Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

EtreCheck says /etc/hosts file is Corrupted

I found an old post about the same problem and followed the reply of Linc Davis.

This is the report generated by Terminal:

Start time: 11:15:40 04/20/18


Model Identifier: iMac15,1

System Version: macOS 10.13.4 (17E199)

Kernel Version: Darwin 17.5.0

System Integrity Protection: Enabled

Time since boot: 4:18


USB


USB3.0 Hub (VIA Labs, Inc.)

G-DRIVE mobile USB (HGST)

USB2.0 Hub (VIA Labs, Inc.)


Diagnostic reports


2018-04-19 Kernel panic

2018-04-20 AdobeGCClient crash

2018-04-20 EPSON Scanner crash

2018-04-20 mds_stores crash x3


Memory: kernel_task (UID 0) is using 1505 MB


Daemons


com.malwarebytes.HelperTool

com.adobe.acc.installer

Adobe_Genuine_Software_Integrity_Service

com.microsoft.office.licensingV2.helper

com.microsoft.autoupdate.helper


Agents


com.apple.SafariHistoryServiceAgent

com.epson.esua.launcher

com.apple.SafariBookmarksSyncAgent

com.epson.scannermonitor

com.microsoft.update.agent

com.epson.Epson_Low_Ink_Reminder.launcher

com.apple.webinspectord

com.apple.SafariNotificationAgent

com.microsoft.OneDriveLauncher

com.apple.SafariCloudHistoryPushAgent

com.epson.ecrp.launcher.plist

com.apple.iBooksX.CacheDelete

com.apple.SafariPlugInUpdateNotifier

com.epson.eventmanager.agent


launchd


/System/Library/LaunchAgents/com.apple.webinspectord.plist

- com.apple.webinspectord

/System/Library/LaunchAgents/com.apple.SafariNotificationAgent.plist

- com.apple.SafariNotificationAgent

/System/Library/LaunchAgents/com.apple.SafariBookmarksSyncAgent.plist

- com.apple.SafariBookmarksSyncAgent

/System/Library/LaunchAgents/com.apple.SafariPlugInUpdateNotifier.plist

- com.apple.SafariPlugInUpdateNotifier

/System/Library/LaunchAgents/com.apple.SafariLaunchAgent.plist

- com.apple.SafariLaunchAgent

/System/Library/LaunchAgents/com.apple.SafariHistoryServiceAgent.plist

- com.apple.SafariHistoryServiceAgent

/System/Library/LaunchAgents/com.apple.SafariCloudHistoryPushAgent.plist

- com.apple.SafariCloudHistoryPushAgent

/Library/LaunchAgents/com.epson.Epson_Low_Ink_Reminder.launcher.plist

- com.epson.Epson_Low_Ink_Reminder.launcher

/Library/LaunchAgents/com.epson.ecrp.launcher.plist

- com.epson.ecrp.launcher.plist

/Library/LaunchAgents/com.epson.scannermonitor.plist

- com.epson.scannermonitor

/Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist

- com.adobe.AAM.Startup-1.0

/Library/LaunchAgents/com.adobe.GC.Invoker-1.0.plist

