Activity monitor sending out massive amounts of data

My activity monitor has been sending out and receiving a massive amount of data (ie. 9.81 GB out and 117.82 GB in). What in the world is causing this? Do I have some kind of virus or is my computer being used for cryptocurrency mining?


I am still on Sierra (os 10.12.6), I really don't want to upgrade my laptop just yet because it will brick all of my FCP 7 projects.


I have done all of the usual (ran Avast, and Malwarebytes. Zapped pRam, repaired permissions with disk utility, ran OnYX), but yet it is still doing this in fact getting worse.

MacBook Pro (Retina, 15-inch, Late 2013), macOS Sierra (10.12.6)

Posted on Oct 13, 2018 6:26 PM

Reply

Similar questions

4 replies

Oct 13, 2018 7:49 PM in response to Eric Root

Eric,

Thanks for the reply. I have been using Avast for a while and would be reluctant to get rid of it. I have tried everything and this one is really good at catching stuff. I have mail shields and web shields that light up whenever anything suspicious happens. I will consider your suggestion but not quite sure yet.


Now with the latest in my discovery. We have been having connectivity issues in our house. I had to move my time machine so my room mate could use it as an access point. He is running an old pc with who knows what that is in there. Once I unplugged the time machine the Kernel_task stopped. So my theory is that his computer is probably mining Cryptocurrency and unable to penetrate my mac or there is something wrong with the time machine.


Here's my report.



EtreCheck version: 5.0.5 (5A016)


Report generated: 2018-10-12 22:13:02

Download EtreCheck from https://etrecheck.com

Runtime: 3:28

Performance: Good

Problem: No problem - just checking

Major Issues:

Anything that appears on this list needs immediate attention.

More than one antivirus app - This machine has multiple antivirus apps installed.

Minor Issues:

These issues do not need immediate attention but they may indicate future problems.

Heavy RAM usage - This machine is using a large amount of RAM.

Apps crashing - There have been numerous app crashes.

Apps with heavy CPU usage - There have been numerous cases of apps with heavy CPU usage.

Clean up - There are orphan files that could be removed.

Unsigned files - There are unsigned software files installed. They appear to be legitimate but should be reviewed.

System modifications - There are a large number of system modifications running in the background.

32-bit Apps - This machine has 32-bits apps that may have problems in the future.

Hardware Information:

MacBook Pro (Retina, 15-inch, Late 2013)

MacBook Pro Model: MacBookPro11,2

1 2 GHz Intel Core i7 (i7-4750HQ) CPU: 4-core

16 RAM - Not upgradeable

BANK 0/DIMM0 - 8 GB DDR3 1600 ok

BANK 1/DIMM0 - 8 GB DDR3 1600 ok

Battery: Health = Normal - Cycle count = 498

Video Information:

Intel Iris Pro - VRAM: 1536 MB

Color LCD 2880 x 1800

Drives:

disk0 - APPLE SSD SM0256F 251.00 GB (Solid State - TRIM: Yes)

Internal PCI 5.0 GT/s x2 Serial ATA

disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk0s2 [Core Storage Container] 250.14 GB

disk1 - Macintosh HD (Journaled HFS+) 249.78 GB (221.85 GB used)

disk0s3 - Recovery HD (Journaled HFS+) [Recovery] 650 MB

Mounted Volumes:

disk1 - Macintosh HD 249.78 GB (27.67 GB free)

Journaled HFS+

Mount point: /

disk2s2 - T******************s 997.71 GB (13.51 GB free)

Mac OS Extended (Case-sensitive, Journaled)

Disk Image

Mount point: /Volumes/T******************s

Network:

Interface en0: Wi-Fi

802.11 a/b/g/n/ac

Interface en4: Bluetooth PAN

Interface bridge0: Thunderbolt Bridge

iCloud Quota: 1003 MB available

System Software:

macOS Sierra 10.12.6 (16G1510)

Time since boot: About a day

Configuration Files:

File /etc/sysctl.conf exists but not expected

/etc/hosts - Count: 16

Security:

System Status

Gatekeeper Enabled

System Integrity Protection Enabled

Unsigned Files:

Launchd: /Library/LaunchDaemons/com.avast.init.plist

Executable: /Applications/Avast.app/Contents/Backend/hub/init.sh

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.avast.update.plist

Executable: /Applications/Avast.app/Contents/Backend/scripts/update/update.sh

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.avid.AMCUninstaller.plist

Executable: /Library/PrivilegedHelperTools/com.avid.AMCUninstaller

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/PACESupport.plist

Executable: /System/Library/Extensions/PACESupportFamily.kext/Contents/Resources/paceload

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.avast.uninstall.plist

Executable: /Library/Application Support/Avast/autouninstall/autouninstall.sh

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.edb.launchd.postgresql-8.4.plist

Executable: /Library/PostgreSQL/8.4/bin/postmaster -D/Library/PostgreSQL/8.4/data

Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.aviator.agent.plist

Executable: ./UpdateAviator.sh ~/Library/Aviator

Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.skype.skype.shareagent.plist

Executable: /Applications/Skype.app/Contents/Library/LaunchServices/com.skype.skype.shareag ent.bundle/Contents/MacOS/com.skype.skype.shareagent

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.avid.AvidUninstaller.plist

Executable: /Library/PrivilegedHelperTools/com.avid.AvidUninstaller

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchAgents/com.avast.userinit.plist

Executable: /Applications/Avast.app/Contents/Backend/hub/userinit.sh

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

Executable: /Library/PrivilegedHelperTools/com.microsoft.office.licensing.helper

Details: Exact match found in the whitelist - probably OK

32-bit Applications:

49 32-bit apps

Kernel Extensions:

/Applications/Utilities/DiskWarrior.app

DiskWarriorPreview.kext (4.3)

/Library/Application Support/Blackmagic Design/Blackmagic DeckLink/Unsigned Extensions

DeckLink_Driver.kext (10.3.4 - SDK 10.8)

DeckLinkFrameBufferDriver.kext (10.3.4 - SDK 10.8)

Blackmagic_Multibridge_Driver.kext (10.3.4 - SDK 10.8)

BlackmagicIO.kext (10.3.4 - SDK 10.8)

BlackmagicUsbIO.kext (10.3.4 - SDK 10.8)

/Library/Application Support/Blackmagic Design/Blackmagic DeckLink/Unsigned Extensions/DeckLink_Driver.kext/Contents/PlugIns

DeckLink_File.kext (10.3.4 - SDK 10.8)

/Library/Extensions

Dropbox.kext (1.8.8 - SDK 10.11)

/System/Library/Extensions

AvidDX.kext (5.9.0 - SDK 10.8)

PACESupportFamily.kext (5.9.1 - SDK 10.6)

/System/Library/Extensions/PACESupportFamily.kext/Contents/PlugIns

PACESupportLeopard.kext (5.9.1 - SDK 10.4)

PACESupportPanther.kext (5.9.1 - SDK 10.-1)

PACESupportSnowLeopard.kext (5.9.1 - SDK 10.6)

PACESupportTiger.kext (5.9.1 - SDK 10.4)

Startup Items:

ProTec6b Path: /Library/StartupItems/ProTec6b

System Launch Agents:

[Not Loaded] 7 Apple tasks

[Loaded] 164 Apple tasks

[Running] 115 Apple tasks

System Launch Daemons:

[Not Loaded] 40 Apple tasks

[Loaded] 163 Apple tasks

[Running] 115 Apple tasks

[Other] 2 Apple tasks

Launch Agents:

[Running] com.adobe.AdobeCreativeCloud.plist (Adobe Systems, Inc. - installed 2018-09-25)

[Running] com.delicioussafari.DeliciousSafariAgent.plist (Douglas Richardson - installed 2014-09-05)

[Loaded] com.avast.userinit.plist (? 4b9d47d7 - installed 2018-09-29)

[Running] com.adobe.GC.AGM.plist (Adobe Systems, Inc. - installed 2018-09-27)

[Other] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a2 3d420d.plist (Adobe Systems, Inc. - installed 2018-02-15)

[Other] com.google.keystone.agent.plist (Google, Inc. - installed 2018-07-17)

[Not Loaded] com.teamviewer.teamviewer_desktop.plist (TeamViewer GmbH - installed 2018-10-12)

