High Sierra keeps changing my default app for PDFs

Many thanks again for your help. CleanMyMac was the culprit. I'm somewhat annoyed with the major software company tech who asked me to install it to remove remnants of their app before re-installation.

Some additional details:
* Removing CleanMyMac only did not solve the problem. When I just did that, the issued later returned.

* Removing Firefox only did not solved the problem.

* To solve the problem, I tried different combinations of app removal until the problem was fixed. I finally removed CleanMyMac followed by removing Firefox. I then reinstalled Firefox (I'm using Firefox to post right now) and the problem has not occurred since. Firefox and CleanMyMac were the same versions as previously installed.

* It was not necessary to remove Sophos Home.

Thanks again.

Are you using Firefox Quantum (latest version of Firefox)? See CountryGirl56's posts above. Some people have identified this as the problem.

Thanks very much. Here's the EtreCheck report.

Note that the behaviour is not currently occurring. I set the default to Acrobat earlier today and so far it has stuck. But I have done this several times recently and the issue reoccurs frequently.

***

EtreCheck version: 3.4.7 (461)

Report generated 2018-02-14 21:20:15

Download EtreCheck from https://etrecheck.com

Runtime: 11:22

Performance: Poor

Click the [Lookup] links for more information from Apple Support Communities.

Click the [Details] links for more information about that line.

Click the [Clean up] link to delete unused files.

Problem: Other problem

Description:

Default app for PDF keeps changing

Hardware Information: ⓘ

iMac (Retina 5K, 27-inch, Late 2015)

[Technical Specifications] - [User Guide] - [Warranty & Service]

iMac - model: iMac17,1

1 3.3 GHz Intel Core i5 (i5-6600) CPU: 4-core

24 GB RAM Upgradeable - [Instructions]

BANK 0/DIMM0

4 GB DDR3 1867 MHz ok

BANK 0/DIMM1

8 GB DDR3 1867 MHz ok

BANK 1/DIMM0

4 GB DDR3 1867 MHz ok

BANK 1/DIMM1

8 GB DDR3 1867 MHz ok

Handoff/Airdrop2: supported

Wireless: en1: 802.11 a/b/g/n/ac

iCloud Quota: 31.03 GB available

Video Information: ⓘ

AMD Radeon R9 M395 - VRAM: 2 GB

iMac 5120 x 2880

S2410W 1920 x 1200

Disk Information: ⓘ

APPLE HDD ST2000DM001 disk0: (2 TB) (Rotational)

[Show SMART report]

EFI (disk0s1 - MS-DOS FAT32) <not mounted> [EFI]: 210 MB

(disk0s2) <not mounted> [CoreStorage Container]: 2.00 TB

Recovery HD (disk0s3 - Journaled HFS+) <not mounted> [Recovery]: 650 MB

APPLE SSD SM0128G disk1: (121.33 GB) (Solid State - TRIM: Yes)

[Show SMART report]

EFI (disk1s1 - MS-DOS FAT32) <not mounted> [EFI]: 210 MB

(disk1s2) <not mounted> [CoreStorage Container]: 120.99 GB

(disk1s3) <not mounted> [Boot]: 134 MB

USB Information: ⓘ

USB30Bus

Samsung M3 Portable Samsung M3 Portable

M3 Portable disk4: (2 TB)

EFI (disk4s1 - MS-DOS FAT32) <not mounted> [EFI]: 210 MB

iMac clone (disk4s2 - Journaled HFS+) /Volumes/iMac clone : 2.00 TB (83.77 GB free)

Recovery HD (disk4s3 - Journaled HFS+) <not mounted> [Recovery]: 650 MB

VIA Labs, Inc. USB3.0 Hub

HGST G-Drive Mobile

541010A9E680 disk3: (1 TB)

EFI (disk3s1 - MS-DOS FAT32) <not mounted> [EFI]: 210 MB

Photo & Movie Archive (disk3s2 - Journaled HFS+) /Volumes/Photo & Movie Archive : 999.86 GB (175.98 GB free)

Broadcom Corp. Bluetooth USB Host Controller

Apple Inc. FaceTime HD Camera (Built-in)

VIA Labs, Inc. USB2.0 Hub

Seagate GoFlex Pro Mac

GoFlex Pro Mac disk5: (1 TB)

