RecentSD has been eating up tons of memory and machine has been crashing for no reason.

[emgilg01]

Any thoughts would be appreciated. Here is the etrecheck report:

Thank you.

EtreCheck version: 5.0.1 (5014)

Report generated: 2018-10-18 12:23:05

Download EtreCheck from https://etrecheck.com

Runtime: 1:23

Performance: Excellent

Sandbox: Enabled

Full drive access: Disabled


Problem: Computer is restarting

Description:

Recentsd is eating up tons of application.

Computer restarts.


Major Issues:

Anything that appears on this list needs immediate attention.


System Integrity Protection disabled - System Integrity Protection is disabled. This computer is at risk of malware infection.

More than one antivirus app - This machine has multiple antivirus apps installed.


Minor Issues:

These issues do not need immediate attention but they may indicate future problems.


Configuration profiles present - This machine has configuration profiles. These are sometimes used by adware and malware.

Heavy RAM usage - This machine is using a large amount of RAM.

Unsigned files - There are unsigned software files installed. They appear to be legitimate but should be reviewed.

System modifications - There are a large number of system modifications running in the background.

32-bit Apps - This machine has 32-bits apps that may have problems in the future.


Hardware Information:

iMac (27-inch, Late 2013)

iMac Model: iMac14,2

1 4 GHz Intel Core i7 (i7-4790K) CPU: 4-core

32 GB RAM - At maximum

BANK 0/DIMM0 - 8 GB DDR3 1866 ok

BANK 1/DIMM0 - 8 GB DDR3 1866 ok

BANK 0/DIMM1 - 8 GB DDR3 1866 ok

BANK 1/DIMM1 - 8 GB DDR3 1866 ok


Video Information:

Intel HD Graphics 4600 - VRAM: 1536 MB

C27F390 1920 x 1080


Drives:

disk0 - TOSHIBA MD04ACA400 4.00 TB (Mechanical - 7200 RPM)

Internal SATA 6 Gigabit Serial ATA

disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk0s2 - H******1 (Journaled HFS+) 1.03 TB (768.26 GB used)

disk0s3 - H******2 (Journaled HFS+) 2.97 TB (2.88 TB used)


disk1 - Samsung SSD 840 EVO 1TB 1.00 TB (Solid State - TRIM: Yes)

Internal SATA 6 Gigabit Serial ATA

disk1s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk1s2 [Core Storage Container] 999.35 GB

disk3 - B************7 (Journaled HFS+) 998.97 GB (761.38 GB used)

disk1s3 - Recovery HD (Journaled HFS+) [Recovery] 650 MB


disk2 - ST4000DX001-1CE168 4.00 TB (Mechanical - 5900 RPM)

Internal SATA 6 Gigabit Serial ATA

disk2s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk2s2 - H******1 (Journaled HFS+) 2.00 TB (1.72 TB used)

disk2s3 - H******3 (Journaled HFS+) 275.00 GB (185.87 GB used)

disk2s4 - H******2 (Journaled HFS+) 1.72 TB (1.05 TB used)


Mounted Volumes:

disk0s2 - H******1 1.03 TB (262.05 GB free)

Journaled HFS+

Mount point: /Volumes/H******1


disk0s3 - H******2 2.97 TB (85.34 GB free)

Journaled HFS+

Mount point: /Volumes/H******2


disk2s2 - H******1 2.00 TB (282.43 GB free)

Journaled HFS+

Mount point: /Volumes/H******1


disk2s3 - H******3 275.00 GB (89.13 GB free)

Journaled HFS+

Mount point: /Volumes/H******3


disk2s4 - H******2 1.72 TB (678.54 GB free)

Journaled HFS+

Mount point: /Volumes/H******2


disk3 - B************7 998.97 GB (237.33 GB free)

Journaled HFS+

Mount point: /


Network:

Interface en1: Wi-Fi



Interface en0: Ethernet

Interface serial1: Built-in Serial Port (1)

Interface en5: Ethernet Adaptor (en5)

Interface en4: iPhone

Interface en3: iPad

Interface en2: Bluetooth PAN


System Software:

macOS Sierra 10.12.6 (16G1510)

Time since boot: About 2 hours


Configuration Files:

/etc/hosts - Count: 16


Configuration Profiles:

This computer has configuration profiles installed.


