Awhile after boot, Finder slow & not responding, uses 99% CPU

Allan, thank you for replying and replying so quickly. Your suggestions are helpful. Your point about a possible failing hard drive is important. I forgot to mention that SoftRAID is warning me "Disk Predicted to Fail Based On SMART Data" -- "The SoftRAID Monitor has detected a disk which is 20 - 60 times more likely to fail over the next 2 - 6 months than a normal disk." The disk referred to is my startup disk! I don't know if this disk which apparently has an exceeding number of bad blocks causes the problem of slowness, since I'd been having the slow-Finder problem for over a year before I got the warning from SoftRAID. (You're wondering how I put up with the problem so long. I know.) I plan to change the disk, but it's going to be expensive and time-consuming for me. I'm thinking about just letting it fail. TimeMachine saves a backup for me every hour.

Anyway, here is what I did, in case it makes any other problem show up crystal clear. It isn't exactly what you said because you suggested I remove two of my favourite apps, but I tried to prevent them from affecting EtreCheck's report. I also uninstalled some programs and removed some kernel extensions and one or two login items. I made sure that Kaspersky Anti Virus Pro and BitTorrent will not run upon startup. I physically removed all external hard drives. (There are no other external peripherals except for my wireless keyboard and wireless mouse.) I shut down the computer, waited a few seconds, then started it up again with no user apps running. Note that kas (a Kaspersky process) was still using 261 MB of RAM at this point. Then I ran EtreCheck with the computer in this condition. The report is at the bottom of this post.

Regarding your point about swaps: What is the problem with them if Chrome or another programme asks for the memory and macOS safely moves currently unused data to swap? Of course it can slow down the system, but the computer can bring up the data (like web pages or Numbers spreadsheets, for example) faster than I can.

Regarding your point about six days since my last reboot: I've been using *nix systems for decades and rarely had any problem with a good system running for weeks or months without reboot. As long as there is enough free space on my disk (and maybe there isn't), swap should allow me to have a huge number of applications running, shouldn't it? Is there a problem offloading graphics memory? I would assume that is integrated into virtual memory.

The report:

EtreCheck version: 4.3.6 (4D041)

Report generated: 2018-08-31 01:41:22

Download EtreCheck from https://etrecheck.com

Runtime: 7:17

Performance: Below Average

Problem: No problem - just checking

Description:

I am taking advice obtained from the Apple user forum to get a cleaner EtreCheck report.

Major Issues: None

Minor Issues:

These issues do not need immediate attention but they may indicate future problems.

Time Machine auto backup disabled - Time Machine auto backups are disabled.

Apps hanging - There have been numerous app hangs.

Apps with heavy CPU usage - There have been numerous cases of apps with heavy CPU usage.

Small backup drive - Time Machine backup drive is too small.

Unsigned files - There are unsigned software file installed. They appear to be legitimate but should be reviewed.

Low performance - EtreCheck report took over 5 minutes to run. This is unusual.

32-bit Apps - This machine has 32-bits apps that may have problems in the future.

Hardware Information:

iMac (27-inch, Late 2012)

iMac Model: iMac13,2

1 3.2 GHz Intel Core i5 (i5-3470) CPU: 4-core

24 GB RAM - Upgradeable

BANK 0/DIMM0 - 8 GB DDR3 1600 ok

BANK 1/DIMM0 - 4 GB DDR3 1600 ok

BANK 0/DIMM1 - 8 GB DDR3 1600 ok

BANK 1/DIMM1 - 4 GB DDR3 1600 ok

Video Information:

NVIDIA GeForce GTX 675MX - VRAM: 1024 MB

iMac 2560 x 1440

Drives:

disk0 - APPLE HDD WDC WD10EALX-408EA0 1.00 TB (Mechanical)

Internal SATA 6 Gigabit Serial ATA

disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk0s2 - Macintosh HD (Journaled HFS+) 999.35 GB

disk0s3 - Recovery HD (Journaled HFS+) [Recovery] 650 MB

Mounted Volumes:

disk0s2 - Macintosh HD 999.35 GB (134.08 GB free)

Journaled HFS+

Mount point: /

Network:

Interface en0: Ethernet

Interface en6: iPad

Interface en1: Wi-Fi

802.11 a/b/g/n

One IPv4 address

Interface en5: iPhone

Interface bridge0: Thunderbolt Bridge

iCloud Quota: 8.96 GB available

System Software:

macOS High Sierra 10.13.6 (17G65)

Time since boot: Less than an hour

System Load: 1.68 (1 min ago) 1.79 (5 min ago) 1.11 (15 min ago)