- com.adobe.GC.Scheduler-1.0

/Library/LaunchAgents/com.epson.eventmanager.agent.plist

- com.epson.eventmanager.agent

/Library/LaunchAgents/com.epson.esua.launcher.plist

- com.epson.esua.launcher

/Library/LaunchAgents/com.microsoft.update.agent.plist

- com.microsoft.update.agent

/Library/LaunchDaemons/com.adobe.agsservice.plist

- Adobe_Genuine_Software_Integrity_Service

/Library/LaunchDaemons/com.malwarebytes.HelperTool.plist

- com.malwarebytes.HelperTool

/Library/LaunchDaemons/com.microsoft.office.licensingV2.helper.plist

- com.microsoft.office.licensingV2.helper

/Library/LaunchDaemons/com.adobe.acc.installer.plist

- com.adobe.acc.installer

/Library/LaunchDaemons/com.microsoft.autoupdate.helper.plist

- com.microsoft.autoupdate.helper

Library/LaunchAgents/com.adobe.GC.Invoker-1.0.plist

- com.adobe.GC.Scheduler-1.0


Bundles


/Library/Extensions/OlympusDSCSCSIDriver.kext

- com.olympus.CamBlockCommandsDeviceUP

/Library/Extensions/EPSONUSBPrintClass.kext

- com.epson.print.kext.USBPrintClass

/Library/Internet Plug-Ins/AdobeAAMDetect.plugin

- com.AdobeAAMDetectLib.AdobeAAMDetect

/Library/Internet Plug-Ins/AdobeExManDetect.plugin

- com.AdobeExManDetectLib.AdobeExManDetect

/Library/Internet Plug-Ins/QuickTime Plugin.plugin

- N/A

/Library/PreferencePanes/Growl.prefPane

- com.growl.prefpanel

/Library/ScriptingAdditions/Adobe Unit Types.osax

- N/A

Library/Keyboard/en-dynamic.lm

- com.apple.LanguageModeling.en

Library/Keyboard/it-dynamic.lm

- com.apple.LanguageModeling.it

Library/Services/ToastIt.service

- com.roxio.ToastItService


Contents of /etc/hosts


127.0.0.1 localhost

255.255.255.255 broadcasthost

::1 localhost

127.0.0.1 activate.adobe.com

127.0.0.1 practivate.adobe.com

127.0.0.1 ereg.adobe.com

127.0.0.1 wip3.adobe.com

127.0.0.1 activate.wip3.adobe.com

127.0.0.1 3dns-3.adobe.com

127.0.0.1 3dns-2.adobe.com

127.0.0.1 adobe-dns.adobe.com

127.0.0.1 adobe-dns-2.adobe.com

127.0.0.1 adobe-dns-3.adobe.com

127.0.0.1 ereg.wip3.adobe.com

127.0.0.1 activate-sea.adobe.com

127.0.0.1 wwis-dubc1-vip60.adobe.com

127.0.0.1 activate-sjc0.adobe.com

127.0.0.1 hl2rcv.adobe.com

127.0.0.1 lm.licenses.adobe.com

127.0.0.1 na2m-pr.licenses.adobe.com

127.0.0.1 ims-na1-prprod.adobelogin.com

127.0.0.1 na4r.services.adobe.com

127.0.0.1 na1r.services.adobe.com


Contents of /etc/pf.conf


scrub-anchor "com.apple/*"

nat-anchor "com.apple/*"

rdr-anchor "com.apple/*"

dummynet-anchor "com.apple/*"

anchor "com.apple/*"

load anchor "com.apple" from "/etc/pf.anchors/com.apple"


