Best spy/malware and performance util for 10.5.x/Intel?
 

Greetings,

I have a Macbook Pro running 10.5.1. My Macbook is nowhere near as fast as it used to be. I am thinking that it has spy/malware, perhaps a virus.

Can anyone recommend a good system utility for OSX that takes care of spy/malware and viruses?

I have a strong Unix and Linux background and I have tried analyzing the Macbook's sluggish performance by looking at process trees. I have run the fix permissions process on the disk drive as well. It seems like much of the sluggishness is due to disk I/O.

When opening any program I watch the bouncing program icon for as much as two minutes while waiting for a browser window or application (iPhoto, Pages, etc) to start.

I know in the Winbloze environment there are super-utilities that optimize the disk volumes, cleanup and optimize the registries and streamline the OS environment to maximize system performance. Does such a thing exist for OSX? If so, can anyone suggest such a utility?

Thanks!

You may have a problem with your disk or with the filesystem on it.
Do "Verify Disk" in Disk Utility - does it indicate any problems?

This can sometimes be from a problem with your prebinding (although I'm a bit confused about the current state of prebinding in OS X, especially based on this thread started by hayne).

But explicitly updating your prebinding should not be necessary any more in OS X. Did you interrupt your OS X Install in some way? Especially during the "optimizing" portion of the install?

For what it's worth, a command to force update your prebinding is:
sudo update_prebinding -root / -force

Trevor

I did not interupt the install process. As I stated in my OP the performance was great and it deteriorated over time. So, it was working well at one time.

I bit the bullet and bought iDefrag and am running it on the system volume now in "online" mode which is not as good as booting it from the bootable CD image so it can do low-level defrag operations.

I had run the verify process on the system volume. I also installed the free-ware app "Onyx" so run a smart lookup on the disk and a verify and it was all okay.

Hopefully it is just a heavily fragged partition.

Unlikely. Disk fragmentation is way down the list of things to check. Have you even tried a fresh user account to see if that is faster?
Have you checked Console to see if any messages give an indication of what is slowing you down?
Have you looked at Activity Monitor?

I would not advise the use of iDefrag. At all. If you must use it, make sure that you have a reliable up-to-date backup before using it, every time you use it.

I also agree with benwiggy that a fragmented hard drive is an extremely unlikely explanation for a two-minute wait to launch applications. That sounds like a systemic problem of some kind.

Did you try the update_prebinding command I mentioned above?

Trevor

Assumptions are evil. What have you done to determine this?

What have you analyzed, exactly? What results did you expect, what results did you get?

Permissions have nothing to do with performance.

Determined how? You keep telling us what the problem is, yet haven't told us how you got to these conclusions.

There. That's a start. But it doesn't explain your conclusions.

Seeing as how we don't have a registry, no. Mac OS X also has built-in file-level defragmentation, so it's rare that most users need anything else. Also, what does "streamline the OS environment" mean, exactly?

You're going to have to be way more explicit before anyone can give good advice.

Stop doing this. It's stupid and makes the whole forum look silly.

Well, I don't really think I am assuming much. While I am not running a kernel debugger and stepping through every operation one at a time to look for a problem I am relying on over a year with this particular Macbook and 27 years of computer experience ranging from VAX/VMS and every commercial variant of UNIX on desktops through very large SMPs as a basis for being able to determine that things on this Macbook are not quite as snappy as they used to be.

To expect a certain metric it would have been necessary to quantify the performance of the Macbook prior to seeing a slowdown. This was not done, so to do a comparative in this case would be totally subjective which is why I went with the gut perception of things being much slower. I did run 'top' and OSX's activity monitor in an attempt to identify a specific application that was stuck in i/o wait or was consuming sigificant processor or memory resources. Nothing looked out of the ordinary. Unfortunately, the startup phase is where things are worst and I have been unable to spawn top or activity monitor to see what was going on during that post login 'rainbow wheel' time. Admittedly, OSX is an island unto its own and is not as straight-forward as other Unicies when it comes to system processes.


I have read in several places on the net that OSX performance can be negatively impacted by permissions on the system volume and that the Disk Utility needs to be run where the permissions can be verified and fixed if necessary, is that not true? I also read that performance can be impacted by bad permissions or fragmented in the fonts libraries. Is that BS as well?

Sigh... I don't need to be Caroll Shelby to know when my Mustang is acting sluggish. In this case I did not pull my Macbook out of the box and decide it was not as fast and the advertising said it would be. I have over a year with this Macbook in the field and I know that booting takes longer, logging in takes longer before the desktop appears and that after all of the Desktop icons appear and the system appears ready to use pointing at any icon or system menu bar within the first couple minutes will turn the pointer into the rainbow wheel of doom and I have to go back to paper sudoku until the Macbook decides it is ready. During these times, with an ear placed to the left of the touchpad, if you are quiet, you can hear a 2.5-in Seagate SATA drive thrashing its little @$$ off.

