EtreCheck report - need help please

[JanetL]

Hello,
I had a pop window for "low memory" and found an answer one of you gave to run EtreCheck. I have done so and now I am wondering what should I remove. Concerned about unassigned files. I appreciate any advice you can give me. Thank you. JanetL

Here is the report:

EtreCheck version: 5.5.4 (5106)
Report generated: 2020-04-29 13:58:15
Download EtreCheck from EtreCheck
Runtime: 4:09
Performance: Good
Sandbox: Enabled
Full drive access: Disabled

Problem: Other problem
Description:
computer is low on memory

Major Issues:
Anything that appears on this list needs immediate attention.
No Time Machine backup - Time Machine backup not found.
Unsigned files - There are unsigned software files installed that could be adware and should be reviewed.

Minor Issues:
These issues do not need immediate attention but they may indicate future problems or opportunities for improvement.
Clean up - There are orphan files that could be removed.
Unsigned files - There are unsigned software files installed. Apple has said that unsigned software will not run by default in a future version of the operating system.
32-bit Apps - This machine has 32-bits apps will not work on macOS 10.15 "Catalina".
Limited drive access - More information may be available with Full Drive Access.
Sharing enabled - This machine has sharing services enabled that could be a security risk.

Hardware Information:
iMac (27-inch, Late 2013)
iMac Model: iMac14,2
3.5 GHz Quad-Core Intel Core i7 (i7-4771) CPU: 4-core
8 RAM - Upgradeable
BANK 0/DIMM0 - 4 GB DDR3 1600
BANK 1/DIMM0 - 4 GB DDR3 1600
BANK 0/DIMM1 - Empty
BANK 1/DIMM1 - Empty

Video Information:
NVIDIA GeForce GTX 775M - VRAM: 2 GB
iMac 2560 x 1440

Drives:
disk0 - APPLE HDD ST1000DM003 1.00 TB (Mechanical - 7200 RPM)
Internal SATA 3 Gigabit Serial ATA
disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB
disk0s2 [APFS Container] 1000.00 GB
disk1 [APFS Virtual drive] 1000.00 GB (Shared by 5 volumes)
disk1s1 - M************ Data (APFS) [APFS Virtual drive] (Shared - 130.04 GB used)
disk1s2 - Preboot (APFS) [APFS Preboot] (Shared)
disk1s3 - Recovery (APFS) [Recovery] (Shared)
disk1s4 - VM (APFS) [APFS VM] (Shared - 1 MB used)
disk1s5 - Macintosh HD (APFS) (Shared - 11.15 GB used)

Mounted Volumes:
disk1s1 - M************ Data [APFS Virtual drive]
1000.00 GB (Shared - 130.04 GB used, 860.87 GB available, 857.98 GB free)
APFS
Mount point: /System/Volumes/Data

disk1s4 - VM [APFS VM]
1000.00 GB (Shared - 1 MB used, 857.98 GB free)
APFS
Mount point: /private/var/vm

disk1s5 - Macintosh HD
1000.00 GB (Shared - 11.15 GB used, 860.87 GB available, 857.98 GB free)
APFS
Mount point: /
Read-only: Yes

Network:
Interface Bluetooth-Modem: Bluetooth DUN
Interface en0: Ethernet
Interface en1: Wi-Fi
802.11 a/b/g/n/ac
Interface en4: Bluetooth PAN
Interface bridge0: Thunderbolt Bridge

Printer sharing: Enabled

System Software:
macOS Catalina 10.15.4 (19E287)
Time since boot: Less than an hour

Notifications:
Notifications not available without Full Drive Access.

Security:
System Status
Gatekeeper: Enabled
System Integrity Protection: Enabled

Antivirus software: Apple and Trusteer

Printer sharing: Enabled

Unsigned Files:
Launchd: ~/Library/LaunchAgents/com.cubase.plist
Executable: ~/Library/Application Support/.baudline/cog
Details: Executable file is hidden - possibly adware

Launchd: /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist
Executable: /Library/PrivilegedHelperTools/com.microsoft.office.licensing.helper
Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.cpmchlpr.cpmchlpr.plist
Executable: ~/Library/Application Support/cpmc/cpmchlpr.app/Contents/MacOS/cpmchlpr
Details: Domain name invalid - possibly adware

Launchd: ~/Library/LaunchAgents/com.google.keystone.xpcservice.plist
Executable: ~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode xpchost
Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.teamviewer.teamviewer_service.plist
Executable: /Applications/TeamViewer.app/Contents/MacOS/TeamViewer_Service -Module Full
Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.nchsoftware.photopad.schedule.LikeSurvey.plist
Executable: /Applications/PhotoPad.app/Contents/MacOS/PhotoPad -scheduled_launch -surveysched
Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.audion.plist
Executable: ~/Library/Application Support/.audacity/ardour
Details: Executable file is hidden - possibly adware

