Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

EtreCheck says /etc/hosts file is Corrupted

I found an old post about the same problem and followed the reply of Linc Davis.

This is the report generated by Terminal:

Start time: 11:15:40 04/20/18


Model Identifier: iMac15,1

System Version: macOS 10.13.4 (17E199)

Kernel Version: Darwin 17.5.0

System Integrity Protection: Enabled

Time since boot: 4:18


USB


USB3.0 Hub (VIA Labs, Inc.)

G-DRIVE mobile USB (HGST)

USB2.0 Hub (VIA Labs, Inc.)


Diagnostic reports


2018-04-19 Kernel panic

2018-04-20 AdobeGCClient crash

2018-04-20 EPSON Scanner crash

2018-04-20 mds_stores crash x3


Memory: kernel_task (UID 0) is using 1505 MB


Daemons


com.malwarebytes.HelperTool

com.adobe.acc.installer

Adobe_Genuine_Software_Integrity_Service

com.microsoft.office.licensingV2.helper

com.microsoft.autoupdate.helper


Agents


com.apple.SafariHistoryServiceAgent

com.epson.esua.launcher

com.apple.SafariBookmarksSyncAgent

com.epson.scannermonitor

com.microsoft.update.agent

com.epson.Epson_Low_Ink_Reminder.launcher

com.apple.webinspectord

com.apple.SafariNotificationAgent

com.microsoft.OneDriveLauncher

com.apple.SafariCloudHistoryPushAgent

com.epson.ecrp.launcher.plist

com.apple.iBooksX.CacheDelete

com.apple.SafariPlugInUpdateNotifier

com.epson.eventmanager.agent


launchd


/System/Library/LaunchAgents/com.apple.webinspectord.plist

- com.apple.webinspectord

/System/Library/LaunchAgents/com.apple.SafariNotificationAgent.plist

- com.apple.SafariNotificationAgent

/System/Library/LaunchAgents/com.apple.SafariBookmarksSyncAgent.plist

- com.apple.SafariBookmarksSyncAgent

/System/Library/LaunchAgents/com.apple.SafariPlugInUpdateNotifier.plist

- com.apple.SafariPlugInUpdateNotifier

/System/Library/LaunchAgents/com.apple.SafariLaunchAgent.plist

- com.apple.SafariLaunchAgent

/System/Library/LaunchAgents/com.apple.SafariHistoryServiceAgent.plist

- com.apple.SafariHistoryServiceAgent

/System/Library/LaunchAgents/com.apple.SafariCloudHistoryPushAgent.plist

- com.apple.SafariCloudHistoryPushAgent

/Library/LaunchAgents/com.epson.Epson_Low_Ink_Reminder.launcher.plist

- com.epson.Epson_Low_Ink_Reminder.launcher

/Library/LaunchAgents/com.epson.ecrp.launcher.plist

- com.epson.ecrp.launcher.plist

/Library/LaunchAgents/com.epson.scannermonitor.plist

- com.epson.scannermonitor

/Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist

- com.adobe.AAM.Startup-1.0

/Library/LaunchAgents/com.adobe.GC.Invoker-1.0.plist