I probably covered that above...

Well, it means that I am deferring to the possibility that there may be something unique to OSX that is atypical to other Unix variants. That it may have some central DB or index vital to system operation that may need to be optimized. Something like the SMIT env in AIX for example. As for OSX having built-in file level defrag, from what I can tell in several places on the net that is subject to debate.

If there is no cenrtalized system database or index necessary for system operation in OSX then bully for me (us). I simply asked in general terms in case there was such a thing that needed to be checked or repaired.

Hopefully the information above is detailed enough.

Would that be more or less silly that you being patronizing and berating someone seeking help in a help forum?

Yes. The command took roughly 30 secs to complete with no stdout or stderr.

One odd example of slowness. I open Finder and select Applications. I click the side scrollbar to move down the listing and I get the rainbow wheel while populates the window with date/time stamps, sizes and details.

This is an example of how widespread and systemic the slowness is. Starting applications, scrolling in Finder windows, operation dialog boxes opening and becoming responsive (print, pdf, etc).

If you wish to see what it is doing, you can add the -debug flag.

Have you installed any system hacks, "haxies", enhancements, input manager plugins (for Safari, Mail, iChat, etc.), third party menubar items, or anything of that type?

Of course, one option is to do an "Archive and Install", which will preserve your users, third party installed apps, and settings, but will give you a shiny new OS install (preserving your previous system in an archive).

Trevor

No system hacks I can think of. Some 3rd party apps like Firefox and Thunderbird, Office 2008, VMWare Fusion. Only thing that would come close to something 'from the wild' would be OnyX that I installed today in an attempt to check and optimize things.

Reinstall? Ugh. At the risk of stoking the bellyfire of a previous respondent a reinstall sounds alot like the follies of the 'other' operating system. I'll do it if that is the only way, it is just very counter-intuitive to most Unix variants.

Is VMWare running when you experience your computer running slowly?

@Mikey-San & jeffwsi

Before this turns into a argument (it somewhat already is),

Repairing permissions does nothing (if anything at all):
http://www.macworld.com/article/5222...rmissions.html
http://www.unsanity.org/archives/000410.php
But it doesn't really hurt to do it anyway.

You could try booting from the System Restore disk, and run "Repair Disk" which does a very different set of repairs to the filesystem, not the permissions of a few files.

Fonts rarely cause problems, unless you specifically work with them alot.

As for a central DB the system uses, the closest thing might be the filesystem journal, or maybe even the Spotlight DB, but I don't think these are absolutely necessary for the Mac to function. Spotlight can be turned off, and journaling is an optional feature of the filesystem. If something was wrong with the filesystem's journal, the Repair Disk command should be able to detect and fix it.

Is there anything in the logs that might explain why your Mac is running slow? You can use the Console.app to easily browse through the various logs, or view them in /Library/Logs, ~/Library/Logs, and /var/log. The system.log might have something interesting.

Do you have any network drives mounted? Or do you have any user accounts whose credentials are on a networked server?
Or in more general terms, does any part of your config depend on being connected to a network?
Even if you don't think you have any network dependencies, I'd strongly recommend physically disconnecting from all networks (including turning off Airport) and then reboot and then see if the problem is there.

Do similar troubleshooting steps in other directions - e.g. the standard one of logging in as a different user to see if the problem is there.

Come on, let's not turn this into a resume contest. It's not going to get anyone anywhere useful. :)

The assumption I was referring to wasn't that you said your computer felt slow--obviously, it's not performing as well as you are used to. You're talking about viruses and malware, and that's the big leap I was talking about. There's nothing wrong with then asking how you've gotten to that idea. How else are we supposed to help if we don't know what's really going on?

Okay, you ran top and didn't see anything chewing CPU or memory. That's good information. What'd you see for memory usage? If you run `top -d`, what kind of disk read/write stats do you see? Might be helpful to you/us.

Just because you're used to something else doesn't mean Mac OS X isn't straightforward. You just might not know it under the hood as well as other Unixes. ;)

No, it's not true. Don't believe the hype, basically. There's a crapload of voodoo on the Internet regarding permissions repair, almost entirely by people who don't really understand how the system works. I always ask those people, "Can you describe how a non-standard permission bit can slow down an application, but not stop it from working entirely?" I can't think of any Cocoa API, for example, that would get slower and not stop working entirely with a weird permission.