Security:

System Status
Gatekeeper Enabled
System Integrity Protection enabled (Custom Configuration)

Unsigned Files:

Launchd: ~/Library/LaunchAgents/com.shirtpocket.backupbytime.plist

Executable: /usr/bin/osascript '~/Library/Application Support/SuperDuper!/Scheduled Copies/Backup by Time.scpt'

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchAgents/com.oracle.java.Java-Updater.plist

Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater -bgcheck

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchAgents/org.chromium.chromoting.plist

Executable: /Library/PrivilegedHelperTools/org.chromium.chromoting.me2me.sh --run-from-launchd

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.cps.ppbed.plist

Executable: /Applications/ppbe/ppbed start-launchd

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist

Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Helper-Tool

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/org.pqrs.Karabiner.load.plist

Executable: /Library/Application Support/org.pqrs/Karabiner/startup.sh start

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/org.virtualbox.startup.plist

Executable: /Library/Application Support/VirtualBox/LaunchDaemons/VirtualBoxStartup.sh restart

Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.macpaw.CleanMyMac3.Scheduler.plist

Executable: '~/Library/Application Support/CleanMyMac 3/CleanMyMac 3 Scheduler.app' --args -scheduled

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

Executable: /Library/PrivilegedHelperTools/com.microsoft.office.licensing.helper

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/com.oracle.java.Java-Updater.plist

Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater -bgcheck

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.cpsww.ppupsd.plist

Executable: /Library/Services/ppupsd

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/com.oracle.java.Helper-Tool.plist

Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Helper-Tool

Details: Exact match found in the whitelist - probably OK


32-bit Applications:

80 32-bit apps


Kernel Extensions:

/Applications/Audio/SoundTap.app

SoundTapVirtualAudioDevice.kext (NCH Software, 1.0.2 - SDK 10.6)


/Applications/Tunnelblick.app

tap.kext (20141104 (Tunnelblick build 4813))

tun.kext (20141104 (Tunnelblick build 4813))


/Applications/VMware Fusion.app

VMwareVMCI.kext (VMware, Inc., 8.5.7)

vmioplug.kext (VMware, Inc., 8.5.7)

vmnet.kext (VMware, Inc., 8.5.7)

vmmon.kext (VMware, Inc., 8.5.7)


/Library/Application Support/Logitech.localized/Logitech Options.localized

LogiMgrDriver.kext (Logitech Inc., 6.90.1 - SDK 10.12)


/Library/Application Support/VirtualBox

VBoxDrv.kext (Oracle America, Inc., 4.3.28)

VBoxNetAdp.kext (Oracle America, Inc., 4.3.28)

VBoxNetFlt.kext (Oracle America, Inc., 4.3.28)

VBoxUSB.kext (Oracle America, Inc., 4.3.28)


/Library/Application Support/org.pqrs/Karabiner

Karabiner.signed.kext (Fumihiko Takayama, 10.22.0 - SDK 10.12)


/Library/Extensions

Soundflower.kext (MATT INGALLS, 2.0b2 - SDK 10.10)

LogitechHIDDevices.kext (Logitech Inc., 3.9.5 - SDK 10.8)

LogitechUnifying.kext (Logitech Inc., 1.3.5 - SDK 10.8)

AppleIntelE1000e.kext (3.2.4.2 - SDK 10.6)

EnergyDriver.kext (Intel Corporation Apps, 2.0 - SDK 10.13)

PdaNetDrv.kext (JUNE FABRICS TECHNOLOGY INC., 1.0.64 - SDK 10.9)

SoundGrid.kext (Waves Inc, 9.7.99)

kudsnetgear.kext (KCodes Corporation, 2.13 - SDK 10.9)