- com.adobe.GC.Scheduler-1.0

/Library/LaunchAgents/com.epson.eventmanager.agent.plist

- com.epson.eventmanager.agent

/Library/LaunchAgents/com.epson.esua.launcher.plist

- com.epson.esua.launcher

/Library/LaunchAgents/com.microsoft.update.agent.plist

- com.microsoft.update.agent

/Library/LaunchDaemons/com.adobe.agsservice.plist

- Adobe_Genuine_Software_Integrity_Service

/Library/LaunchDaemons/com.malwarebytes.HelperTool.plist

- com.malwarebytes.HelperTool

/Library/LaunchDaemons/com.microsoft.office.licensingV2.helper.plist

- com.microsoft.office.licensingV2.helper

/Library/LaunchDaemons/com.adobe.acc.installer.plist

- com.adobe.acc.installer

/Library/LaunchDaemons/com.microsoft.autoupdate.helper.plist

- com.microsoft.autoupdate.helper

Library/LaunchAgents/com.adobe.GC.Invoker-1.0.plist

- com.adobe.GC.Scheduler-1.0


Bundles


/Library/Extensions/OlympusDSCSCSIDriver.kext

- com.olympus.CamBlockCommandsDeviceUP

/Library/Extensions/EPSONUSBPrintClass.kext

- com.epson.print.kext.USBPrintClass

/Library/Internet Plug-Ins/AdobeAAMDetect.plugin

- com.AdobeAAMDetectLib.AdobeAAMDetect

/Library/Internet Plug-Ins/AdobeExManDetect.plugin

- com.AdobeExManDetectLib.AdobeExManDetect

/Library/Internet Plug-Ins/QuickTime Plugin.plugin

- N/A

/Library/PreferencePanes/Growl.prefPane

- com.growl.prefpanel

/Library/ScriptingAdditions/Adobe Unit Types.osax

- N/A

Library/Keyboard/en-dynamic.lm

- com.apple.LanguageModeling.en

Library/Keyboard/it-dynamic.lm

- com.apple.LanguageModeling.it

Library/Services/ToastIt.service

- com.roxio.ToastItService


Contents of /etc/hosts


127.0.0.1 localhost

255.255.255.255 broadcasthost

::1 localhost

127.0.0.1 activate.adobe.com

127.0.0.1 practivate.adobe.com

127.0.0.1 ereg.adobe.com

127.0.0.1 wip3.adobe.com

127.0.0.1 activate.wip3.adobe.com

127.0.0.1 3dns-3.adobe.com

127.0.0.1 3dns-2.adobe.com

127.0.0.1 adobe-dns.adobe.com

127.0.0.1 adobe-dns-2.adobe.com

127.0.0.1 adobe-dns-3.adobe.com

127.0.0.1 ereg.wip3.adobe.com

127.0.0.1 activate-sea.adobe.com

127.0.0.1 wwis-dubc1-vip60.adobe.com

127.0.0.1 activate-sjc0.adobe.com

127.0.0.1 hl2rcv.adobe.com

127.0.0.1 lm.licenses.adobe.com

127.0.0.1 na2m-pr.licenses.adobe.com

127.0.0.1 ims-na1-prprod.adobelogin.com

127.0.0.1 na4r.services.adobe.com

127.0.0.1 na1r.services.adobe.com


Contents of /etc/pf.conf


scrub-anchor "com.apple/*"

nat-anchor "com.apple/*"

rdr-anchor "com.apple/*"

dummynet-anchor "com.apple/*"

anchor "com.apple/*"

load anchor "com.apple" from "/etc/pf.anchors/com.apple"