Security:

Unsigned Files:

Launchd: /Library/LaunchAgents/org.chromium.chromoting.plist

Executable: /Library/PrivilegedHelperTools/org.chromium.chromoting.me2me.sh --run-from-launchd

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.rogueamoeba.instanton-agent.plist

Executable: instanton-agent

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist

Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Helper-Tool

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchAgents/com.oracle.java.Java-Updater.plist

Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater -bgcheck

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.softraid.softraidd.plist

Executable: softraidd

Details: Exact match found in the whitelist - probably OK

32-bit Applications:

90 32-bit apps

Kernel Extensions:

/Library/Extensions

[Loaded] SoftRAID.kext (SoftRAID LLC, 5.6.5 - SDK 10.9)

/System/Library/Extensions

[Not Loaded] Soundflower.kext (1.6.6 - SDK 10.6)

[Not Loaded] DymoUsbPrinterClassDriver.kext (1.1 - SDK 10.9)

System Launch Agents:

System Launch Daemons:

Launch Agents:

Launch Daemons:

User Launch Agents:

User Login Items:

iTunesHelper Application (Apple - installed 2018-07-13)

(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

Backup and sync from Google Application (Google, Inc. - installed 2018-05-30)

(/Applications/_Tom-Added/Backup and Sync.app)

Internet Plug-ins:

FlashPlayer-10.6: (installed 2016-04-08)

OVSHelper: (installed 2015-08-13)

Flash Player: (installed 2016-04-08)

DYMO NPAPI Addin: (installed 2015-12-22)

Google Earth Web Plug-in: (installed 2016-06-25)

googletalkbrowserplugin: (installed 2015-12-11)

DYMO Safari Addin: (installed 2015-12-22)

JavaAppletPlugin: (installed 2018-07-19)

Safari Extensions:

3rd Party Preference Panes:

Flash Player (installed 2016-04-05)

Java (installed 2018-07-19)

MenuMeters (installed 2013-06-25)

Time Machine:

Skip System Files: No

Mobile backups: No

Auto backup: No

Volumes being backed up:

Macintosh HD: Disk size: 999.35 GB - Disk used: 865.27 GB

Destinations:

T************A [Local] (Last used)

Total size: 999.86 GB

Total number of backups: 13

Oldest backup: 2018-08-30 02:57:29

Last backup: 2018-08-31 00:46:29

Top Processes by CPU:

Top Processes by Memory:

Top Processes by Network Use:

Top Processes by Energy Use:

Virtual Memory Information:

Software Installs (past 30 days):

Diagnostics Information (past 7 days):

2018-08-28 22:39:00 Finder.app Hang (13 times)

/System/Library/CoreServices/Finder.app

2018-08-28 00:37:41 Google Chrome.app CPU (7 times)

/Applications/Google Chrome.app

2018-08-27 20:50:06 QuickLookUIService Crash

/System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuickLookUI.fr amework/Versions/A/XPCServices/QuickLookUIService.xpc/Contents/MacOS/QuickLookUI Service

2018-08-27 15:10:24 WindowServer CPU (3 times)

/System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/Resources/Window Server

2018-08-27 02:39:36 Adobe CEF Helper.app Crash (4 times)

/Library/Application Support/Adobe/*/Adobe CEF Helper.app

End of report

Allan, I'm still working on your concise help. Thanks! I must confess Kaspersky Virus Scanner Pro Agent was running when I ran EtreCheck a third time and got 'Good' performance. The report is below. It looks much better than the first report and even the second report during which Google Backup and Sync was doing a lot of work, so is it a normal report now? I'm still concerned about the 'minor' issues, though. Please read my reply to Old Toad if you have time.

EtreCheck version: 4.3.6 (4D041)

Report generated: 2018-08-31 13:30:02

Download EtreCheck from https://etrecheck.com

Runtime: 4:47

Performance: Good

Problem: No problem - just checking

Description:

This is a very lightly loaded system now; I am only running Chrome and I have only one desktop. I want to see whether EtreCheck finds any major or minor problems.

Major Issues: None

Minor Issues:

These issues do not need immediate attention but they may indicate future problems.

Time Machine auto backup disabled - Time Machine auto backups are disabled.

Heavy RAM usage - This machine is using a large amount of RAM.

Apps hanging - There have been numerous app hangs.

Apps with heavy CPU usage - There have been numerous cases of apps with heavy CPU usage.

Small backup drive - Time Machine backup drive is too small.

Unsigned files - There are unsigned software file installed. They appear to be legitimate but should be reviewed.