FakeSMC_ACPISensors.kext (6.25-332-gf3a8525c.1758 - SDK 10.8)

FakeSMC_CPUSensors.kext (6.25-332-gf3a8525c.1758 - SDK 10.8)

FakeSMC_GPUSensors.kext (6.25-332-gf3a8525c.1758 - SDK 10.8)

FakeSMC_LPCSensors.kext (6.25-332-gf3a8525c.1758 - SDK 10.8)

FakeSMC.kext (6.25-332-gf3a8525c.1758 - SDK 10.8)

FakePCIID.kext (1.3.6 - SDK 10.6)

FakePCIID_XHCIMux.kext (1.3.6 - SDK 10.6)


System Launch Agents:

[Not Loaded] 8 Apple tasks
[Loaded] 167 Apple tasks
[Running] 52 Apple tasks
[Killed] 59 Apple tasks

System Launch Daemons:

[Not Loaded] 38 Apple tasks
[Loaded] 171 Apple tasks
[Running] 72 Apple tasks
[Killed] 36 Apple tasks
[Other] 2 Apple tasks

Launch Agents:

[Loaded] com.oracle.java.Java-Updater.plist (? 806b7ac9 - installed 2018-10-18)
[Not Loaded] com.adobe.AdobeCreativeCloud.plist (Adobe Systems, Inc. - installed 2017-06-14)
[Running] com.bjango.istatmenus.agent.plist (Bjango Pty Ltd - installed 2018-02-19)
[Not Loaded] com.Logitech.Control Center.Daemon.plist (? 209c949 - installed 2016-10-04)
[Running] com.privateinternetaccess.osx.PIA-VPN.plist (London Trust Media Incorporated - installed 2018-09-03)
[Running] com.adobe.GC.AGM.plist (Adobe Systems, Inc. - installed 2018-10-17)
[Running] com.bjango.istatmenus.status.plist (Bjango Pty Ltd - installed 2018-02-19)
[Not Loaded] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist (Adobe Systems, Inc. - installed 2018-02-15)
[Not Loaded] com.adobe.AAM.Updater-1.0.plist (? ffb65062 - installed 2017-06-14)
[Running] com.malwarebytes.mbam.frontend.agent.plist (Malwarebytes Corporation - installed 2018-09-14)
[Running] org.chromium.chromoting.plist (? 81572da9 - installed 2018-05-31)
[Running] com.logitech.manager.daemon.plist (Logitech Inc. - installed 2018-05-17)
[Running] com.waves.daemon.SoundGrid.DawNodeService.plist (Waves Inc - installed 2017-05-09)
[Not Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Systems, Inc. - installed 2018-10-17)

Launch Daemons:

[Running] com.cps.ppbed.plist (? 854bb7fc - installed 2017-09-11)
[Running] com.malwarebytes.mbam.rtprotection.daemon.plist (Malwarebytes Corporation - installed 2018-09-14)
[Loaded] com.adobe.fpsaud.plist (Adobe Systems, Inc. - installed 2018-09-21)
[Loaded] com.microsoft.office.licensing.helper.plist (? 6d8cb30e - installed 2010-08-25)
[Loaded] com.tclementdev.timemachineeditor.scheduler.plist (Thomas CLEMENT - installed 2018-07-04)
[Not Loaded] org.pqrs.Karabiner.load.plist (? 44439558 - installed 2016-10-31)
[Running] com.malwarebytes.mbam.settings.daemon.plist (Malwarebytes Corporation - installed 2018-09-14)
[Loaded] com.adobe.ARMDC.Communicator.plist (Adobe Systems, Inc. - installed 2018-02-15)
[Not Loaded] org.virtualbox.startup.plist (? 700b9385 - installed 2017-09-13)
[Not Loaded] com.waves.daemon.SoundGrid.DisableNetworkRxPolling.plist (Apple - installed 2018-06-28)
[Running] com.bjango.istatmenus.daemon.plist (Bjango Pty Ltd - installed 2018-02-19)
[Loaded] com.adobe.agsservice.plist (Adobe Systems, Inc. - installed 2018-10-17)
[Running] com.cpsww.ppupsd.plist (? d1c774db - installed 2016-12-09)
[Running] com.jft.PdaNetMac.plist (JUNE FABRICS TECHNOLOGY INC. - installed 2015-10-29)
[Loaded] net.tunnelblick.tunnelblick.tunnelblickd.plist (Jonathan Bullard - installed 2017-08-11)
[Loaded] com.tonymacx86.InstallHelper.plist (TONYMACX86 LLC - installed 2017-06-02)
[Loaded] com.oracle.java.Helper-Tool.plist (? e3fefdd2 - installed 2018-10-18)
[Loaded] com.macpaw.CleanMyMac3.Agent.plist (MacPaw Inc. - installed 2018-03-28)
[Loaded] com.bjango.istatmenus.installerhelper.plist (Bjango Pty Ltd - installed 2018-02-19)
[Loaded] com.adobe.ARMDC.SMJobBlessHelper.plist (Adobe Systems, Inc. - installed 2018-02-15)
[Running] com.adobe.adobeupdatedaemon.plist (Adobe Systems, Inc. - installed 2017-06-14)

User Launch Agents:

[Loaded] com.dropbox.DropboxMacUpdate.agent.plist (G7HH3F8CAK - installed 2018-08-22)
[Loaded] com.macpaw.CleanMyMac3.Scheduler.plist (? 0 - installed 2018-03-07)
[Loaded] com.shirtpocket.backupbytime.plist (? 0 - installed 2018-10-18)
[Running] com.amazon.music.plist (94KV3E626L - installed 2017-07-13)
[Loaded] com.google.keystone.agent.plist (EQHXZ8M8AV - installed 2018-10-11)
[Loaded] com.skype.skype.shareagent.plist (Skype Communications S.a.r.l - installed 2017-09-11)

User Login Items:

MemoryCleanHelper (App Store - installed 2018-08-02)

(/Applications/Memory Clean.app/Contents/Library/LoginItems/MemoryCleanHelper.app)

CleanMyMac 3 Menu (MacPaw Inc. - installed 2018-02-09)

(/Applications/CleanMyMac 3.app/Contents/MacOS/CleanMyMac 3 Menu.app/Contents/MacOS/CleanMyMac 3 Menu)

iTunesHelper (Apple - installed 2018-09-24)

(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app/Contents/MacOS/iTunesHelper)

Backup and Sync (Google, Inc. - installed 2018-10-17)

(/Applications/Backup and Sync.app/Contents/MacOS/Backup and Sync)

Dropbox (Dropbox, Inc. - installed 2018-10-17)

(/Applications/Dropbox.app/Contents/MacOS/Dropbox)

MailButler 2 (Fabian Jaeger - installed 2018-09-24)

(/Applications/MailButler 2.app/Contents/MacOS/MailButler)

Activity Monitor (Apple - installed 2017-09-24)

(/Applications/Utilities/Activity Monitor.app/Contents/MacOS/Activity Monitor)

Karabiner (Fumihiko Takayama - installed 2017-08-15)

(/Applications/Karabiner.app/Contents/MacOS/Karabiner)

SuperDuper! (Bruce Lacey - installed 2018-05-29)

(/Applications/SuperDuper!.app/Contents/MacOS/SuperDuper!)