Contents of /etc/syslog.conf


install.* @127.0.0.1:32376


Contents of /etc/pam.d/authorization


auth optional pam_krb5.so use_first_pass use_kcminit

auth optional pam_ntlm.so use_first_pass

auth required pam_opendirectory.so use_first_pass nullok

account required pam_opendirectory.so


Contents of /etc/pam.d/authorization_aks


auth required pam_aks.so

account required pam_opendirectory.so


Contents of /etc/pam.d/authorization_ctk


auth required pam_smartcard.so use_first_pass pkinit

account required pam_opendirectory.so


Contents of /etc/pam.d/authorization_la


auth required pam_localauthentication.so

auth required pam_aks.so

account required pam_opendirectory.so


Contents of /etc/pam.d/authorization_lacont


auth required pam_localauthentication.so continuityunlock

auth required pam_aks.so

account required pam_opendirectory.so


Contents of /etc/pam.d/checkpw


auth required pam_opendirectory.so use_first_pass nullok

account required pam_opendirectory.so no_check_home no_check_shell


Contents of /etc/pam.d/chkpasswd


auth required pam_opendirectory.so

account required pam_opendirectory.so

password required pam_permit.so

session required pam_permit.so


Contents of /etc/pam.d/cups


auth required pam_opendirectory.so

account required pam_permit.so

password required pam_deny.so

session required pam_permit.so


Contents of /etc/pam.d/login


auth optional pam_krb5.so use_kcminit

auth optional pam_ntlm.so try_first_pass

auth optional pam_mount.so try_first_pass

auth required pam_opendirectory.so try_first_pass

account required pam_nologin.so

account required pam_opendirectory.so

password required pam_opendirectory.so

session required pam_launchd.so

session required pam_uwtmp.so

session optional pam_mount.so


Contents of /etc/pam.d/login.term


account required pam_nologin.so

account required pam_opendirectory.so

session required pam_uwtmp.so


Contents of /etc/pam.d/other


auth required pam_deny.so

account required pam_deny.so

password required pam_deny.so

session required pam_deny.so


Contents of /etc/pam.d/passwd


auth required pam_permit.so

account required pam_opendirectory.so

password required pam_opendirectory.so

session required pam_permit.so


Contents of /etc/pam.d/screensaver


auth optional pam_krb5.so use_first_pass use_kcminit

auth required pam_opendirectory.so use_first_pass nullok

account required pam_opendirectory.so

account sufficient pam_self.so

account required pam_group.so no_warn group=admin,wheel fail_safe

account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe


Contents of /etc/pam.d/screensaver_aks


auth required pam_aks.so

account required pam_opendirectory.so

account sufficient pam_self.so

account required pam_group.so no_warn group=admin,wheel fail_safe

account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe


Contents of /etc/pam.d/screensaver_ctk


auth required pam_smartcard.so use_first_pass

account required pam_opendirectory.so

account sufficient pam_self.so

account required pam_group.so no_warn group=admin,wheel fail_safe

account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe


Contents of /etc/pam.d/screensaver_la


auth required pam_localauthentication.so

auth required pam_aks.so

account required pam_opendirectory.so

account sufficient pam_self.so

account required pam_group.so no_warn group=admin,wheel fail_safe

account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe


Contents of /etc/pam.d/smbd


account required pam_sacl.so sacl_service=smb allow_trustacct

session required pam_permit.so


Contents of /etc/pam.d/sshd


auth optional pam_krb5.so use_kcminit

auth optional pam_ntlm.so try_first_pass

auth optional pam_mount.so try_first_pass

auth required pam_opendirectory.so try_first_pass

account required pam_nologin.so

account required pam_sacl.so sacl_service=ssh

account required pam_opendirectory.so

password required pam_opendirectory.so

session required pam_launchd.so

session optional pam_mount.so


Contents of /etc/pam.d/su


auth sufficient pam_rootok.so

auth required pam_opendirectory.so

account required pam_group.so no_warn group=admin,wheel ruser root_only fail_safe

account required pam_opendirectory.so no_check_shell

password required pam_opendirectory.so

session required pam_launchd.so


Contents of /etc/pam.d/sudo


auth sufficient pam_smartcard.so

auth required pam_opendirectory.so

account required pam_permit.so

password required pam_deny.so

session required pam_permit.so


Contents of /etc/periodic/daily/110.clean-tmps


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_clean_tmps_enable" in

[Yy][Ee][Ss])

if [ -z "$daily_clean_tmps_days" ]

then

echo '$daily_clean_tmps_enable is set but' \

'$daily_clean_tmps_days is not'

rc=2

else

echo ""

echo "Removing old temporary files:"

set -f noglob

args="-atime +$daily_clean_tmps_days -mtime +$daily_clean_tmps_days"

args="${args} -ctime +$daily_clean_tmps_days"

dargs="-empty -mtime +$daily_clean_tmps_days"

dargs="${dargs} ! -name .vfs_rsrc_streams_*"

[ -n "$daily_clean_tmps_ignore" ] && {

args="$args "`echo " ${daily_clean_tmps_ignore% }" |

sed 's/[ ][ ]*/ ! -name /g'`

dargs="$dargs "`echo " ${daily_clean_tmps_ignore% }" |

sed 's/[ ][ ]*/ ! -name /g'`


...and 21 more line(s)


Contents of /etc/periodic/daily/130.clean-msgs


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_clean_msgs_enable" in

[Yy][Ee][Ss])

if [ ! -d /var/msgs ]

then

echo '$daily_clean_msgs_enable is set but /var/msgs' \

"doesn't exist"

rc=2

else

echo ""

echo "Cleaning out old system announcements:"

[ -n "$daily_clean_msgs_days" ] &&

arg=-${daily_clean_msgs_days#-} || arg=

msgs -c $arg && rc=0 || rc=3

fi;;

