Requesting Help from EtreSoft Report
Hello, My MacBook Pro one day started beachballing endlessly when I opened Chrome. In my Utilities folder, I suspected processes AppNOS and APPTS were to blame. I followed an Apple Support Forum suggestion to run an EtreSoft EtreCheck report, which I did, so I am posting it here below with hopes of advice on how to fix it. I believe it is due to some adware problem I downloaded mistakenly. I am not highly technical, so if any responder could keep that in mind, I would be so grateful. Many thanks in advance.
My computer details:
I have a MacBook Pro (13 inch, late 2011) running macOS HIgh Sierra 10.13.4
2.4 GHz, Intel Core i5, Memory 4GB 1333 Mhz DDR3, 500 GB storage
EtreCheck version: 4.2.1 (4C020)
Report generated: 2018-04-28 14:01:27
Download EtreCheck from https://etrecheck.com
Runtime: 11:34
Performance: Poor
Problem: Beachballing
Description:
Processes APPNOS and APPTS are eating up my RAM. My Chrome browser is beach balling constantly, but my Safari seems to work. All of a sudden this seems to have happened, so I must have downloaded some sort of bad adware. Help
Major Issues:
Anything that appears on this list needs immediate attention.
No Time Machine backup - Time Machine backup not found.
Adware - Adware detected.
Poor performance - EtreCheck report took over 10 minutes to run. This is very unusual.
Minor Issues:
These issues do not need immediate attention but they may indicate future problems.
Upgradeable hard drive - This machine’s hard drive could be replaced with an SSD. This would dramatically improve your machine’s performance.
High battery cycle count - Your battery may be losing capacity.
Apps crashing - There have been numerous app crashes.
Clean up - There are orphan files that could be removed.
Small backup drive - Time Machine backup drive is too small.
Unsigned files - There is unsigned software installed. They appear to be legitimate but should be reviewed.
Hardware Information:
MacBook Pro (13-inch, Late 2011)
MacBook Pro Model: MacBookPro8,1
1 2.4 GHz Intel Core i5 (i5-2435M) CPU: 2-core
4 GB RAM Upgradeable
BANK 0/DIMM0 - 2 GB DDR3 1333 ok
BANK 1/DIMM0 - 2 GB DDR3 1333 ok
Battery: Health = Replace Soon - Cycle count = 1750
Video Information:
Intel HD Graphics 3000 - VRAM: 384 MB
Color LCD 1280 x 800
Drives:
disk0 - TOSHIBA MK5065GSXF 500.11 GB (Mechanical)
Internal SATA 3 Gigabit Serial ATA
disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB
disk0s2 () [Core Storage Container] 499.25 GB
disk1 - Macintosh HD (Journaled HFS+) 498.88 GB
disk0s3 - Recovery HD (Journaled HFS+) [Recovery] 650 MB
Mounted Volumes:
disk1 - Macintosh HD 498.88 GB (243.38 GB free)
Journaled HFS+
Mount point: /
Network:
Interface en0: Ethernet
Interface fw0: FireWire
Interface en1: Wi-Fi
802.11 a/b/g/n
One IPv4 address
Interface en3: iPhone
Interface en4: Bluetooth PAN
Interface bridge0: Thunderbolt Bridge
iCloud Quota: 141.51 GB available
System Software:
macOS High Sierra 10.13.4 (17E199)
Time since boot: Less than an hour
System Load: 1.83 (1 min ago) 1.94 (5 min ago) 1.87 (15 min ago)
Configuration Files:
File /etc/launchd.conf exists but not expected
/etc/hosts - Count: 1
Security:
| System | Status |
|---|---|
| Gatekeeper | Mac App Store and identified developers |
| System Integrity Protection | Enabled |
Adware:
Launchd: ~/Library/LaunchAgents/Otwexplain.dolnwoad.plist
Reason: Adware name match
Executable: /Users/***/Library/Application Support/Otwexplain/Otwexplain.app/Contents/MacOS/AppAS -trigger download -isDev 0 -installVersion 1099 -firstAppId 730980002 -sig ASSAF_SIGNATURE -identity Otwexplain
Launchd: ~/Library/LaunchAgents/com.adscleaner.hlpradc.plist
Reason: Adware name match