EFI (disk5s1 - MS-DOS FAT32) <not mounted> [EFI]: 210 MB

Job Archive (disk5s2 - Journaled HFS+) /Volumes/Job Archive : 999.86 GB (754.50 GB free)

Apple, Inc. Keyboard Hub

Apple Inc. Apple Keyboard

Thunderbolt Information: ⓘ

Apple Inc. thunderbolt_bus

Virtual disks: ⓘ

Macintosh HD (disk2 - Journaled HFS+) / [Startup]: 2.11 TB (924.04 GB free)

Physical disk: disk1s2 120.99 GB Online

Physical disk: disk0s2 2.00 TB Online

System Software: ⓘ

macOS High Sierra 10.13.3 (17D47) - Time since boot: about 14 hours

Gatekeeper: ⓘ

Mac App Store and identified developers

Clean up: ⓘ

/Library/LaunchAgents/com.epson.esua.launcher.plist

/Applications/Epson Software/EPSON Software Updater.app/Contents/EPSON Software Updater Agent.app/Contents/MacOS/EPSON Software Updater Agent

Executable not found!

One orphan file found. [Clean up]

Kernel Extensions: ⓘ

/Library/Extensions

[loaded] com.Cycling74.driver.Soundflower (2.0b2 - SDK 10.10) [Lookup]

[loaded] com.sophos.kext.oas (9.7.0 - SDK 10.12) [Lookup]

[loaded] com.sophos.nke.swi (9.7.0 - SDK 10.12) [Lookup]

System Launch Agents: ⓘ

[not loaded] 9 Apple tasks

[loaded] 169 Apple tasks

[running] 112 Apple tasks

System Launch Daemons: ⓘ

[not loaded] 35 Apple tasks

[loaded] 181 Apple tasks

[running] 115 Apple tasks

Launch Agents: ⓘ

[failed] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a 23d420d.plist (Adobe Systems, Inc. - installed 2018-02-13) [Lookup]

[running] com.adobe.AdobeCreativeCloud.plist (Adobe Systems, Inc. - installed 2018-02-06) [Lookup]

[loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2018-01-31) [Lookup]

[running] com.epson.epw.agent.plist (? 7c4cf380 5b21e787 - installed 2017-01-30) [Lookup]

[failed] com.epson.esua.launcher.plist (? 70512568 0 - installed 2017-11-07) [Lookup] - /Applications/Epson Software/EPSON Software Updater.app/Contents/EPSON Software Updater Agent.app/Contents/MacOS/EPSON Software Updater Agent: Executable not found!

[loaded] com.google.keystone.agent.plist (Google, Inc. - installed 2017-09-28) [Lookup]

[loaded] com.microsoft.update.agent.plist (Microsoft Corporation - installed 2018-01-24) [Lookup]

[running] com.sophos.agent.plist (Sophos - installed 2018-01-25) [Lookup]

[running] com.sophos.home.ui.plist (Sophos - installed 2018-01-25) [Lookup]

Launch Daemons: ⓘ

[running] com.adobe.ARMDC.Communicator.plist (Adobe Systems, Inc. - installed 2018-02-13) [Lookup]

[running] com.adobe.ARMDC.SMJobBlessHelper.plist (Adobe Systems, Inc. - installed 2018-02-13) [Lookup]

[loaded] com.adobe.acc.installer.plist (Adobe Systems, Inc. - installed 2018-02-06) [Lookup]

[running] com.adobe.agsservice.plist (Adobe Systems, Inc. - installed 2018-01-31) [Lookup]

[loaded] com.adobe.fpsaud.plist (Adobe Systems, Inc. - installed 2018-02-01) [Lookup]

[running] com.backblaze.bzserv.plist (Backblaze - installed 2018-02-02) [Lookup]

[running] com.bombich.ccchelper.plist (Bombich Software, Inc. - installed 2018-01-08) [Lookup]

[running] com.crashplan.proserver.plist (? 7d305767 8ab793d2 - installed 2016-05-16) [Lookup]

[loaded] com.google.keystone.daemon.plist (Google, Inc. - installed 2017-10-13) [Lookup]

[loaded] com.linotype.FontExplorerX.securityhelper.plist (Linotype GmbH - installed 2016-02-22) [Lookup]