*) rc=0;;

esac

exit $rc


Contents of /etc/periodic/daily/140.clean-rwho


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_clean_rwho_enable" in

[Yy][Ee][Ss])

if [ -z "$daily_clean_rwho_days" ]

then

echo '$daily_clean_rwho_enable is enabled but' \

'$daily_clean_rwho_days is not set'

rc=2

elif [ ! -d /var/rwho ]

then

echo '$daily_clean_rwho_enable is enabled but /var/rwho' \

"doesn't exist"

rc=2

else

echo ""

echo "Removing stale files from /var/rwho:"

case "$daily_clean_rwho_verbose" in

[Yy][Ee][Ss])

print=-print;;

*)

print=;;


...and 14 more line(s)


Contents of /etc/periodic/daily/199.clean-fax


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

if [ -d /var/spool/fax ]; then

echo ""

echo "Removing scratch fax files"

cd /var/spool/fax && \

find . -type f -name '[0-9]*.[0-9][0-9][0-9]' -mtime +7 -delete >/dev/null 2>&1;

fi


Contents of /etc/periodic/daily/310.accounting


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_accounting_enable" in

[Yy][Ee][Ss])

if [ ! -f /var/account/acct ]

then

echo '$daily_accounting_enable is set but /var/account/acct' \

"doesn't exist"

rc=2

elif [ -z "$daily_accounting_save" ]

then

echo '$daily_accounting_enable is set but ' \

'$daily_accounting_save is not'

rc=2

else

echo ""

echo "Rotating accounting logs and gathering statistics:"

cd /var/account

rc=0

n=$daily_accounting_save

rm -f acct.$n.gz acct.$n || rc=3

m=$n


...and 18 more line(s)


Contents of /etc/periodic/daily/400.status-disks


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_status_disks_enable" in

[Yy][Ee][Ss])

echo ""

echo "Disk status:"

df $daily_status_disks_df_flags && rc=1 || rc=3

;;

*) rc=0;;

esac

exit $rc


Contents of /etc/periodic/daily/420.status-network


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_status_network_enable" in

[Yy][Ee][Ss])

echo ""

echo "Network interface status:"

case "$daily_status_network_usedns" in

[Yy][Ee][Ss])

netstat -i && rc=0 || rc=3;;

*)

netstat -in && rc=0 || rc=3;;

esac;;

*) rc=0;;

esac

exit $rc


Contents of /etc/periodic/daily/430.status-rwho


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_status_rwho_enable" in

[Yy][Ee][Ss])

rwho=$(echo /var/rwho/*)

if [ -f "${rwho%% *}" ]

then

echo ""

echo "Local network system status:"

prog=ruptime

else

echo ""

echo "Local system status:"

prog=uptime

fi

rc=$($prog | tee /dev/stderr | wc -l)

if [ $? -eq 0 ]

then

[ $rc -gt 1 ] && rc=1

else

rc=3

fi;;


...and 3 more line(s)


Contents of /etc/periodic/daily/999.local


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

rc=0

for script in $daily_local

do

echo ''

case "$script" in

/*)

if [ -f "$script" ]

then

echo "Running $script:"

sh $script || rc=3

else

echo "$script: No such file"

[ $rc -lt 2 ] && rc=2

fi;;

*)

echo "$script: Not an absolute path"

[ $rc -lt 2 ] && rc=2;;

esac

done

exit $rc


Contents of /etc/periodic/monthly/199.rotate-fax


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

echo ""

printf %s "Rotating fax log files:"

cd /var/log/fax

for i in *.log; do

if [ -f "${i}" ]; then

echo -n " $i"

if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi

if [ -f "${i}.3${gzext}" ]; then mv -f "${i}.3${gzext}" "${i}.4${gzext}"; fi

if [ -f "${i}.2${gzext}" ]; then mv -f "${i}.2${gzext}" "${i}.3${gzext}"; fi

if [ -f "${i}.1${gzext}" ]; then mv -f "${i}.1${gzext}" "${i}.2${gzext}"; fi

if [ -f "${i}.0${gzext}" ]; then mv -f "${i}.0${gzext}" "${i}.1${gzext}"; fi

if [ -f "${i}" ]; then mv -f "${i}" "${i}.0" && if [ -x /usr/bin/gzip ]; then gzip -9 "${i}.0"; fi; fi

touch "${i}" && chmod 640 "${i}" && chown root:admin "${i}"

fi

done

echo ""