Here's a great article:

http://unsanity.org/archives/000410.php

This one, I don't have a direct answer for. A corrupt font may cause unpredictable behaviour in an application. That's the basic rule. A corrupt or unoptimized font cache might cause a performance issue during, say, font lookup--but this is really just a guess, and I couldn't say with any semblance of determination.

First, this is way better than "it's disk I/O". It at least describes what you're seeing in detail, rather than telling us what you think the problem is. You might very well be right, but when you jump straight to the conclusion, you should expect people to ask how you got there, because none of us know what you've done or how good you are at diagnosing Mac OS X. Furthermore, the more you tell us you've done, the more we can skip. :)

So. A beachball simply means that the GUI is being blocked by some operation. Could indeed be a disk read or write operation (usually the case). But so far, I still don't hear any evidence that points to a virus. What third-party software do you have installed?

Totally did. Appreciated, sir.

Where'd you see it up for debate, out of curiosity? Would like to see.

For what it's worth, it's definitely in the Darwin kernel sources. I think the specific implementation is different from its original inception in Panther, but these days it's handled by the hfs_relocate() function, which gets called by hfs_vnop_open() when opening a file if the following conditions are met:

- System has been up for 3 minutes
- File has not been modified in the last 60 seconds
- File is at least 20 MB
- File has 8 or more extents

Under these conditions, the file gets relocated to contiguous space, if available on the disk.

Understood. I was only addressing the specific questions instead of the broader one you were obviously asking as well, and that was indeed my mistake.

It was good, thanks. Should've been the first post! :)

Sorry to snap, but I see Mac zealots take "clever" shots at MS so much around here that it's basically a pet peeve at this point. (Ask around.) I simply think this forum and its inhabitants are better than cheap shots.

No. I only start it on the rare occasion I need to run it.

The slowness will appear during the accoount login/desktop initialization phase, before userspace apps are started.

I do not have any network dependent accounts and do not rely on any network user authentication (LDAP, etc). The laptop is a standalone system and not a part of a larger Apple network of machines.

I experience this slowness with networking disabled, on battery or plugged to AC, at home or work or even in the middle of the desert many miles away from anything. :D

The most common cause of slowdowns among my clients is too many icons on the desktop. If you have a lot of icons on your desktop, move them elsewhere. You'll be surprised at the speed improvements.

Most common causes of system performance going down is the following

Software configuration

No more free HD space (for virtual memory)

Filesystem issues (fsck or diskwarrior can fix)

Hardware failure (bad ram or a HD on its way out)

OS corruption (it happens, even in OS X)

There are other factors that can happen too, but a lot of those can be environment specific so I won't bother listing them. However, what I listed above are the most common problems I see every day with OS X and Macs, and I admin 6,000 Macs to give you an idea of where I am getting this from.

First place I would look is in the system.log and see if any errors are happening. If you are getting like an I/O error, then your HD is having issues reading/writing data and that could be software (corrupted file system) or hardware (the drive is starting to fail). That was an example.

Is 16 too many?

OSX 10.5.2 with 2GB DDR2 667 RAM and 2Ghz Core2 Duo

18.9GB free on System Volume

Is there a way to run fsck during boot phase before / volume is mounted read-write, similar to other Unices? Usually running fsck on a mounted volume is not advisable.

Running a SMART lookup on the disk drive lists no problems or hardware/block errors.

What would be an indicator for this? Failed fsck routine?

I am seeing an odd error (odd to me anyways) during the login phase:
May 27 13:41:13 macbook-pro-15 SecurityAgent [679]: NSExceptionHandler has recorded the following exception:
NSRangeException -- *** -[NSCFArray objectAtIndex:]: index (0) beyond bounds (0) Stack Trace: 0x3719a 0x93c7a0fb 0x90ab202b <snip> (29 more hex string values)

booting into single user mode you can run fsck, by holding down cmd + S right at power on will boot you into SUM. Run fsck from there and see if it gets any errors in doing so.

Nah, 16 isn't a lot of icons. Usually, I see people with 50+ and then things get slow. (I think this bug was fixed in Leopard. Anyone know?)

Is this after a restart/boot, or does it also happen after a regular log out?

The error you see in the console log after login may be accompanied by a crash. Is there a crash log for Security Agent listed in Console.app? What login items do you have listed in System Preferences > Accounts?

What third-party software do you have installed?

Does this slowdown happen with a new, fresh user account?

Sounds OK to me. Usually you should leave at least 3-5GB free, or stuff slows down a lot, and the disk starts to churn even more.
Yep, it's called Single User Mode. Hold down Command+S immediately when you start your computer, before the Apple appears. After a few moments, a terminal-like screen should appear.