[Not Loaded] com.adobe.AAM.Updater-1.0.plist (? ffb65062 - installed 2018-10-03)

[Running] com.malwarebytes.mbam.frontend.agent.plist (Malwarebytes Corporation - installed 2018-09-14)

[Not Loaded] com.teamviewer.teamviewer.plist (TeamViewer GmbH - installed 2018-10-12)

[Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2018-09-27)

[Running] com.blackmagic-design.DesktopVideoFirmwareUpdater.plist (Blackmagic Design Inc - installed 2014-12-22)

[Other] com.canon.MFManager.plist (? 8a8296d7 - installed 2012-05-22)

Launch Daemons:

[Running] com.malwarebytes.mbam.rtprotection.daemon.plist (Malwarebytes Corporation - installed 2018-09-14)

[Loaded] com.adobe.fpsaud.plist (Adobe Systems, Inc. - installed 2018-09-21)

[Loaded] com.apple.aelwriter.plist (Apple - installed 2014-05-06)

[Loaded] com.microsoft.office.licensing.helper.plist (? 6d8cb30e - installed 2010-08-25)

[Not Loaded] com.apple.installer.cleanupinstaller.plist (Apple - installed 2017-06-28)

[Running] com.malwarebytes.mbam.settings.daemon.plist (Malwarebytes Corporation - installed 2018-09-14)

[Loaded] com.edb.launchd.postgresql-8.4.plist (? 42ee2393 - installed 2014-06-26)

[Loaded] com.adobe.ARMDC.Communicator.plist (Adobe Systems, Inc. - installed 2018-02-15)

[Running] com.adobe.acc.installer.v2.plist (Adobe Systems, Inc. - installed 2018-09-25)

[Running] com.rockysandstudio.WUHelper.plist (Rocky Sand Studio Ltd. - installed 2015-09-20)

[Running] com.blackmagic-design.DesktopVideoHelper.plist (Blackmagic Design Inc - installed 2014-12-22)

[Loaded] com.google.keystone.daemon.plist (Google, Inc. - installed 2018-07-17)

[Loaded] com.adobe.agsservice.plist (Adobe Systems, Inc. - installed 2018-09-27)

[Running] com.blackmagic-design.streaming.BMDStreamingServer.plist (Blackmagic Design Inc - installed 2014-12-22)

[Loaded] com.blackmagic-design.desktopvideo.XPCService.plist (Blackmagic Design Inc - installed 2014-12-22)

[Running] com.apple.qmaster.qmasterd.plist (Apple - installed 2010-08-25)

[Loaded] com.avid.AvidUninstaller.plist (? e7fae1d6 - installed 2017-07-13)

[Loaded] com.avast.init.plist (? fe750b9b - installed 2018-09-29)

[Loaded] com.daisydiskapp.DaisyDiskAdminHelper.plist (? de20d690 - installed 2018-01-04)

[Not Loaded] com.teamviewer.teamviewer_service.plist (TeamViewer GmbH - installed 2018-10-12)

[Loaded] com.teamviewer.Helper.plist (TeamViewer GmbH - installed 2018-01-25)

[Loaded] com.avast.update.plist (? f4a2548f - installed 2018-09-29)

[Loaded] PACESupport.plist (? ab6b5614 - installed 2013-02-01)

[Loaded] com.avast.uninstall.plist (? 1d68eef4 - installed 2018-09-29)

[Loaded] com.malwarebytes.HelperTool.plist (Malwarebytes Corporation - installed 2017-03-04)

[Loaded] com.adobe.ARMDC.SMJobBlessHelper.plist (Adobe Systems, Inc. - installed 2018-02-15)

[Loaded] com.avid.AMCUninstaller.plist (? 9ab338b5 - installed 2017-06-28)

[Running] com.paceap.eden.licensed.plist (? b8fa6e6c - installed 2015-02-04)

User Launch Agents:

[Loaded] com.adobe.AAM.Updater-1.0.plist (? 0 - installed 2018-10-03)

[Loaded] com.dropbox.DropboxMacUpdate.agent.plist (Dropbox, Inc. - installed 2018-08-07)

[Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2018-09-27)

[Not Loaded] org.hola.vpn.plist (? 0 - installed 2017-01-25)

[Loaded] com.aviator.agent.plist (? 0 - installed 2014-05-06)

[Loaded] com.skype.skype.shareagent.plist (? 0 - installed 2017-12-06)

User Login Items:

AdobeResourceSynchronizer (Adobe Systems, Inc. - installed 2018-10-09)

(/Applications/Adobe Acrobat DC/Adobe Acrobat.app/Contents/Helpers/AdobeResourceSynchronizer.app)

Dropbox.app (Dropbox, Inc. - installed 2018-10-11)

(/Applications/Dropbox.app)

AdobeResourceSynchronizer (Adobe Systems, Inc. - installed 2018-10-09)

(/Applications/Adobe Acrobat DC/Adobe Acrobat.app/Contents/Helpers/AdobeResourceSynchronizer.app/Contents/MacOS/Adobe ResourceSynchronizer)

Dropbox (Dropbox, Inc. - installed 2018-10-11)

(/Applications/Dropbox.app/Contents/MacOS/Dropbox)

Internet Plug-ins:

AdobeAAMDetect: 3.0.0.0 (installed 2018-09-25)

FlashPlayer-10.6: 31.0.0.122 (installed 2018-10-09)

QuickTime Plugin: 7.7.3 (installed 2018-07-20)

AdobePDFViewerNPAPI: 17.012.20098 (installed 2018-10-09)

AdobePDFViewer: 19.008.20074 (installed 2018-10-09)

Flash Player: 31.0.0.122 (installed 2018-10-09)

SharePointBrowserPlugin: 14.1.0 (installed 2017-11-04)

nplastpass: 3.1.21 (installed 2014-10-16)

PepperFlashPlayer: 31.0.0.122 (installed 2018-10-09)

Silverlight: 5.1.30514.0 (installed 2014-11-01)

JavaAppletPlugin: 15.0.1 (installed 2014-05-06)

User Internet Plug-ins:

WebEx64: 1.0 (installed 2014-06-28)

Google Earth Web Plug-in: 7.1 (installed 2013-10-07)

Audio Plug-ins:

DVCPROHDAudio: 1.3.2 (installed 2014-05-06)

Safari Extensions:

LastPass.safariextz - LastPass - https://lastpass.com/ (installed 2018-10-10)

3rd Party Preference Panes:

Blackmagic Desktop Video (installed 2014-12-22)

Flash Player (installed 2018-09-21)

Perian (installed 2011-07-23)

Time Machine:

Skip System Files: No

Mobile backups: Yes

Auto backup: Yes

Volumes being backed up:

Macintosh HD: Disk size: 249.78 GB - Disk used: 222.11 GB

Destinations:

1**************p [Network] (Last used)

Total size: 997.71 GB

Total number of backups: 80

Oldest backup: 2018-02-09 00:30:08

Last backup: 2018-10-12 19:53:49

Performance:

System Load: 2.71 (1 min ago) 3.04 (5 min ago) 2.78 (15 min ago)

Nominal I/O speed: 1.42 MB/s

File system: 25.19 seconds

Write speed: 376 MB/s

Read speed: 616 MB/s

CPU Usage:

Type Overall Individual cores

System 8 % 24 % 1 % 13 % 1 % 12 % 1 % 12 % 1 %

User 13 % 39 % 1 % 22 % 1 % 21 % 1 % 21 % 1 %

Idle 78 % 37 % 98 % 65 % 98 % 67 % 98 % 66 % 98 %

Top Processes by CPU:

Process (count) Source CPU Location

com.avast.daemon AVAST Software a.s. 78.36 %

EtreCheckPro Etresoft, Inc. 16.38 %

dbfseventsd (3) ? 12.42 % /Library/DropboxHelperTools/Dropbox_u501

Dropbox (4) Dropbox, Inc. 11.58 %

kernel_task Apple 11.50 %

Top Processes by Memory:

Process (count) Source RAM usage Location

Google Chrome Helper (32) Google, Inc. 4.17 GB

kernel_task Apple 1.42 GB

EtreCheckPro Etresoft, Inc. 603 MB

Finder Apple 583 MB

mdworker (24) Apple 573 MB

Top Processes by Network Use:

Process Source Input Output Location

kernel_task Apple 843 MB 979 MB

Dropbox Dropbox, Inc. 2 MB 2 MB

apsd Apple 786 KB 1 MB

mDNSResponder Apple 1 MB 343 KB

netbiosd Apple 131 KB 15 KB

Virtual Memory Information:

Available RAM 5.43 GB

Free RAM 18 MB

Used RAM 10.57 GB

Cached files 5.41 GB

Swap Used 43 MB

Software Installs (past 30 days):

Name Version Install Date

Safari 12.0 2018-09-18

Adobe Acrobat DC (18.011.20063) 18.011.20063 2018-09-20

Gatekeeper Configuration Data 155 2018-09-24

XProtectPlistConfigData 2100 2018-09-27

Adobe Acrobat DC (19.008.20071) 19.008.20071 2018-10-03

LastPass 4.1.0 2018-10-04

Adobe Flash Player 31.0.0.122 2018-10-09

Adobe Pepper Flash Player 31.0.0.122 2018-10-09

Adobe Acrobat DC (19.008.20074) 19.008.20074 2018-10-09

Keynote 8.0 2018-10-10

Clean up:

/Library/LaunchAgents/com.canon.MFManager.plist

/Applications/Canon Utilities/ImageBrowser EX/ExtApp/MFManager.app/Contents/MacOS/MFManager

Executable not found

~/Library/LaunchAgents/org.hola.vpn.plist

HolaVPN.app

Executable not found

/Applications/Avast.app/Contents/Backend/launch/com.avast.account-sync.plist

@AV_BASE_DIR/utils/com.avast.account-sync

Executable not found

Diagnostics Information (past 7 days):

2018-10-12 22:10:15 postgres Crash

/Library/PostgreSQL/8.4/bin/postgres

2018-10-12 22:05:29 RTProtectionDaemon.app CPU

/Library/Application Support/Malwarebytes/*/Engine.bundle/Contents/PlugIns/RTProtectionDaemon.app

2018-10-12 21:57:32 Avast.app CPU

/Applications/Avast.app

2018-10-12 03:47:31 backupd CPU

/System/Library/CoreServices/backupd.bundle/Contents/Resources/backupd

2018-10-10 13:59:52 CalendarAgent Crash

/System/Library/PrivateFrameworks/CalendarAgent.framework/Executables/CalendarAg ent

2018-10-08 01:22:51 Google Chrome.app CPU

/Applications/Google Chrome.app

2018-10-07 00:18:52 CEPHtmlEngine.app Crash

/Applications/Adobe Illustrator CC 2018/Adobe Illustrator.app/Contents/MacOS/CEPHtmlEngine/CEPHtmlEngine.app

End of report



Oct 13, 2018 8:33 PM in response to Eric Root

Point noted and I will take your advice, thank you. I am really due for low level reformat and a new OS install.


What is a normal amount of information to be sent out by kernel_task. I noticed my Mac Pro is sending out data, but not nearly as much as the time machine was? My Mac Pro is sending 4.35 GB of data, and receiving 1.76 GB, that seems like a lot. I ran little snitch last night and looked at the map of all of the packets going back and forth and there was nothing suspicious. All within the US and Europe with legitimate companies (google, adobe, etc.).


Is it possible that our modem was hacked for Crypto mining?

Oct 13, 2018 7:09 PM in response to mike welch

I would uninstall Avast. It tends to interfere with the computer's operation while providing minimal to no benefit unless you work with Windows files. Most long time posters recommend not using antivirus software or cleaning software such as CleanMyMac.


Avast


Avast Un-install

Try running this program in your normal user account, then copy and paste the output in a reply. The program was created by etresoft, a frequent contributor. Please use copy and paste as screen shots can be hard to read. Click “Share Report” button in the toolbar, select “Copy Report” and then paste into a reply. This will show what is running on your computer. No personal information is shown. You can run the report for free at least once, but if you run it several times, at some point it will ask you to pay a license fee.

Etrecheck – System Information

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Activity monitor sending out massive amounts of data

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.