Contents of /etc/periodic/monthly/200.accounting


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

oldmask=$(umask)

umask 066

case "$monthly_accounting_enable" in

[Yy][Ee][Ss])

W=/var/log/wtmp

rc=0

remove=NO

if [ $rc -eq 0 ]

then

echo ""

echo "Doing login accounting:"

rc=$(ac -p | sort -nr -k 2 | tee /dev/stderr | wc -l)

[ $rc -gt 0 ] && rc=1

fi

[ $remove = YES ] && rm -f $W.0;;

*) rc=0;;

esac

umask $oldmask

exit $rc


Contents of /etc/periodic/monthly/999.local


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

rc=0

for script in $monthly_local

do

echo ''

case "$script" in

/*)

if [ -f "$script" ]

then

echo "Running $script:"

sh $script || rc=3

else

echo "$script: No such file"

[ $rc -lt 2 ] && rc=2

fi;;

*)

echo "$script: Not an absolute path"

[ $rc -lt 2 ] && rc=2;;

esac

done

exit $rc


Contents of /etc/periodic/weekly/320.whatis


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$weekly_whatis_enable" in

[Yy][Ee][Ss])

echo ""

echo "Rebuilding whatis database:"

MANPATH=`/usr/bin/manpath -q`

if [ $? = 0 ]

then

if [ -z "${MANPATH}" ]

then

echo "manpath failed to find any manpage directories"

rc=3

else

rc=0

/usr/libexec/makewhatis.local "${MANPATH}" || rc=3

if [ X"${man_locales}" != X ]

then

for i in ${man_locales}

do

LC_ALL=$i /usr/libexec/makewhatis.local -a \

-L "${MANPATH}" || rc=3


...and 9 more line(s)


Contents of /etc/periodic/weekly/999.local


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

rc=0

for script in $weekly_local

do

echo ''

case "$script" in

/*)

if [ -f "$script" ]

then

echo "Running $script:"

sh $script || rc=3

else

echo "$script: No such file"

[ $rc -lt 2 ] && rc=2

fi;;

*)

echo "$script: Not an absolute path"

[ $rc -lt 2 ] && rc=2;;

esac

done

exit $rc


Contents of /Library/Preferences/com.apple.security.appsandbox.plist (XML 1.0 document text, ASCII text)


<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>UnrestrictSpotlightContainerScope</key>

<true/>

</dict>

</plist>


Contents of /Library/Preferences/SystemConfiguration/com.apple.Boot.plist (XML 1.0 document text, ASCII text)


<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Kernel Flags</key>

<string></string>

</dict>

</plist>


Bad plists


/Library/Preferences/com.epson.Easy Photo Scan.UnInstallList.plist

/Library/Preferences/com.epson.Easy Photo Print.UnInstallList.plist

/Library/Preferences/com.epson.EPSON Scan.UnInstallList.plist

/Library/Preferences/com.epson.Inkjet Printer Driver.UnInstallList.plist

/Library/Preferences/com.epson.Print CD.UnInstallList.plist

/Library/Preferences/com.epson.Epson Event Manager.UnInstallList.plist

/Library/Preferences/com.epson.Epson Customer Research Participation.UnInstallList.plist

/Library/Preferences/com.epson.Epson Low Ink Reminder.UnInstallList.plist

/Library/Preferences/com.epson.EPSON Software Updater.UnInstallList.plist

/Library/Preferences/com.epson.Epson Connect Printer Setup.UnInstallList.plist

/Library/Preferences/com.epson.Epson Scanner Monitor.UnInstallList.plist

/Library/Preferences/com.epson.PC-FAX Driver.UnInstallList.plist

/Library/Preferences/com.epson.Epson Scanner ICA Driver.UnInstallList.plist


Listeners


launchd: microsoft-ds

launchd: microsoft-ds

kdc: kerberos

cupsd: ipp


User login items


Tri-BACKUP 8 Launcher

- /Applications/Tri-BACKUP 8.app/Contents/Resources/Tri-BACKUP 8 Launcher.app

OneDrive

- /Applications/OneDrive.app

iTunesHelper

- /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app


Restricted files: 1825


Elapsed time (s): 140

iMac with Retina 5K display, macOS High Sierra (10.13.4), 4 gHz i7 - 16GB

Posted on Apr 20, 2018 2:31 AM

Reply
Question marked as Best reply

Posted on Apr 20, 2018 5:05 AM

Hello WALTER-MILANO-ITALY,

I'm sorry, but there is a bug in EtreCheck regarding the hosts file. It incorrectly reports the file as corrupt if there are over 10 entries. This will be fixed in the next version. It would have been better to have asked privately or post your EtreCheck report. You have no idea what some random script on the internet is going to do. In this case it has exposed your piracy of Adobe apps. EtreCheck tries hard to hide that kind of personal information. But with added complexity sometimes comes bugs like the erroneous corrupt flag.