Then you can type in something like
A bit more detailed info on this is here:
http://support.apple.com/kb/TS1417

Although SMART can't catch all disk errors, it's still a good sign.
Usually when fsck fails, there's definitely something wrong with the filesystem. From past experiences on this board, filesystem corruption is a usually a Bad Thing™.


Looks like other people are having this error in a bunch of other programs, so maybe it's just from a line of debugging code?
http://www.google.com/search?q=Secur...wing+exception
Doesn't seem to be causing

Jeff, is it one, or the other, or both? We're talking very different things here.

The first thing I would do in trying to diagnose a beachball (http://en.wikipedia.org/wiki/Spinning_wait_cursor) problem is to look at the system.log and console.log where messages are usually time-stamped. Any messages at the time of the problem?

Next try the following:
- log in as a different (preferrably freshly-created) user. Does the problem exist there?
- startup in Safe Mode by holding down the Shift key after you hear the startup chime. Does the problem exist there?

If the above doesn't give any clues as to the nature of the problem, you could bring in the big guns - the Apple Developer tools ("Xcode Tools", which are on one of the DVDs that came with your Mac) includes "Instruments" which is a set of performance monitoring tools. Using those tools should show you what is happening.

The application is attempting to retrieve an object from an array. The array has N items in it, numbered 0 to (N - 1). The application asked for the object at position that was either less than 0 or greater than (N - 1). This raises an exception and the system logs the error automatically. (So in a sense, it's debugging information, but only because the application actually did something it shouldn't have.)

Edit: In this specific case, it looks like the array was empty, and the app tried to query it for an object. Oops.

Before going that far, there's always Activity Monitor, which can sample a running application.

It shouldn't be... Look into the possibilities that tlarkin suggests.

jeffwsi, you've now had four requests to create a brand new user and tell us if the slowdowns continue there (five if you include this post). Could you please check that out and let us know?

Also, you mention an error message on startup, and that error message is nothing to worry about. I'm curious, though, do you have an error message in your logs when you try to launch an application and it takes two minutes?

OK, if you have an objection to doing an Archive and Install, that's fine--keep troubleshooting. But if it takes you days to troubleshoot this, versus 30-40 minutes to Archive and Install, I know which choice I would make. YMMV.

Trevor

I agree completely - except for one thing:
If someone is dedicated enough to troubleshoot the problem to the point of figuring out what the cause was, there is the possibility that they might learn that the problem stemmed from something that they did (e.g. installing haxie XYZ, or removing file PDQ) and therefore they will know enough to avoid doing the same thing in the future.

Yes, that is a good point.

Trevor

Typo alert:

My defragmentation post is too old for me to edit, but I just re-read it and realized I meant to type LESS THAN 20 MB. Not more. Sorry if this caused any confusion for anyone.

Sorry for the thread bump, too.

Since your initial post was regarding spyware, MacScan will get rid of tracking cookies (I run MacScan every few days and find at least a dozen of them in that amount of time). It's supposed to find most spyware, including Trojan Horses, keyloggers, etc. Over the few months I've used it, it only showed tracking cookies in the display of what it found.

As far as speed overall, My Imac seemed to benefit most from disabling most fonts. Read this article: http://katzwebdesign.wordpress.com/2...worked-for-me/

I have also eliminated unneeded languages using Monolingual and reduced the size of programs using Xslimmer, both of which may have helped speed. Try any or all and see if they help.

In my honest opinion (and I believe the opinion of many others on this forum), MacScan is a complete waste of money (my condolences to you wala). Scanning software will always find tracking cookies (provided that you actually browse the net). However, you can easily delete these cookies yourself ("Reset Safari" or "Clear Private Data") - you don't need MacScan or any other software to do it for you. Note too that those tracking cookies are only as dangerous as the websites you visit. If you are concerned about the types of cookies that are finding their way onto your computer, you can change your privacy settings in your browsers to something less permissive.

I seriously doubt this has any impact on speed. As far as I know, neither eliminating localizations nor eliminating excess code in a universal binary actually reduces the amount of bytes loaded into memory. Since you have the same amount of code in memory before and after "slimming", I doubt anything is going to perform any faster. Perhaps load times might be marginally improved, but I doubt that would be perceptible. Someone enlighten me if I'm wrong.

if you think your problems are disk related, then i suggest you boot from the leopard install dvd and run the disk repair facility. after that you can also try booting in safe mode because i think that does some sort of repair/defrag automatically as well.
-marc

Funny that this thread just died on the vine without a resolution...
Looking for the sequel. Anyone know what the resolution was to this?

Thanks