Launchd: /Library/LaunchDaemons/com.teamviewer.Helper.plist
Executable: /Library/PrivilegedHelperTools/com.teamviewer.Helper
Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchAgents/com.teamviewer.teamviewer_desktop.plist
Executable: /Applications/TeamViewer.app/Contents/Helpers/TeamViewer_Desktop -RunAsAgent YES -Module Full
Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.storelegacy.Siri.plist
Executable: ~/Library/Application Support/.oscpd/AssetCache
Details: Executable file is hidden - possibly adware

Launchd: ~/Library/LaunchAgents/com.google.keystone.agent.plist
Executable: ~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchAgents/com.teamviewer.teamviewer.plist
Executable: /Applications/TeamViewer.app/Contents/MacOS/TeamViewer -RunAsAgent YES
Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.LaterAgent.silhouette.plist
Executable: ~/Library/Application Support/.nfcd/seld
Details: Domain name invalid - possibly adware

Plugin: /Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin
Plugin: /Library/Internet Plug-Ins/nplastpass.plugin
Plugin: /Library/Internet Plug-Ins/Silverlight.plugin

Apps: 7

32-bit Applications:
28 32-bit apps

System Launch Agents:
[Not Loaded] 16 Apple tasks
[Loaded] 174 Apple tasks
[Running] 123 Apple tasks

System Launch Daemons:
[Not Loaded] 35 Apple tasks
[Loaded] 175 Apple tasks
[Running] 126 Apple tasks
[Other] One Apple task

Launch Agents:
[Not Loaded] com.adobe.AAM.Updater-1.0.plist (Adobe Systems, Inc. - installed 2019-01-30)
[Other] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist (Adobe Systems, Inc. - installed 2020-02-11)
[Running] com.adobe.AdobeCreativeCloud.plist (Adobe Systems, Inc. - installed 2020-03-27)
[Running] com.adobe.GC.AGM.plist (Adobe Systems, Inc. - installed 2020-04-22)
[Not Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2020-04-22)
[Loaded] com.microsoft.update.agent.plist (Microsoft Corporation - installed 2020-04-21)
[Not Loaded] com.teamviewer.teamviewer.plist (? aa311aa9 - installed 2015-02-13)
[Not Loaded] com.teamviewer.teamviewer_desktop.plist (? d4765397 - installed 2015-02-13)
[Loaded] com.trusteer.rapport.rapportd.plist (Trusteer LTD - installed 2019-10-27)

Launch Daemons:
[Loaded] com.adobe.ARMDC.Communicator.plist (Adobe Systems, Inc. - installed 2020-02-07)
[Loaded] com.adobe.ARMDC.SMJobBlessHelper.plist (Adobe Systems, Inc. - installed 2020-02-07)
[Running] com.adobe.acc.installer.v2.plist (Adobe Systems, Inc. - installed 2020-03-27)
[Running] com.adobe.agsservice.plist (Adobe Systems, Inc. - installed 2020-04-22)
[Loaded] com.adobe.fpsaud.plist (Adobe Systems, Inc. - installed 2020-03-27)
[Loaded] com.apple.installer.osmessagetracing.plist (Apple - installed 2019-10-28)
[Loaded] com.microsoft.OneDriveUpdaterDaemon.plist (Microsoft Corporation - installed 2018-04-26)
[Loaded] com.microsoft.autoupdate.helper.plist (Microsoft Corporation - installed 2020-04-21)
[Loaded] com.microsoft.office.licensing.helper.plist (? 6d8cb30e - installed 2014-02-26)
[Loaded] com.microsoft.office.licensingV2.helper.plist (Microsoft Corporation - installed 2018-04-10)
[Loaded] com.microsoft.teams.TeamsUpdaterDaemon.plist (Microsoft Corporation - installed 2020-04-15)
[Loaded] com.teamviewer.Helper.plist (? 7ca2e004 - installed 2015-04-08)
[Not Loaded] com.teamviewer.teamviewer_service.plist (? b485a599 - installed 2015-02-13)
[Running] com.trusteer.rooks.rooksd.plist (Trusteer LTD - installed 2019-10-27)