It looks like you had a kernel panic the last time you restarted. Do you have any panic reports in Console.app? EtreCheck tries to extract pertinent information from panic reports, but in rare cases, the reports are missing or incomplete.


Maybe run EtreCheck again the next time the machine misbehaves. Ideally, run EtreCheck during the anomaly or shortly afterwards.

Similar questions

5 replies
Question marked as Best reply

Apr 20, 2018 5:05 AM in response to WALTER-MILANO-ITALY

Hello WALTER-MILANO-ITALY,

I'm sorry, but there is a bug in EtreCheck regarding the hosts file. It incorrectly reports the file as corrupt if there are over 10 entries. This will be fixed in the next version. It would have been better to have asked privately or post your EtreCheck report. You have no idea what some random script on the internet is going to do. In this case it has exposed your piracy of Adobe apps. EtreCheck tries hard to hide that kind of personal information. But with added complexity sometimes comes bugs like the erroneous corrupt flag.


It looks like you had a kernel panic the last time you restarted. Do you have any panic reports in Console.app? EtreCheck tries to extract pertinent information from panic reports, but in rare cases, the reports are missing or incomplete.


Maybe run EtreCheck again the next time the machine misbehaves. Ideally, run EtreCheck during the anomaly or shortly afterwards.

Apr 20, 2018 2:42 AM in response to WALTER-MILANO-ITALY

If there is a specific problem in how your mac is working, please tell us. Otherwise, don’t worry. If you start looking at all the stuff you posted, you will find a lot of stuff that you don’t know about and it is meant to be there to make your system work as designed. There is no good reason to start digging through all that just because. Enjoy your mac.

Apr 20, 2018 2:51 AM in response to Luis Sequeira1

THANKS LUIS.

Sorry, I did not send all the informations.

Unfortunately there is a problem, and that is why I used Etrecheck.

My iMac had problems since several months: freezes, restart, sometimes with fan at full speed. One or two controls at Genius Bar did not find any problem. There are some posts here also.

A couple of month ago I formatted my HD and reinstalled al from scratch: I never did it in the past: I used to "copy" all of my HD from the old Mac to the new-one simply wit MigrationAssistant and this at any new Mac from 2003 until now.

After formatting and new installation there was a great improvement but now I still have some Rebots.

I will try to post the full Etrecheck Report


EtreCheck version: 4.2.1 (4C020)

Report generated: 2018-04-19 22:29:58

Download EtreCheck from https://etrecheck.com

Runtime: 2:39

Performance: Excellent


Problem: Computer is restarting


Major Issues:

Anything that appears on this list needs immediate attention.


Kernel panics- This system has experienced kernel panics. This could be a sign of hardware failure.

Heavy CPU usage- Some processes are using an unusually high amount of CPU.


Minor Issues:

These issues do not need immediate attention but they may indicate future problems.


Corrupt hosts file- Hosts file is corrupt.

32-bit Apps- This machine has 32-bits apps that may have problems in the future.


Hardware Information:

iMac (Retina 5K, 27-inch, Late 2014)

iMac Model: iMac15,1

1 4 GHz Intel Core i7 (i7-4790K) CPU: 4-core

16 GB RAMUpgradeable

BANK 0/DIMM0 - 8 GB DDR3 1600 ok

BANK 1/DIMM0 - 8 GB DDR3 1600 ok

BANK 0/DIMM1 - Empty

BANK 1/DIMM1 - Empty


Video Information:

AMD Radeon R9 M295X - VRAM: 4096 MB

iMac


Drives:

disk0 - APPLE SSD SM1024F 1.00 TB (Solid State - TRIM: Yes)