Contents of /etc/syslog.conf


install.* @127.0.0.1:32376


Contents of /etc/pam.d/authorization


auth optional pam_krb5.so use_first_pass use_kcminit

auth optional pam_ntlm.so use_first_pass

auth required pam_opendirectory.so use_first_pass nullok

account required pam_opendirectory.so


Contents of /etc/pam.d/authorization_aks


auth required pam_aks.so

account required pam_opendirectory.so


Contents of /etc/pam.d/authorization_ctk


auth required pam_smartcard.so use_first_pass pkinit

account required pam_opendirectory.so


Contents of /etc/pam.d/authorization_la


auth required pam_localauthentication.so

auth required pam_aks.so

account required pam_opendirectory.so


Contents of /etc/pam.d/authorization_lacont


auth required pam_localauthentication.so continuityunlock

auth required pam_aks.so

account required pam_opendirectory.so


Contents of /etc/pam.d/checkpw


auth required pam_opendirectory.so use_first_pass nullok

account required pam_opendirectory.so no_check_home no_check_shell


Contents of /etc/pam.d/chkpasswd


auth required pam_opendirectory.so

account required pam_opendirectory.so

password required pam_permit.so

session required pam_permit.so


Contents of /etc/pam.d/cups


auth required pam_opendirectory.so

account required pam_permit.so

password required pam_deny.so

session required pam_permit.so


Contents of /etc/pam.d/login


auth optional pam_krb5.so use_kcminit

auth optional pam_ntlm.so try_first_pass

auth optional pam_mount.so try_first_pass

auth required pam_opendirectory.so try_first_pass

account required pam_nologin.so

account required pam_opendirectory.so

password required pam_opendirectory.so

session required pam_launchd.so

session required pam_uwtmp.so

session optional pam_mount.so


Contents of /etc/pam.d/login.term


account required pam_nologin.so

account required pam_opendirectory.so

session required pam_uwtmp.so


Contents of /etc/pam.d/other


auth required pam_deny.so

account required pam_deny.so

password required pam_deny.so

session required pam_deny.so


Contents of /etc/pam.d/passwd


auth required pam_permit.so

account required pam_opendirectory.so

password required pam_opendirectory.so

session required pam_permit.so


Contents of /etc/pam.d/screensaver


auth optional pam_krb5.so use_first_pass use_kcminit

auth required pam_opendirectory.so use_first_pass nullok

account required pam_opendirectory.so

account sufficient pam_self.so

account required pam_group.so no_warn group=admin,wheel fail_safe

account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe


Contents of /etc/pam.d/screensaver_aks


auth required pam_aks.so

account required pam_opendirectory.so

account sufficient pam_self.so

account required pam_group.so no_warn group=admin,wheel fail_safe

account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe


Contents of /etc/pam.d/screensaver_ctk


auth required pam_smartcard.so use_first_pass

account required pam_opendirectory.so

account sufficient pam_self.so

account required pam_group.so no_warn group=admin,wheel fail_safe

account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe


Contents of /etc/pam.d/screensaver_la


auth required pam_localauthentication.so

auth required pam_aks.so

account required pam_opendirectory.so

account sufficient pam_self.so

account required pam_group.so no_warn group=admin,wheel fail_safe

account required pam_group.so no_warn deny group=admin,wheel ruser fail_safe


Contents of /etc/pam.d/smbd


account required pam_sacl.so sacl_service=smb allow_trustacct

session required pam_permit.so


Contents of /etc/pam.d/sshd


auth optional pam_krb5.so use_kcminit

auth optional pam_ntlm.so try_first_pass

auth optional pam_mount.so try_first_pass

auth required pam_opendirectory.so try_first_pass

account required pam_nologin.so

account required pam_sacl.so sacl_service=ssh

account required pam_opendirectory.so

password required pam_opendirectory.so

session required pam_launchd.so

session optional pam_mount.so


Contents of /etc/pam.d/su


auth sufficient pam_rootok.so

auth required pam_opendirectory.so

account required pam_group.so no_warn group=admin,wheel ruser root_only fail_safe

account required pam_opendirectory.so no_check_shell

password required pam_opendirectory.so

session required pam_launchd.so


Contents of /etc/pam.d/sudo


auth sufficient pam_smartcard.so

auth required pam_opendirectory.so

account required pam_permit.so

password required pam_deny.so

session required pam_permit.so


Contents of /etc/periodic/daily/110.clean-tmps


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_clean_tmps_enable" in

[Yy][Ee][Ss])

if [ -z "$daily_clean_tmps_days" ]

then

echo '$daily_clean_tmps_enable is set but' \

'$daily_clean_tmps_days is not'

rc=2

else

echo ""

echo "Removing old temporary files:"

set -f noglob

args="-atime +$daily_clean_tmps_days -mtime +$daily_clean_tmps_days"

args="${args} -ctime +$daily_clean_tmps_days"

dargs="-empty -mtime +$daily_clean_tmps_days"

dargs="${dargs} ! -name .vfs_rsrc_streams_*"

[ -n "$daily_clean_tmps_ignore" ] && {

args="$args "`echo " ${daily_clean_tmps_ignore% }" |

sed 's/[ ][ ]*/ ! -name /g'`

dargs="$dargs "`echo " ${daily_clean_tmps_ignore% }" |

sed 's/[ ][ ]*/ ! -name /g'`


...and 21 more line(s)


Contents of /etc/periodic/daily/130.clean-msgs


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_clean_msgs_enable" in

[Yy][Ee][Ss])

if [ ! -d /var/msgs ]

then

echo '$daily_clean_msgs_enable is set but /var/msgs' \

"doesn't exist"

rc=2

else

echo ""

echo "Cleaning out old system announcements:"

[ -n "$daily_clean_msgs_days" ] &&

arg=-${daily_clean_msgs_days#-} || arg=

msgs -c $arg && rc=0 || rc=3

fi;;

*) rc=0;;

esac

exit $rc


Contents of /etc/periodic/daily/140.clean-rwho


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_clean_rwho_enable" in

[Yy][Ee][Ss])

if [ -z "$daily_clean_rwho_days" ]

then

echo '$daily_clean_rwho_enable is enabled but' \

'$daily_clean_rwho_days is not set'

rc=2

elif [ ! -d /var/rwho ]

then

echo '$daily_clean_rwho_enable is enabled but /var/rwho' \

"doesn't exist"

rc=2

else

echo ""

echo "Removing stale files from /var/rwho:"

case "$daily_clean_rwho_verbose" in

[Yy][Ee][Ss])

print=-print;;

*)

print=;;


...and 14 more line(s)


