM in response to cdhw

Yes, The PID 11302 on the Activity Monitor in bin line then put into the Terminal app as "ps x 11302 | cat," gave....

Last login: Mon May 2 12:50:30 on ttys000

declan-ogallaghers-imac-5:~ declanogallagher$ ps x 11302 | cat

PID TT STAT TIME COMMAND

11302 ?? S 0:23.24 /System/Library/Frameworks/JavaVM.framework/Home/bin/java -Xmx512M -Xms64M -XX:MaxPermSize=384M -Dfile.encoding=UTF-8 -DH2_TCP_PORT=48081 -DH2_WEB_PORT=48082 -Dorg.apache.el.parser.COERCE_TO_ZERO=false -Dcom.addressbookserver.ENABLE_BONJOUR=true -Dcom.addressbookserver.ENABLE_H2=true -Dcom.addressbookserver.H2_DATABASE=../db -Dcom.addressbookserver.H2_BACKUPS=../backups -Dcom.sun.management.jmxremote -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.util.logging.config.file=/usr/share/addressBookServerEnterpriseEdition/a pache-tomcat-6.0.18/conf/logging.properties -Djava.endorsed.dirs=/usr/share/addressBookServerEnterpriseEdition/apache-tomca t-6.0.18/endorsed -classpath :/usr/share/addressBookServerEnterpriseEdition/apache-tomcat-6.0.18/bin/bootstr ap.jar -Dcatalina.base=/usr/share/addressBookServerEnterpriseEdition/apache-tomcat-6.0 .18 -Dcatalina.home=/usr/share/addressBookServerEnterpriseEdition/apache-tomcat-6.0 .18 -Djava.io.tmpdir=/usr/share/addressBookServerEnterpriseEdition/apache-tomcat-6. 0.18/temp org.apache.catalina.startup.Bootstrap start

declan-ogallaghers-imac-5:~ declanogallagher$

Feels very close now.

Reply

Answer 14

May 5, 2016 5:00 AM in response to ReallyHateApple

Just went back to double check. The Activity Monitor in

Activity Monitor > View > All Processes

The bin PID number has changed to 212 I put this number to the Terminal App and....

declan-ogallaghers-imac-5:~ declanogallagher$ ps x 212 | cat

PID TT STAT TIME COMMAND

212 ?? S 0:42.43 /System/Library/Frameworks/JavaVM.framework/Home/bin/java -Xmx512M -Xms64M -XX:MaxPermSize=384M -Dfile.encoding=UTF-8 -DH2_TCP_PORT=48081 -DH2_WEB_PORT=48082 -Dorg.apache.el.parser.COERCE_TO_ZERO=false -Dcom.addressbookserver.ENABLE_BONJOUR=true -Dcom.addressbookserver.ENABLE_H2=true -Dcom.addressbookserver.H2_DATABASE=../db -Dcom.addressbookserver.H2_BACKUPS=../backups -Dcom.sun.management.jmxremote -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.util.logging.config.file=/usr/share/addressBookServerEnterpriseEdition/a pache-tomcat-6.0.18/conf/logging.properties -Djava.endorsed.dirs=/usr/share/addressBookServerEnterpriseEdition/apache-tomca t-6.0.18/endorsed -classpath :/usr/share/addressBookServerEnterpriseEdition/apache-tomcat-6.0.18/bin/bootstr ap.jar -Dcatalina.base=/usr/share/addressBookServerEnterpriseEdition/apache-tomcat-6.0 .18 -Dcatalina.home=/usr/share/addressBookServerEnterpriseEdition/apache-tomcat-6.0 .18 -Djava.io.tmpdir=/usr/share/addressBookServerEnterpriseEdition/apache-tomcat-6. 0.18/temp org.apache.catalina.startup.Bootstrap start

declan-ogallaghers-imac-5:~ declanogallagher$

Nearly there?

Reply

Answer 15

cdhw

Level 4

3,588 points

May 5, 2016 8:52 AM in response to ReallyHateApple

My earlier guess looks correct. You have installed a piece of software 'addressBookServerEnterpriseEdition', which is apparently intend to synchronise address books between different Macs. My guess is you've had it quite a while. Do you still need it?

C.

Reply