Executable: /Users/***/Library/Application Support/adc/hlpradc.app/Contents/MacOS/hlpradc
Launchd: ~/Library/LaunchAgents/Otwexplain.disable.plist
Reason: Adware name match
Executable: /Users/***/Library/Application Support/Otwexplain/Otwexplain.app/Contents/MacOS/AppAS -trigger disable -isDev 0 -installVersion 1099 -firstAppId 730980002 -identity Otwexplain
Launchd: ~/Library/LaunchAgents/Otwexplain.uadpte.plist
Reason: Adware name match
Executable: /Users/***/Library/Application Support/Otwexplain/Otwexplain.app/Contents/MacOS/AppAS -trigger update -isDev 0 -installVersion 1099 -firstAppId 730980002 -identity Otwexplain -sig ASSAF_SIGNATURE -agentUpdate 0
Launchd: ~/Library/LaunchAgents/com.pcv.hlpramcn.plist
Reason: Adware name match
Executable: /Users/***/Library/Application Support/amc/helperamc.app/Contents/MacOS/helperamc
Launchd: ~/Library/LaunchAgents/Otwexplain.btvlit.plist
Reason: Adware name match
Executable: /Users/***/Library/Application Support/Otwexplain/Otwexplain.app/Contents/MacOS/AppAS -trigger ltvbit -isDev 0 -installVersion 1099 -firstAppId 730980002 -identity Otwexplain
Launchd: ~/Library/LaunchAgents/Smokyashan.isengard.plist
Reason: Adware name match
Executable: /Users/***/Library/Application Support/Smokyashan/Smokyashan.app/Contents/MacOS/AppNOS -trigger update -isDev 0 -installVersion 1054 -firstAppId 1434976216979282 -identity Smokyashan -sig NOSIGNATURE_SIGNATURE -agentUpdate 2
Launchd: ~/Library/LaunchAgents/Otwexplain.AppVemoral.plist
Reason: Adware name match
Executable: /Users/***/Library/Application Support/Otwexplain/Otwexplain.app/Contents/MacOS/AppAS -trigger AppRemoval -isDev 0 -installVersion 1099 -firstAppId 730980002 -identity Otwexplain
Unsigned Files:
Launchd: ~/Library/LaunchAgents/mg.update.plist
Executable: /Users/***/Library/Application Support/mg/MG.app/Contents/MacOS/MG
Launchd: /Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist
Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Helper-Tool
Details: Exact match found in the whitelist - probably OK
Launchd: ~/Library/LaunchAgents/com.citrixonline.GoToMeeting.G2MUpdate.plist
Executable: /Users/***/Library/Application Support/CitrixOnline/GoToMeeting/G2MUpdate
Details: Exact match found in the whitelist - probably OK
Launchd: /Library/LaunchDaemons/com.cisco.anyconnect.aciseagentd.plist
Executable: /opt/cisco/anyconnect/bin/aciseagentd -d
Details: Exact match found in the whitelist - probably OK
Launchd: /Library/LaunchDaemons/com.cisco.anyconnect.ciscod.plist
Executable: /opt/cisco/hostscan/bin/ciscod -d
Details: Exact match found in the whitelist - probably OK
Launchd: /Library/LaunchAgents/com.cisco.anyconnect.gui.plist
Executable: /Applications/Cisco/Cisco AnyConnect Secure Mobility Client.app --wait-apps /Applications/Cisco/Cisco AnyConnect Secure Mobility Client.app
Details: Exact match found in the whitelist - probably OK
Launchd: /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist
Executable: /Library/PrivilegedHelperTools/com.microsoft.office.licensing.helper
Details: Exact match found in the whitelist - probably OK
Launchd: /Library/LaunchDaemons/com.cisco.anyconnect.vpnagentd.plist
Executable: /opt/cisco/anyconnect/bin/vpnagentd -execv_instance
Details: Exact match found in the whitelist - probably OK
Launchd: /Library/LaunchAgents/com.oracle.java.Java-Updater.plist
Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater -bgcheck
Details: Exact match found in the whitelist - probably OK
Kernel Extensions:
/System/Library/Extensions
[Not Loaded] WD1394HPDriver.kext (1.0.11 - SDK 10.4)
[Not Loaded] WD1394_64HPDriver.kext (1.0.1 - SDK 10.6)
[Not Loaded] WDUSB_64HPDriver.kext (1.0.3)
[Not Loaded] WDUSBHPDriver.kext (1.0.14)