32-bit Apps - This machine has 32-bits apps that may have problems in the future.

Hardware Information:

iMac (27-inch, Late 2012)

iMac Model: iMac13,2

1 3.2 GHz Intel Core i5 (i5-3470) CPU: 4-core

24 RAM - Upgradeable

BANK 0/DIMM0 - 8 GB DDR3 1600 ok

BANK 1/DIMM0 - 4 GB DDR3 1600 ok

BANK 0/DIMM1 - 8 GB DDR3 1600 ok

BANK 1/DIMM1 - 4 GB DDR3 1600 ok

Video Information:

NVIDIA GeForce GTX 675MX - VRAM: 1024 MB

iMac 2560 x 1440

Drives:

disk0 - APPLE HDD WDC WD10EALX-408EA0 1.00 TB (Mechanical)

Internal SATA 6 Gigabit Serial ATA

disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk0s2 - Macintosh HD (Journaled HFS+) 999.35 GB

disk0s3 - Recovery HD (Journaled HFS+) [Recovery] 650 MB

Mounted Volumes:

disk0s2 - Macintosh HD 999.35 GB (131.06 GB free)

Journaled HFS+

Mount point: /

Network:

Interface en0: Ethernet

Interface en6: iPad

Interface en1: Wi-Fi

802.11 a/b/g/n

One IPv4 address

Interface en5: iPhone

Interface bridge0: Thunderbolt Bridge

iCloud Quota: 8.96 GB available

System Software:

macOS High Sierra 10.13.6 (17G65)

Time since boot: About 12 hours

System Load: 2.21 (1 min ago) 2.21 (5 min ago) 2.27 (15 min ago)

Security:

System Status

Gatekeeper Mac App Store and identified developers

System Integrity Protection Enabled

Unsigned Files:

Launchd: /Library/LaunchDaemons/com.rogueamoeba.instanton-agent.plist

Executable: instanton-agent

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist

Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Helper-Tool

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.softraid.softraidd.plist

Executable: softraidd

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchAgents/org.chromium.chromoting.plist

Executable: /Library/PrivilegedHelperTools/org.chromium.chromoting.me2me.sh --run-from-launchd

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchAgents/com.oracle.java.Java-Updater.plist

Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater -bgcheck

Details: Exact match found in the whitelist - probably OK

32-bit Applications:

90 32-bit apps

Kernel Extensions:

/Library/Extensions

[Loaded] SoftRAID.kext (5.6.5 - SDK 10.9)

/System/Library/Extensions

[Not Loaded] Soundflower.kext (1.6.6 - SDK 10.6)

[Not Loaded] DymoUsbPrinterClassDriver.kext (1.1 - SDK 10.9)

System Launch Agents:

[Not Loaded] 9 Apple tasks

[Loaded] 171 Apple tasks

[Running] 113 Apple tasks

[Other] One Apple task

System Launch Daemons:

[Not Loaded] 32 Apple tasks

[Loaded] 184 Apple tasks

[Running] 118 Apple tasks

[Other] 2 Apple tasks

Launch Agents:

[Running] com.softraid.SoftRAIDMonitor.plist (SoftRAID LLC - installed 2018-02-28)

[Loaded] org.macosforge.xquartz.startx.plist (? d225a7da - installed 2015-10-16)

[Loaded] com.google.keystone.agent.plist (Google, Inc. - installed 2018-07-18)

[Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2018-05-23)

[Loaded] com.oracle.java.Java-Updater.plist (? 28b2abd9 - installed 2018-07-07)

[Other] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a 23d420d.plist (Adobe Systems, Inc. - installed 2018-04-21)

[Other] org.chromium.chromoting.plist (? 81572da9 - installed 2018-07-24)

[Running] com.privateinternetaccess.osx.PIA-VPN.plist (London Trust Media Incorporated - installed 2018-06-19)

Launch Daemons:

[Running] com.softraid.softraidd.plist (? 39d3366c - installed 2018-02-28)

[Loaded] com.oracle.java.Helper-Tool.plist (? e3fefdd2 - installed 2018-07-07)

[Loaded] org.macosforge.xquartz.privileged_startx.plist (? 65395f14 - installed 2015-10-16)

[Loaded] com.google.keystone.daemon.plist (Google, Inc. - installed 2018-07-18)

[Running] com.dymo.pnpd.plist (? 0 - installed 2014-10-16)

[Loaded] com.skype.skypeinstaller.plist (? a81aef1d - installed 2017-01-07)

[Loaded] com.rogueamoeba.instanton-agent.plist (? e0a5b354 - installed 2017-07-25)