User Launch Agents:
[Running] com.LaterAgent.silhouette.plist (? 0 - installed 2020-01-14)
[Loaded] com.adobe.AAM.Updater-1.0.plist (Adobe Systems, Inc. - installed 2015-05-10)
[Loaded] com.adobe.ccxprocess.plist (Apple - installed 2020-04-09)
[Running] com.audion.plist (? 0 - installed 2019-10-26)
[Other] com.cpmchlpr.cpmchlpr.plist (? 0 - installed 2019-10-10)
[Loaded] com.cubase.plist (? 0 - installed 2019-10-26)
[Loaded] com.google.keystone.agent.plist (? 0 - installed 2020-03-12)
[Loaded] com.google.keystone.xpcservice.plist (? 0 - installed 2020-03-12)
[Loaded] com.nchsoftware.photopad.schedule.LikeSurvey.plist (? 0 - installed 2018-09-25)
[Loaded] com.skype.skype.shareagent.plist (Skype Communications S.a.r.l - installed 2017-11-04)
[Running] com.storelegacy.Siri.plist (? 0 - installed 2020-04-01)

User Login Items:
[Not Loaded] LaunchHelper (App Store - installed 2019-02-05)
Modern Login Item
/Applications/FreeChat for Facebook Messenger.app/Contents/Library/LoginItems/LaunchHelper.app

[Not Loaded] MenuTabHelper (App Store - installed 2016-08-12)
Modern Login Item
/Applications/MenuTab for Facebook.app/Contents/Library/LoginItems/MenuTabHelper.app

[Not Loaded] Launcher Disabler (Microsoft Corporation - installed 2018-04-26)
Modern Login Item
/Applications/OneDrive.app/Contents/Library/LoginItems/Launcher Disabler.app

[Not Loaded] OneDrive Launcher (Microsoft Corporation - installed 2018-04-26)
Modern Login Item
/Applications/OneDrive.app/Contents/Library/LoginItems/OneDrive Launcher.app

Internet Plug-ins:
AdobeAAMDetect: 3.0.0.0 (Adobe Systems, Inc. - installed 2020-03-27)
FlashPlayer-10.6: 32.0.0.363 (Adobe Systems, Inc. - installed 2020-04-14)
AdobePDFViewerNPAPI: 17.012.20098 (Adobe Systems, Inc. - installed 2020-03-18)
AdobePDFViewer: 20.006.20042 (Adobe Systems, Inc. - installed 2020-03-18)
ZoomUsPlugIn: 4.6.10 (20041.0408) (Zoom Video Communications, Inc. - installed 2020-04-09)
Flash Player: 32.0.0.363 (Adobe Systems, Inc. - installed 2020-04-14)
SharePointBrowserPlugin: 14.7.7 (? - installed 2017-10-14)
nplastpass: 3.1.21 (? - installed 2014-08-14)
PepperFlashPlayer: 32.0.0.363 (Adobe Systems, Inc. - installed 2020-04-14)
Silverlight: 5.1.40728.0 (? - installed 2015-10-27)

User Internet Plug-ins:
User Internet Plug-ins need Full Drive Access

User Audio Plug-ins:
User Audio Plug-ins need Full Drive Access

User iTunes Plug-ins:
User iTunes Plug-ins need Full Drive Access

Safari Extensions:
Rapport Content Blocker (Trusteer LTD - installed 2019-11-25)
Rapport Extension (Trusteer LTD - installed 2019-11-25)

3rd Party Preference Panes:
Flash Player (Adobe Systems, Inc. - installed 2020-03-27)
Trusteer Endpoint Protection (Trusteer LTD - installed 2019-11-25)

Time Machine:
Time Machine Not Configured!

Performance:
System Load: 1.89 (1 min ago) 1.59 (5 min ago) 1.58 (15 min ago)
Nominal I/O speed: 2.19 MB/s
File system: 36.30 seconds
Write speed: 110 MB/s
Read speed: 167 MB/s

CPU Usage Snapshot:
Type Overall
System: 3 %
User: 4 %
Idle: 94 %

Top Processes Snapshot by CPU:
Process (count) CPU (Source - Location)
Other processes 34.25 % (?)
accountsd 8.07 % (Apple)
EtreCheck 4.02 % (App Store)
Google Chrome 1.26 % (Google, Inc.)
trustd 0.73 % (Apple)

Top Processes Snapshot by Memory:
Process (count) RAM usage (Source - Location)
EtreCheck 528 MB (App Store)
Google Chrome 169 MB (Google, Inc.)
Teams 141 MB (Microsoft Corporation)
App Store 114 MB (Apple)
Finder 99 MB (Apple)

Top Processes Snapshot by Network Use:
Process (count) Input / Output (Source - Location)
Other processes 62 MB / 48 MB (?)
Teams 29 KB / 14 KB (Microsoft Corporation)
SystemUIServer 0 B / 64 B (Apple)
mdworker_shared 0 B / 0 B (Apple)
spindump_agent 0 B / 0 B (Apple)