System Launch Agents:
| [Not Loaded] | 8 Apple tasks |
| [Loaded] | 178 Apple tasks |
| [Running] | 106 Apple tasks |
| [Other] | One Apple task |
System Launch Daemons:
| [Not Loaded] | 37 Apple tasks |
| [Loaded] | 180 Apple tasks |
| [Running] | 117 Apple tasks |
| [Other] | One Apple task |
Launch Agents:
| [Running] | com.adobe.AdobeCreativeCloud.plist (? faec172d - installed 2015-11-30) |
| [Not Loaded] | com.adobe.AAM.Updater-1.0.plist (? ffb65062 - installed 2015-11-30) |
| [Loaded] | com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2018-02-18) |
| [Loaded] | com.oracle.java.Java-Updater.plist (? ccc2859a - installed 2017-12-19) |
| [Loaded] | com.cisco.anyconnect.gui.plist (? 40bd3462 - installed 2017-05-02) |
| [Other] | com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a2 3d420d.plist (Adobe Systems, Inc. - installed 2018-02-18) |
Launch Daemons:
| [Loaded] | com.adobe.ARMDC.SMJobBlessHelper.plist (Adobe Systems, Inc. - installed 2018-02-18) |
| [Running] | com.cisco.anyconnect.aciseagentd.plist (? 8b31c1c3 - installed 2016-12-09) |
| [Running] | com.cisco.anyconnect.vpnagentd.plist (? f363637f - installed 2016-12-09) |
| [Loaded] | com.adobe.fpsaud.plist (Adobe Systems, Inc. - installed 2018-03-26) |
| [Loaded] | com.microsoft.office.licensing.helper.plist (? 6d8cb30e - installed 2011-03-10) |
| [Loaded] | com.oracle.java.Helper-Tool.plist (? e3fefdd2 - installed 2017-12-19) |
| [Running] | com.adobe.agsservice.plist (Adobe Systems, Inc. - installed 2018-02-18) |
| [Loaded] | com.adobe.ARMDC.Communicator.plist (Adobe Systems, Inc. - installed 2018-02-18) |
| [Running] | com.cisco.anyconnect.ciscod.plist (? d78c2ec9 - installed 2016-12-09) |
| [Not Loaded] | org.AnonymousVPN.helper.plist (? 0 - installed 2015-11-01) |
User Launch Agents:
| [Loaded] | Otwexplain.disable.plist (Adware - installed 2018-03-25) |
| [Loaded] | Otwexplain.uadpte.plist (Adware - installed 2018-03-25) |
| [Running] | com.spotify.webhelper.plist (Spotify - installed 2018-04-28) |
| [Loaded] | com.google.keystone.agent.plist (Google, Inc. - installed 2018-02-03) |
| [Running] | com.techyutils.ummhlpr.plist (Techyutils Software Private Limited - installed 2016-12-24) |
| [Other] | com.adscleaner.hlpradc.plist (Adware - installed 2017-02-08) |
| [Loaded] | com.dropbox.DropboxMacUpdate.agent.plist (Dropbox, Inc. - installed 2018-04-12) |
| [Loaded] | Smokyashan.isengard.plist (Adware - installed 2018-03-28) |
| [Loaded] | mg.update.plist (? 0 - installed 2016-07-13) |
| [Loaded] | com.citrixonline.GoToMeeting.G2MUpdate.plist (? 0 - installed 2017-02-22) |
| [Other] | com.adwarecleaner.hlprawc.plist (? 0 - installed 2016-08-19) |
| [Loaded] | com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2018-02-18) |
| [Loaded] | Otwexplain.btvlit.plist (Adware - installed 2018-03-25) |
| [Loaded] | Otwexplain.dolnwoad.plist (Adware - installed 2018-03-25) |
| [Other] | c***********************************1@m*******************************t (? 0 - installed 2011-12-19) |
| [Loaded] | Otwexplain.AppVemoral.plist (Adware - installed 2018-03-25) |
| [Other] | com.pcv.hlpramcn.plist (Adware - installed 2017-07-01) |
User Login Items:
Advanced Mac Cleaner Application (PCVARK software Private Limited
(/Applications/Advanced Mac Cleaner.app)
iTunesHelper Application (? - installed 2018-04-02)
(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)
ScanSnap Manager Application (?
(/Applications/ScanSnap/ScanSnap Manager.app)
Genieo Application (?
(/Incompatible Software/Genieo.app)
Dropbox Application (?
(/Applications/Dropbox.app)
Google Chrome Application (Google, Inc.
(/Applications/Google Chrome.app)
AdobeResourceSynchronizer Application (Adobe Systems, Inc.