User Launch Agents:

[Loaded] com.bittorrent.BitTorrent.plist (BitTorrent, Inc - installed 2018-06-09)

[Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2018-08-31)

User Login Items:

iTunesHelper Application (Apple - installed 2018-07-13)

(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

Backup and sync from Google Application (Google, Inc. - installed 2018-05-30)

(/Applications/_Tom-Added/Backup and Sync.app)

Internet Plug-ins:

FlashPlayer-10.6: (installed 2016-04-08)

OVSHelper: (installed 2015-08-13)

Flash Player: (installed 2016-04-08)

DYMO NPAPI Addin: (installed 2015-12-22)

Google Earth Web Plug-in: (installed 2016-06-25)

googletalkbrowserplugin: (installed 2015-12-11)

DYMO Safari Addin: (installed 2015-12-22)

JavaAppletPlugin: (installed 2018-07-19)

Safari Extensions:

OpenIE.safariextz - Parallels - http://www.parallels.com (installed 2018-07-31)

3rd Party Preference Panes:

Flash Player (installed 2016-04-05)

Java (installed 2018-07-19)

MenuMeters (installed 2013-06-25)

Time Machine:

Skip System Files: No

Mobile backups: No

Auto backup: No

Volumes being backed up:

Macintosh HD: Disk size: 999.35 GB - Disk used: 868.29 GB

Destinations:

T************A [Local] (Last used)

Total size: 999.86 GB

Total number of backups: 13

Oldest backup: 2018-08-30 02:57:29

Last backup: 2018-08-31 00:46:29

Top Processes by CPU:

Process (count) Source % of CPU Location

Google Chrome Helper (76) Google, Inc. 26

Google Chrome Google, Inc. 8

WindowServer Apple 7

mds_stores Apple 4

kernel_task Apple 3

Top Processes by Memory:

Process (count) Source RAM usage Location

Google Chrome Helper (80) Google, Inc. 11.33 GB

kernel_task Apple 1.28 GB

Google Chrome Google, Inc. 1.13 GB

mds_stores Apple 303 MB

kas Mac App Store 298 MB

Top Processes by Network Use:

Process Source Input Output Location

mDNSResponder Apple 476 KB 236 KB

netbiosd Apple 66 KB 22 KB

rapportd Apple 4 KB 38 KB

apsd Apple 4 KB 4 KB

SystemUIServer Apple 0 B 144 B

Top Processes by Energy Use:

Process (count) Source Energy (0-100) Location

Google Chrome Helper (80) Google, Inc. 21

Google Chrome Google, Inc. 5

WindowServer Apple 4

mds_stores Apple 1

mdworker (7) Apple 1

Virtual Memory Information:

Available RAM 8.71 GB

Free RAM 19 MB

Used RAM 15.29 GB

Cached files 8.70 GB

Swap Used 188 MB

Software Installs (past 30 days):

Name Version Install Date

Chrome Remote Desktop Host 69.0.3497 2018-08-06

CloudApp 4.4.1 2018-08-16

Gatekeeper Configuration Data 153 2018-08-28

Flip4Mac Uninstaller 3.0 2018-08-30

Diagnostics Information (past 7 days):

2018-08-28 22:39:00 Finder.app Hang

/System/Library/CoreServices/Finder.app

2018-08-28 00:37:41 Google Chrome.app CPU

/Applications/Google Chrome.app

2018-08-27 20:50:06 QuickLookUIService Crash

/System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuickLookUI.f ramework/Versions/A/XPCServices/QuickLookUIService.xpc/Contents/MacOS/QuickLookU IService

2018-08-27 15:10:24 WindowServer CPU

/System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/Resources/Windo wServer

2018-08-27 02:39:36 Adobe CEF Helper.app Crash

/Library/Application Support/Adobe/*/Adobe CEF Helper.app

End of report

Correction: Kaspersky Virus Scanner Pro Agent was running when I ran EtreCheck the second time. I don't want to uninstall the Kaspersky software for good because it has detected Bitcoin-mining and such JavaScript malware and allowed me to delete it, which sped up my system a lot. The BBC article you mentioned, Allan, specifically said most users should not panic and remove the Kaspersky software. IMHO the NSA is much more dangerous than Kaspersky Labs to individuals.

I know that most virus and Trojan infections come from a user's bad habits and prevention is really the only cure (since after an infection some viruses can "own" the system), but I think it's good to run a good virus scanner on a Mac these days, considering such problems as moments of user weakness (installing some software from an unreliable source), careless software vendors, and ransomware.