[loaded] com.macpaw.CleanMyMac3.Agent.plist (MacPaw Inc. - installed 2017-12-04) [Lookup]

[loaded] com.microsoft.autoupdate.helper.plist (Microsoft Corporation - installed 2018-01-24) [Lookup]

[loaded] com.microsoft.office.licensingV2.helper.plist (Microsoft Corporation - installed 2016-02-12) [Lookup]

[loaded] com.sharpcast.xfsmond.plist (? 685406c7 0 - installed 2018-01-30) [Lookup]

[running] com.sophos.common.servicemanager.plist (Sophos - installed 2018-01-25) [Lookup]

User Launch Agents: ⓘ

[loaded] com.adobe.AAM.Updater-1.0.plist (Adobe Systems, Inc. - installed 2017-10-20) [Lookup]

[loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2018-01-31) [Lookup]

[running] com.backblaze.bzbmenu.plist (Backblaze - installed 2018-02-14) [Lookup]

[loaded] com.dropbox.DropboxMacUpdate.agent.plist (Dropbox, Inc. - installed 2017-08-26) [Lookup]

[not loaded] com.linotype.FontFolderProtector.plist (Linotype GmbH - installed 2018-01-03) [Lookup]

[running] com.spotify.webhelper.plist (Spotify - installed 2018-02-09) [Lookup]

User Login Items: ⓘ

CCC User Agent Application (Bombich Software, Inc. - installed 2018-01-08)

(/Applications/Carbon Copy Cloner.app/Contents/Library/LoginItems/CCC User Agent.app)

Billings Pro Sync Helper SMLoginItem - Hidden (Marketcircle Inc - installed 2017-12-04)

(/Applications/Billings Pro.app/Contents/Library/LoginItems/Billings Pro Sync Helper.app)

Internet Plug-ins: ⓘ

AdobeAAMDetect: 3.0.0.0 (installed 2018-02-06) [Lookup]

FlashPlayer-10.6: 28.0.0.161 (installed 2018-02-06) [Lookup]

QuickTime Plugin: 7.7.3 (installed 2018-01-25)

AdobePDFViewerNPAPI: 17.012.20098 (installed 2018-02-14) [Lookup]

AdobePDFViewer: 18.011.20035 (installed 2018-02-14) [Lookup]

Flash Player: 28.0.0.161 (installed 2018-02-06) [Lookup]

o1dbrowserplugin: 5.41.3.0 (installed 2015-12-11) [Lookup]

PepperFlashPlayer: 28.0.0.161 (installed 2018-02-07) [Lookup]

googletalkbrowserplugin: 5.41.3.0 (installed 2015-12-11) [Lookup]

Safari Extensions: ⓘ

[enabled] Adblock Plus - Eyeo GmbH - https://adblockplus.org/ (installed 2017-09-20)

[enabled] LastPass - LastPass - https://lastpass.com/ (installed 2017-11-16)

3rd Party Preference Panes: ⓘ

Backblaze Backup (installed 2018-02-02) [Lookup]

Flash Player (installed 2018-02-01) [Lookup]

FUSE for macOS (installed 2016-09-26) [Lookup]

Paragon NTFS for Mac ® OS X (installed 2017-12-04) [Lookup]

Xmarks for Safari (installed 2015-03-04) [Lookup]

Time Machine: ⓘ

Skip System Files: NO

Mobile backups: OFF

Auto backup: NO - Auto backup turned off

Volumes being backed up:

Macintosh HD: Disk size: 2.11 TB Disk used: 1.19 TB

Job Archive: Disk size: 999.86 GB Disk used: 245.36 GB

Destinations:

TimeMachine [Local]

Total size: 2.00 TB

Total number of backups: 57

Oldest backup: 27/04/2016, 19:05

Last backup: 05/10/2016, 21:08

Size of backup disk: Too small

Backup size 2.00 TB < (Disk used 1.44 TB X 3)