(/Applications/Adobe Acrobat Reader DC.app/Contents/Helpers/AdobeResourceSynchronizer.app)
ShareFile Desktop Application (novel labs, inc.
(/Applications/ShareFile Desktop.app)
Spotify Application (Spotify
(/Applications/Spotify.app)
Internet Plug-ins:
AdobeAAMDetect: 3.0.0.0 (installed 2015-11-30)
FlashPlayer-10.6: 29.0.0.140 (installed 2018-04-10)
QuickTime Plugin: 7.7.3 (installed 2018-04-07)
AdobePDFViewerNPAPI: 17.012.20098 (installed 2018-02-26)
AdobePDFViewer: 18.011.20038 (installed 2018-02-26)
Flash Player: 29.0.0.140 (installed 2018-04-10)
SharePointBrowserPlugin: 14.5.9 (installed 2015-12-30)
Silverlight: 5.1.30514.0 (installed 2014-11-03)
JavaAppletPlugin: Java 8 Update 161 build 12 (installed 2018-02-21)
User Internet Plug-ins:
CitrixOnlineWebDeploymentPlugin: 1.0.105 (installed 2013-04-25)
ZoomUsPlugIn: 4.1.23108.0402 (installed 2018-04-05)
Google Earth Web Plug-in: 7.1 (installed 2013-10-07)
Safari Extensions:
| gophoto-it.safariextz - installdaddy - (installed 2014-01-19) |
3rd Party Preference Panes:
Flash Player (installed 2018-03-26)
Java (installed 2018-02-21)
Time Machine:
Time Machine Not Configured!
Top Processes by CPU:
| Process (count) | Source | % of CPU |
| WindowServer | Apple | 21 |
| sandboxd | Apple | 8 |
| sysmond | Apple | 3 |
| kernel_task | Apple | 1 |
| mdworker (22) | Apple | 1 |
Top Processes by Memory:
| Process (count) | Source | RAM usage |
| kernel_task | Apple | 449 MB |
| mdworker (23) | Apple | 291 MB |
| mds_stores | Apple | 182 MB |
| Dropbox (3) | Dropbox, Inc. | 87 MB |
| Finder | Apple | 73 MB |
Top Processes by Network Use:
| Process | Source | Input | Output |
| Dropbox | Dropbox, Inc. | 72 KB | 147 KB |
| mDNSResponder | Apple | 127 KB | 63 KB |
| apsd | Apple | 8 KB | 7 KB |
| netbiosd | Apple | 2 KB | 1 KB |
| SystemUIServer | Apple | 0 B | 144 B |
Top Processes by Energy Use:
| Process (count) | Source | Energy usage (0-100) |
| mdworker (23) | Apple | 14 |
| mds | Apple | 5 |
| WindowServer | Apple | 4 |
| mds_stores | Apple | 4 |
| sysmond | Apple | 1 |
Virtual Memory Information:
| Available RAM | 1015 MB |
| Free RAM | 18 MB |
| Used RAM | 3.01 GB |
| Cached files | 997 MB |
| Swap Used | 768 KB |
Clean up:
~/Library/LaunchAgents/com.adwarecleaner.hlprawc.plist
/Users/***/Library/Application Support/awc/hlprawc.app/Contents/MacOS/hlprawc
Executable not found
~/Library/LaunchAgents/c***********************************1@m****************** *************t
/System/Library/Frameworks/CoreServices.framework/Frameworks/OSServices.framewor k/Versions/A/Support/CSConfigDotMacCert
Executable not found
Diagnostics Information (past 7 days):
2018-04-28 13:45:35 ShareFile Desktop.app Crash (4 times)
/System/Library/PrivateFrameworks/WirelessDiagnostics.framework/Versions/A/Libra ries/libprotobuf.dylib abort() called *** error for object 0x60000044a410: Invalid pointer dequeued from free list |
2018-04-28 13:42:08 Adobe CEF Helper.app Crash (5 times)
2018-04-28 13:37:08 Google Chrome.app Hang (once)
2018-04-28 00:21:12 syncdefaultsd Crash (once)
*** Terminating app due to uncaught exception 'NSInternalInconsistencyException', reason: 'Unexpected syncIdentifier(5) for app:com.apple.security.cloudkeychainproxy3/0x7fdb7865fac0' terminating with uncaught exception of type NSException abort() called |
2018-04-27 13:09:01 WindowServer CPU (2 times)
End of report
MacBook Pro, macOS High Sierra (10.13.4)