Virtual Memory Information:
Physical RAM: 8 GB

Free RAM: 1004 MB
Used RAM: 5.67 GB
Cached files: 1.35 GB

Available RAM: 2.33 GB
Swap Used: 0 B

Software Installs (past 30 days):
Install Date Name (Version)
2020-04-01 Numbers (10.0)
2020-04-01 Pages (10.0)
2020-04-01 Keynote (10.0)
2020-04-08 macOS Catalina 10.15.4 Supplemental Update
2020-04-08 MRTConfigData (1.58)
2020-04-09 Zoom (4.6.20041.0408)
2020-04-14 Adobe Flash Player
2020-04-14 Adobe Pepper Flash Player
2020-04-14 Microsoft Word for Mac
2020-04-14 Microsoft OneNote for Mac
2020-04-14 Microsoft Excel for Mac
2020-04-14 Microsoft PowerPoint for Mac
2020-04-14 Microsoft Outlook for Mac
2020-04-15 Microsoft Teams (1.00.308663)
2020-04-16 XProtectPlistConfigData (2119)
2020-04-21 Microsoft AutoUpdate
2020-04-29 EtreCheck (5.5.4)

Clean up:
~/Library/LaunchAgents/com.cpmchlpr.cpmchlpr.plist
~/Library/Application Support/cpmc/cpmchlpr.app/Contents/MacOS/cpmchlpr
Executable not found

Diagnostics Information (past 7-30 days):
Directory /Library/Logs/DiagnosticReports is not accessible.
Enable Full Drive Access to see more information.

End of report

 

[Raz0rEdge]

No need to go through all this to resolve the issue. You have 8GB of memory with 2 empty slots, you should grab a 16 GB upgrade kit with 2 8GB sticks from OWC (for example) and insert it. The 27" is easy to upgrade, just remove the screws holding the brackets at the bottom of the screen, and then insert the 2 memory sticks and power up.

 

[MacInWin]

And before you even invest in that, I would run Activity Monitor (Applications/Utilities) and look at the Memory tab to see if memory is under any pressure. If it's green, you are good. You can click on the title bar on "Memory" to sort the processes running by how much memory they are using to see if there is one that is hogging the system for any reason. Reboots normally clear up those kinds of runaway situations, too.

 

[JanetL]

Hi thank, Activity Monitor is green. Will keep you posted. I was worried that it was a malware!

- - - Updated - - -

Thanks I appreciate the advice.
So no need to worry about the unassigned apps.

 

[Lifeisabeach]

What is "Trusteer"? Your report lists it as antivirus software. If you aren't required to use it by, say your employer for some reason, you should purge it.

There's this:

Launchd: ~/Library/LaunchAgents/com.cubase.plist
Executable: ~/Library/Application Support/.baudline/cog
Details: Executable file is hidden - possibly adware

I don't know what it is, but it's flagged as possible adware.

Launchd: ~/Library/LaunchAgents/com.cpmchlpr.cpmchlpr.plist
Executable: ~/Library/Application Support/cpmc/cpmchlpr.app/Contents/MacOS/cpmchlpr
Details: Domain name invalid - possibly adware

Another possible adware.

Launchd: ~/Library/LaunchAgents/com.audion.plist
Executable: ~/Library/Application Support/.audacity/ardour
Details: Executable file is hidden - possibly adware

I'm not sure what to make of this. Audion was an app that Panic used to make but was discontinued long ago. Do you or did you use this?

Launchd: ~/Library/LaunchAgents/com.storelegacy.Siri.plist
Executable: ~/Library/Application Support/.oscpd/AssetCache
Details: Executable file is hidden - possibly adware

I'm not sure what to make of this either.

Launchd: ~/Library/LaunchAgents/com.LaterAgent.silhouette.plist
Executable: ~/Library/Application Support/.nfcd/seld
Details: Domain name invalid - possibly adware

Yet one more. What you should do is download and run DetectX Swift and see what it finds. It's proving to be really good at rooting out adware.

 

[JanetL]

Hi
Thanks for the info. Trustee seems to be Rapportd (IMB security) I never asked for and never used it. And I keep deleted it and it keeps coming back.
Will try the DetectX Swift and keep you posted.
Appreciate it.
Stay well.

 

[Lifeisabeach]

Hi
Thanks for the info. Trustee seems to be Rapportd (IMB security) I never asked for and never used it. And I keep deleted it and it keeps coming back.
Will try the DetectX Swift and keep you posted.
Appreciate it.
Stay well.

According to a discussion on Apple's forums, some banks use Trusteer Rapport and may have been installed if you downloaded something from a bank you use. The best thing to is re-download the installer if that's the case with you and see if there is an uninstaller process. If not, we can help you with this.
How to uninstall rapportd - Apple Community