Kaspersky seems to be rated better than Mcafee for Mac malware protection, from what I've read.

Hi, Old Toad. You provided a lot of food for thought, certainly. Thanks!

After waiting for Google Backup and Sync to finish some work, I re-ran EtreCheck and got a 'Good' rating in EtreCheck's Performance tab. I am very happy because it looks like this could be the beginning of fixing my long-running problem! Yippee!

If enough of my system is still intact, I'd like to narrow down which part of the system and, hopefully, which user-level threads are clogging the CPU or the user-event pipeline. Adding the keyword bottleneck to my googling seems to turn up some pointers on that subject.

I'd like to learn how to troubleshoot my iMac in a systematic way to pinpoint its problem (or problems). Maybe I'll have to read some books to learn it. Allan's suspicion about a failing hard disk is worth following up, even if it requires an onerous replacement. He also pointed me to threats BitTorrent opens me up to. I will do something to fix that--probably never use it again on my main computer. Otherwise I don't really like making absolutely huge changes to my usage patterns just to speed up Finder. If I do a clean install (not from Time Machine) my system might run fast, but it destroys hundreds or thousands of hours of effort in setting things up; I don't think that's the most sophisticated thing to do.

I hope this thread regarding Kaspersky and malware doesn't end up dominating my request for help. I'm after power user education and I'm willing to read a book on Mac internals to get it. Any recommendations specific to my stated needs would be most appreciated. My background is mostly *nix application programming and a bit of driver and kernel programming, by the way. I probably should have been able to better pinpoint my system's problems, but my understanding of System Monitor and BSD top(1) and vm_stat(1) and the like is very spotty.

So far as I understand, the banning of Kaspersky software is just a precaution and must be viewed in light of the current Russophobia. I think if the government were serious about computer security they would ban government use of MS Windows and Macs in most of their offices. Libré software can be much more secure than closed-source software (though, as Heartbleed proved, not perfectly secure). I don't think I'm a tinfoil hat type, but I suppose you've read Wired's article on NSA's hard-disk flasher, GrayFish, that survives attempts to reflash the hard disk's ROM. (bit.ly/2PUhbCu) How about that? (Notice that Kaspersky is the one who brought the flasher to the public's attention.) GrayFish is only the worst publicly known NSA exploit. I wouldn't assume the NSA is not inside any almost-new PC or Mac that's been on the Internet (or is it 'internet' now?) for a few months. Would you be okay if people watched you with secret cameras in your bathroom? 'But I haven't done anything wrong' is not the point. I don't have answers for terrorism and crime, but if I were an opposition party technologist, I would sure try to keep my computers away from the NSA, if even possible. As a little guy without any dark secrets, I feel safe from harassment. But if 60 - 70% of people feel the same way, it is a slippery slope. (I don't have any answers for that either, except to try to wake people up.) Is there any need for me to catalogue the NSA's other intrusions into our digital lives? I'll just give one more example. As an American living abroad and communicating online with many foreigners, I'm sure they keep a lot of records pinpointing me. They have the 'right' to do that.

As to your comments about defences against malware, etc., I used to hold to the same views, but as malware writers become more and more subtle with their attacks, and since I'm human and can have a momentary lapse in judgement, it doesn't seem dumb anymore to run anti-malware software. I understand that such software, the Kaspersky software included, has a dangerous level of access to my OS and I live with that (significant and inelegant) compromise.

Somehow I missed the news about Google listening in via Chrome or just skipped over it. I was already keeping a slip of paper over my iMac's camera. Now I guess I'll have to look for a way to turn off the mic at OS level. I am painfully aware of Chrome being a resource hog. I do a tremendous amount of research on the Web (or is it 'web' now?) and am developing software--for which I absolutely require Chrome. I use two Chrome extensions that mitigate Chrome's problems: Tab Outliner (paid for) and The Big Suspender. I also just kill off runaway Chrome helper processes when they turn up (not common anymore except when I go bonkers with 100+ tabs). I believe heavy resource usage is a 'feature' of the way Chrome enables JavaScript, but that might be a mistaken notion.

The 'do not track' feature is no big deal to me. If I really want anonymity, I'll use a good VPN and probably Firefox.

The trend towards 'phone home' software nowadays just seems to be the way the wind is blowing. It, along with over-dependence upon cloud computing, puts our privacy and data at risk. It might be a good idea for most of us to have a utility computer for day-to-day use, a hardened computer for things like net banking, and a few years' worth of monthly backups. Such a monthly backup scheme is something any good computer company has had for decades. They live and die by their software (even computer vendors).