Internal PCI 5.0 GT/s x2 Serial ATA

disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk0s2 () 1.00 TB

disk1s1 - i*****D (APFS) 1.00 TB (469.49 GB used)

disk1s2 - Preboot (APFS) [APFS Preboot] 1.00 TB (49 MB used)

disk1s3 - Recovery (APFS) [Recovery] 1.00 TB (1.02 GB used)

disk1s4 - VM (APFS) [APFS VM] 1.00 TB (2.15 GB used)


disk2 - HGST G-DRIVE mobile USB 2.00 TB

External USB 5 Gbit/s

disk2s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk2s2 - T*****8 (Journaled HFS+) 2.00 TB


Mounted Volumes:

disk1s1 - i*****D 1.00 TB (527.43 GB free)

APFS

Mount point: /


disk1s4 - VM [APFS VM] 1.00 TB (527.43 GB free)

APFS

Mount point: /private/var/vm


disk2s2 - T*****8 2.00 TB (1.78 TB free)

Journaled HFS+

Mount point: /Volumes/T*****8


Network:

Interface en0: Ethernet

Interface en6: iPad

Interface en5: iPhone

Interface fw0: Thunderbolt FireWire

Interface en1: Wi-Fi

802.11 a/b/g/n/ac

One IPv4 address

Interface en4: Bluetooth PAN

Interface bridge0: Thunderbolt Bridge

iCloud Quota: 4.34 GB available


System Software:

macOS High Sierra 10.13.4 (17E199)

Time since boot: Less than an hour

System Load: 3.45 (1 min ago) 4.55 (5 min ago) 2.33 (15 min ago)


Configuration Files:

/etc/hosts - Count: 20 - Corrupt!


Security:

SystemStatus
GatekeeperMac App Store and identified developers
System Integrity ProtectionEnabled


32-bit Applications:

73 32-bit apps


Kernel Extensions:

/Applications/COMUNICAZIONE/Transmit.app

[Not Loaded] transmitdiskfs.kext (4.0.0 - SDK 10.6)


/Applications/Parallels Desktop.app

[Not Loaded] prl_hypervisor.kext (Parallels, Inc., 10.4.0 29337 - SDK 10.7)

[Not Loaded] prl_netbridge.kext (Parallels, Inc., 10.4.0 29337 - SDK 10.7)

[Not Loaded] prl_usb_connect.kext (Parallels, Inc., 10.4.0 29337 - SDK 10.7)

[Not Loaded] prl_vnic.kext (Parallels, Inc., 10.4.0 29337 - SDK 10.7)


/Applications/Toast 10 Titanium/Toast Titanium.app

[Not Loaded] RoxioBluRaySupport.kext (1.1.6)


/Applications/VIDEO/iSkysoft iMedia Converter Deluxe.app

[Not Loaded] SystemAudioRecorder.kext (1.1.0 - SDK 10.6)


/Library/Extensions

[Not Loaded] OlympusDSCSCSIDriver.kext (Olympus Corporation, 3.2.0 - SDK 10.11)


/Users/***/Library/Services/ToastIt.service/Contents/MacOS

[Not Loaded] TDIXController.kext (2.0)


System Launch Agents:

[Not Loaded]8 Apple tasks
[Loaded]164 Apple tasks
[Running]120 Apple tasks
[Other]One Apple task


System Launch Daemons:

[Not Loaded]36 Apple tasks
[Loaded]181 Apple tasks
[Running]117 Apple tasks


Launch Agents:

[Loaded]com.microsoft.update.agent.plist (Microsoft Corporation - installed 2018-04-13)
[Not Loaded]com.adobe.AAM.Updater-1.0.plist (? ffb65062 - installed 2018-01-20)
[Running]com.epson.scannermonitor.plist (Seiko Epson Corporation - installed 2017-06-06)
[Loaded]com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2018-01-30)
[Loaded]com.epson.esua.launcher.plist (Seiko Epson Corporation - installed 2017-11-07)
[Running]com.epson.eventmanager.agent.plist (Seiko Epson Corporation - installed 2017-09-27)
[Running]com.epson.Epson_Low_Ink_Reminder.launcher.plist (Seiko Epson Corporation - installed 2018-02-07)
[Running]com.epson.ecrp.launcher.plist (Seiko Epson Corporation - installed 2017-07-24)