Contents of /etc/periodic/daily/199.clean-fax


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

if [ -d /var/spool/fax ]; then

echo ""

echo "Removing scratch fax files"

cd /var/spool/fax && \

find . -type f -name '[0-9]*.[0-9][0-9][0-9]' -mtime +7 -delete >/dev/null 2>&1;

fi


Contents of /etc/periodic/daily/310.accounting


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_accounting_enable" in

[Yy][Ee][Ss])

if [ ! -f /var/account/acct ]

then

echo '$daily_accounting_enable is set but /var/account/acct' \

"doesn't exist"

rc=2

elif [ -z "$daily_accounting_save" ]

then

echo '$daily_accounting_enable is set but ' \

'$daily_accounting_save is not'

rc=2

else

echo ""

echo "Rotating accounting logs and gathering statistics:"

cd /var/account

rc=0

n=$daily_accounting_save

rm -f acct.$n.gz acct.$n || rc=3

m=$n


...and 18 more line(s)


Contents of /etc/periodic/daily/400.status-disks


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_status_disks_enable" in

[Yy][Ee][Ss])

echo ""

echo "Disk status:"

df $daily_status_disks_df_flags && rc=1 || rc=3

;;

*) rc=0;;

esac

exit $rc


Contents of /etc/periodic/daily/420.status-network


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_status_network_enable" in

[Yy][Ee][Ss])

echo ""

echo "Network interface status:"

case "$daily_status_network_usedns" in

[Yy][Ee][Ss])

netstat -i && rc=0 || rc=3;;

*)

netstat -in && rc=0 || rc=3;;

esac;;

*) rc=0;;

esac

exit $rc


Contents of /etc/periodic/daily/430.status-rwho


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$daily_status_rwho_enable" in

[Yy][Ee][Ss])

rwho=$(echo /var/rwho/*)

if [ -f "${rwho%% *}" ]

then

echo ""

echo "Local network system status:"

prog=ruptime

else

echo ""

echo "Local system status:"

prog=uptime

fi

rc=$($prog | tee /dev/stderr | wc -l)

if [ $? -eq 0 ]

then

[ $rc -gt 1 ] && rc=1

else

rc=3

fi;;


...and 3 more line(s)


Contents of /etc/periodic/daily/999.local


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

rc=0

for script in $daily_local

do

echo ''

case "$script" in

/*)

if [ -f "$script" ]

then

echo "Running $script:"

sh $script || rc=3

else

echo "$script: No such file"

[ $rc -lt 2 ] && rc=2

fi;;

*)

echo "$script: Not an absolute path"

[ $rc -lt 2 ] && rc=2;;

esac

done

exit $rc


Contents of /etc/periodic/monthly/199.rotate-fax


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

echo ""

printf %s "Rotating fax log files:"

cd /var/log/fax

for i in *.log; do

if [ -f "${i}" ]; then

echo -n " $i"

if [ -x /usr/bin/gzip ]; then gzext=".gz"; else gzext=""; fi

if [ -f "${i}.3${gzext}" ]; then mv -f "${i}.3${gzext}" "${i}.4${gzext}"; fi

if [ -f "${i}.2${gzext}" ]; then mv -f "${i}.2${gzext}" "${i}.3${gzext}"; fi

if [ -f "${i}.1${gzext}" ]; then mv -f "${i}.1${gzext}" "${i}.2${gzext}"; fi

if [ -f "${i}.0${gzext}" ]; then mv -f "${i}.0${gzext}" "${i}.1${gzext}"; fi

if [ -f "${i}" ]; then mv -f "${i}" "${i}.0" && if [ -x /usr/bin/gzip ]; then gzip -9 "${i}.0"; fi; fi

touch "${i}" && chmod 640 "${i}" && chown root:admin "${i}"

fi

done

echo ""


Contents of /etc/periodic/monthly/200.accounting


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

oldmask=$(umask)

umask 066

case "$monthly_accounting_enable" in

[Yy][Ee][Ss])

W=/var/log/wtmp

rc=0

remove=NO

if [ $rc -eq 0 ]

then

echo ""

echo "Doing login accounting:"

rc=$(ac -p | sort -nr -k 2 | tee /dev/stderr | wc -l)

[ $rc -gt 0 ] && rc=1

fi

[ $remove = YES ] && rm -f $W.0;;

*) rc=0;;

esac

umask $oldmask

exit $rc


Contents of /etc/periodic/monthly/999.local


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

rc=0

for script in $monthly_local

do

echo ''

case "$script" in

/*)

if [ -f "$script" ]

then

echo "Running $script:"

sh $script || rc=3

else

echo "$script: No such file"