Top Processes by CPU: ⓘ

24% SophosAutoUpdate

12% kernel_task

8% WindowServer

5% plugin-container

5% plugin-container

Top Processes by Memory: ⓘ

5.81 GB kernel_task

3.90 GB Adobe Lightroom Classic

1.40 GB firefox

1024 MB plugin-container

882 MB bztransmit

Top Processes by Network Use: ⓘ

Input Output Process name

7 MB 74 KB SophosWebIntelligence

1 MB 2 MB SophosMcsAgentD

1 MB 179 KB mDNSResponder

493 KB 214 KB Mail

223 KB 162 KB SugarSync

Top Processes by Energy Use: ⓘ

18.04 bztransmit

8.46 WindowServer

8.40 coreaudiod

7.42 plugin-container

Virtual Memory Information: ⓘ

4.10 GB Available RAM

49 MB Free RAM

19.90 GB Used RAM

4.06 GB Cached files

997 MB Swap Used

Software installs (last 30 days): ⓘ

Slack: 3.0.5 (installed 2018-01-18)

Microsoft Excel for Mac: (installed 2018-01-22)

Microsoft Word for Mac: (installed 2018-01-22)

Microsoft OneNote for Mac: (installed 2018-01-22)

Microsoft PowerPoint for Mac: (installed 2018-01-22)

Microsoft Outlook for Mac: (installed 2018-01-22)

Microsoft AutoUpdate: (installed 2018-01-24)

Microsoft Word for Mac: (installed 2018-01-27)

Microsoft PowerPoint for Mac: (installed 2018-01-27)

Moon Invoice Pro: 1.6.8 (installed 2018-01-29)

Adobe Flash Player: (installed 2018-02-06)

Adobe Pepper Flash Player: (installed 2018-02-07)

ARMDC Agent Installer: (installed 2018-02-13)

Adobe Acrobat DC (18.011.20035): (installed 2018-02-14)

Microsoft Word for Mac: (installed 2018-02-14)

Microsoft Excel for Mac: (installed 2018-02-14)

Microsoft PowerPoint for Mac: (installed 2018-02-14)

Install information may not be complete.

Diagnostics Events (last 3 days for minor events): ⓘ

2018-02-14 06:55:00 Last shutdown cause: 0 - Power loss

2018-02-13 21:07:09 Adobe Illustrator.app Crash [Open]

2018-02-12 07:42:02 Adobe InDesign CC 2018.app High CPU use [Open] [Details]

Thank you.

I've had Sophos running on my Macs the last couple of years. I don't believe that is the cause of the issue I have described. Sophos was using a high level of system resources when I ran EtreCheck because it was in the middle of an update. It's inaccurate to suggest that Macs are immune to virus infections, by the way. I know a number of people who have had infections.

I don't regularly use maintenance apps. I installed CleanMyMac - on the recommendation of a tech from a major software global corp - to remove remnants of a specific problematic app a while back. It did the job. I'll happily remove it. Again, I can't see any causal link to my issue, particularly because I have not used the app

What I don't see is how my issue is attributable to either of these two applications? The issue started after upgrading to High Sierra, I had never experienced it before that point. Would you be able to identify for me where, in the EtreCheck report, it shows that either Sophos or CleanMyMac are causing the issue? I'd rather know before removing anything. Thanks.

Thanks again.

As I said, I used CleanMyMac once, for a specific issue. I have not used it again. I did this a long time before the issue I'm experiencing occurred and it is demonstrably unconnected. I note that there was a MacPaw daemon running and this is useful to know - I have CleanMyMac configured to not run in the background, but clearly it was doing something.

Sophos doesn't waste me any money, it's free. I have run it trouble free for a couple of years - literally not a single issue until this post in this forum. This is the very first issue I've had on this iMac since I bought it two years ago. All that time Sophos has been running, 24/7. I don't use torrent services or visit dodgy websites. But this iMac is sometimes used by other people and it is quite possible for someone to inadvertent visit an insecure site which can result in a security breach. It only takes a click on a phishing scam email or similar. Several times Sophos has blocked malicious websites and I'm glad it did.

I have uninstalled it now and will see if it changes the errant behaviour. I'll move on Firefox, then Sophos if there is not success. I'll report back on this thread.

Thanks again for your time and expertise.

Thanks very much for your advice.

I had a quick look at the threads you posted and will have a proper read later today. I did see one post which said that the issue affects earlier versions of OS X, not High Sierra. But others contradicted this.

I have now removed CleanMyMac and will monitor for the issue. If that fails I'll move on to Firefox and then Sophos. I'll report back here.

Thanks again.

OK, thanks. Firefox will be my next candidate. Shame, as it's a brilliant browser.