Launch Daemons:

[Loaded]com.microsoft.autoupdate.helper.plist (Microsoft Corporation - installed 2018-04-13)
[Loaded]com.malwarebytes.HelperTool.plist (Malwarebytes Corporation - installed 2018-03-01)
[Loaded]com.adobe.acc.installer.plist (Adobe Systems, Inc. - installed 2018-02-22)
[Running]com.adobe.agsservice.plist (Adobe Systems, Inc. - installed 2018-01-30)
[Loaded]com.microsoft.office.licensingV2.helper.plist (Microsoft Corporation - installed 2017-12-05)


User Launch Agents:

[Loaded]com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2018-01-30)


User Login Items:

Tri-BACKUP 8 Launcher Applicazione (?

(/Applications/Tri-BACKUP 8.app/Contents/Resources/Tri-BACKUP 8 Launcher.app)

OneDrive Applicazione (Mac App Store

(/Applications/OneDrive.app)

iTunesHelper Applicazione (Apple - installed 2018-03-30)

(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

OneDrive Launcher SMLoginItem (Mac App Store - installed 2018-04-18)

(/Applications/OneDrive.app/Contents/Library/LoginItems/OneDrive Launcher.app)

com.adobe.SwitchBoard.monitor.plist MachInit (?

(/etc/mach_init_per_user.d/com.adobe.SwitchBoard.monitor.plist)


Internet Plug-ins:

AdobeExManDetect: AdobeExManDetect 1.1.0.0 (installed 2018-01-20)

AdobeAAMDetect: 3.0.0.0 (installed 2018-02-22)

QuickTime Plugin: 7.7.3 (installed 2018-01-27)


Safari Extensions:

OpenIE.safariextz - Parallels - http://www.parallels.com(installed 2018-01-19)


3rd Party Preference Panes:

Growl (installed 2018-01-16)


Time Machine:

Skip System Files: No

Mobile backups:

Auto backup: Yes

Volumes being backed up:

i*****D: Disk size: 1.00 TB - Disk used: 472.91 GB

Destinations:

T*****8 [Local] (Last used)

Total size: 2.00 TB

Total number of backups: 27

Oldest backup: 2018-01-15 19:36:51

Last backup: 2018-04-19 22:21:24


Top Processes by CPU:

Process (count)Source% of CPU
mdworker (42)Apple100
mds_storesApple16
mdsApple14
kernel_taskApple13
spindumpApple8


Top Processes by Memory:

Process (count)SourceRAM usage
kernel_taskApple1.57 GB
mdworker (43)Apple1.08 GB
mds_storesApple739 MB
Microsoft ExcelMicrosoft Corporation328 MB
DockApple140 MB


Top Processes by Network Use:

ProcessSourceInputOutput
mDNSResponderApple90 KB69 KB
MailApple27 KB6 KB
apsdApple10 KB15 KB
OneDriveMac App Store8 KB2 KB
netbiosdApple5 KB3 KB


Top Processes by Energy Use:

Process (count)SourceEnergy usage (0-100)
mdworker (43)Apple18
mds_storesApple9
mdsApple3
WindowServerApple2
OneDriveMac App Store1


Virtual Memory Information:

Available RAM10.64 GB
Free RAM4.89 GB
Used RAM5.36 GB
Cached files5.75 GB
Swap Used0 B


Diagnostics Information (past 7 days):

2018-04-19 22:23:48 Kernel Panic (2 times)

2018-04-19 22:23:42 Last Shutdown Cause: -63 - Unknown (once)

2018-04-19 22:12:45 EPSON Scanner.app Crash (once)

*** Terminating app due to uncaught exception 'NetworkTimeout', reason: ''

abort() called

terminating with uncaught exception of type NSException

2018-04-14 14:05:19 Aperture.app CPU (once)


End of report


Thanks for your Help.

Apr 20, 2018 4:48 AM in response to WALTER-MILANO-ITALY

The kernel panics could be, as the report suggests, caused by hardware; but it may also be software.


I noticed that the transmit and parallels kernel extensions are very old. I suppose that your version of Parallels does not work on High Sierra at all. You should uninstall it, as per the developers' instructions, or update to a current version. Same with Transmit.

EtreCheck says /etc/hosts file is Corrupted

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.