[ $rc -lt 2 ] && rc=2

fi;;

*)

echo "$script: Not an absolute path"

[ $rc -lt 2 ] && rc=2;;

esac

done

exit $rc


Contents of /etc/periodic/weekly/320.whatis


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

case "$weekly_whatis_enable" in

[Yy][Ee][Ss])

echo ""

echo "Rebuilding whatis database:"

MANPATH=`/usr/bin/manpath -q`

if [ $? = 0 ]

then

if [ -z "${MANPATH}" ]

then

echo "manpath failed to find any manpage directories"

rc=3

else

rc=0

/usr/libexec/makewhatis.local "${MANPATH}" || rc=3

if [ X"${man_locales}" != X ]

then

for i in ${man_locales}

do

LC_ALL=$i /usr/libexec/makewhatis.local -a \

-L "${MANPATH}" || rc=3


...and 9 more line(s)


Contents of /etc/periodic/weekly/999.local


if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

fi

rc=0

for script in $weekly_local

do

echo ''

case "$script" in

/*)

if [ -f "$script" ]

then

echo "Running $script:"

sh $script || rc=3

else

echo "$script: No such file"

[ $rc -lt 2 ] && rc=2

fi;;

*)

echo "$script: Not an absolute path"

[ $rc -lt 2 ] && rc=2;;

esac

done

exit $rc


Contents of /Library/Preferences/com.apple.security.appsandbox.plist (XML 1.0 document text, ASCII text)


<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>UnrestrictSpotlightContainerScope</key>

<true/>

</dict>

</plist>


Contents of /Library/Preferences/SystemConfiguration/com.apple.Boot.plist (XML 1.0 document text, ASCII text)


<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>Kernel Flags</key>

<string></string>

</dict>

</plist>


Bad plists


/Library/Preferences/com.epson.Easy Photo Scan.UnInstallList.plist

/Library/Preferences/com.epson.Easy Photo Print.UnInstallList.plist

/Library/Preferences/com.epson.EPSON Scan.UnInstallList.plist

/Library/Preferences/com.epson.Inkjet Printer Driver.UnInstallList.plist

/Library/Preferences/com.epson.Print CD.UnInstallList.plist

/Library/Preferences/com.epson.Epson Event Manager.UnInstallList.plist

/Library/Preferences/com.epson.Epson Customer Research Participation.UnInstallList.plist

/Library/Preferences/com.epson.Epson Low Ink Reminder.UnInstallList.plist

/Library/Preferences/com.epson.EPSON Software Updater.UnInstallList.plist

/Library/Preferences/com.epson.Epson Connect Printer Setup.UnInstallList.plist

/Library/Preferences/com.epson.Epson Scanner Monitor.UnInstallList.plist

/Library/Preferences/com.epson.PC-FAX Driver.UnInstallList.plist

/Library/Preferences/com.epson.Epson Scanner ICA Driver.UnInstallList.plist


Listeners


launchd: microsoft-ds

launchd: microsoft-ds

kdc: kerberos

cupsd: ipp


User login items


Tri-BACKUP 8 Launcher

- /Applications/Tri-BACKUP 8.app/Contents/Resources/Tri-BACKUP 8 Launcher.app

OneDrive

- /Applications/OneDrive.app

iTunesHelper

- /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app


Restricted files: 1825


Elapsed time (s): 140

iMac with Retina 5K display, macOS High Sierra (10.13.4), 4 gHz i7 - 16GB

Posted on Apr 20, 2018 2:31 AM

Reply
Question marked as Best reply

Posted on Apr 20, 2018 5:05 AM

Hello WALTER-MILANO-ITALY,

I'm sorry, but there is a bug in EtreCheck regarding the hosts file. It incorrectly reports the file as corrupt if there are over 10 entries. This will be fixed in the next version. It would have been better to have asked privately or post your EtreCheck report. You have no idea what some random script on the internet is going to do. In this case it has exposed your piracy of Adobe apps. EtreCheck tries hard to hide that kind of personal information. But with added complexity sometimes comes bugs like the erroneous corrupt flag.


It looks like you had a kernel panic the last time you restarted. Do you have any panic reports in Console.app? EtreCheck tries to extract pertinent information from panic reports, but in rare cases, the reports are missing or incomplete.


Maybe run EtreCheck again the next time the machine misbehaves. Ideally, run EtreCheck during the anomaly or shortly afterwards.

Similar questions

5 replies

There are no replies.

EtreCheck says /etc/hosts file is Corrupted

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.