Internet Plug-ins:

AdobeAAMDetect: 3.0.0.0 (installed 2017-06-14)

FlashPlayer-10.6: 31.0.0.122 (installed 2018-10-17)

AdobePDFViewerNPAPI: 17.012.20098 (installed 2018-09-19)

Silverlight: 5.1.50901.0 (installed 2018-05-02)

QuickTime Plugin: 7.7.3 (installed 2018-08-16)

Flash Player: 31.0.0.122 (installed 2018-10-17)

npwViewer_turn: (installed 2016-08-18)

PepperFlashPlayer: 31.0.0.122 (installed 2018-10-09)

AdobePDFViewer: 18.011.20063 (installed 2018-09-19)

SharePointBrowserPlugin: 14.1.3 (installed 2017-06-05)

npDDRia: 0.0.14.5 (installed 2016-08-18)

SmartCamFinder: SmartCamFinder 1.0.0.0 (installed 2014-12-08)

JavaAppletPlugin: Java 8 Update 191 build 12 (installed 2018-10-18)


3rd Party Preference Panes:

Flash Player (installed 2018-09-21)

Java (installed 2018-10-06)

Logitech Control Center (installed 2018-05-02)

Logi Options Launcher (installed 2018-06-19)


Time Machine:

Time Machine information not available without Full Drive Access.


Performance:

System Load: 2.65 (1 min ago) 2.65 (5 min ago) 2.72 (15 min ago)

Nominal I/O speed: 1.30 MB/s

File system: 17.35 seconds

Write speed: 484 MB/s

Read speed: 514 MB/s


CPU Usage:

Type Overall Individual cores
System 6 % 12 % 1 % 10 % 1 % 10 % 1 % 10 % 1 %
User 15 % 31 % 1 % 27 % 1 % 30 % 1 % 29 % 1 %
Idle 79 % 57 % 99 % 63 % 98 % 60 % 98 % 61 % 98 %

Top Processes by CPU:

Process (count) Source CPU Location
recentsd Apple 99.54 %
Other processes ? 41.29 %
EtreCheck App Store 15.96 %
VLC VideoLAN 6.05 %
iconservicesagent Apple 1.26 %

Top Processes by Memory:

Process (count) Source RAM usage Location
recentsd Apple 17.88 GB
EtreCheck App Store 465 MB
Google Chrome Google, Inc. 180 MB
Messages Apple 95 MB
pia_nw London Trust Media Incorporated 85 MB

Top Processes by Network Use:

Process Source Input Output Location
mDNSResponder Apple 993 KB 891 KB
Dropbox Dropbox, Inc. 277 KB 1 MB
apsd Apple 14 KB 42 KB
netbiosd Apple 22 KB 18 KB
helpd Apple 12 KB 10 KB

Virtual Memory Information:

Available RAM 1.62 GB
Free RAM 23 MB
Used RAM 30.38 GB
Cached files 1.60 GB
Swap Used 211 MB

Software Installs (past 30 days):

Name Version Install Date
Adobe Acrobat Reader DC (18.011.20063) 2018-09-19
Duplicate Detective 1.99.1 2018-09-25
Evernote 7.5.2 2018-10-03
PDFScanner 1.13.1 2018-10-03
Adobe Flash Player 2018-10-09
Adobe Pepper Flash Player 2018-10-09
WhatsApp 0.3.1072 2018-10-16
Firmware Update Tool 2018-10-18
Java 8 Update 191 2018-10-18
EtreCheck 5.0.1 2018-10-18

Diagnostics Information (past 7 days):

Directory /Library/Logs/DiagnosticReports is not accessible without Full Drive Access.


End of report

 

[P1LGRIM]

Likely candidates :

More than one antivirus app - This machine has multiple antivirus apps installed.

Configuration profiles present - This machine has configuration profiles. These are sometimes used by adware and malware.

/Applications/VMware Fusion.app
VMwareVMCI.kext (VMware, Inc., 8.5.7)
vmioplug.kext (VMware, Inc., 8.5.7)
vmnet.kext (VMware, Inc., 8.5.7)
vmmon.kext (VMware, Inc., 8.5.7)

/Library/Application Support/VirtualBox
VBoxDrv.kext (Oracle America, Inc., 4.3.28)
VBoxNetAdp.kext (Oracle America, Inc., 4.3.28)
VBoxNetFlt.kext (Oracle America, Inc., 4.3.28)
VBoxUSB.kext (Oracle America, Inc., 4.3.28)