Mac freezing, possible virus?

Question

I am running Yosemite and experiencing very nasty freezing issues. Once I was able to recover from by reinstalling osx and second time (few months later) reinstalling alone didn't help, but also downgrading user from Admin rights did.

Here are the symptoms:

• freezing applications, wheel mouse icon, occurring every 30 seconds or so and lasting about the same time.
• CPU usage is near zero. Idle ~97%
• ran opensnoop, but it didn't correlate to frezing
• once freeze occurs, 'top' any Activity Monotor do not show any activity - they freeze too. But, after freeze ends, I can see the spike in CPU activity. Activity Monitor replays the past events in a fast-forward kind of way, at 10x speed. But there is no way to tell what activity transpired. System was frozen.
• it feels like 1/4 of one core of cpu is actually being used for OS itself.
• no hardware issues were discovered with AHT.
• Safe mode had no impact.

In the screenshot bellow, there is a blimp in CPU usage. That's the freeze. Sometimes they happen for longer, sometimes shorter duration.

I know it's relatively vague problem description, but I would like to hear some theories on what this could be. And if it happens again, how to actually pin point to the process that is causing it.

Answer 1

You can check which processes are using the most time interval in the system calls:

sudo fs_usage | grep -v 0.0000

^{See: How do I debug an out-of-control “kernel_task” process?}

In case your macOS experienced out-of-space scenario, some services can be still in a freeze mode (causing some freeze timeouts) and they need manual unpause by the following command:

kill -CONT -1

Otherwise check whether clean restart helps with anything.

If you had any unexpected shutdown after freeze, it's good to check for the shutdown code.

If won't help, if you experience another freeze, hit ⌘-⌥-Control-Shift-, (Cmd-Opt-Ctrl-Shift-Period), this will trigger sysdiagnose process which will quickly gather system-wide diagnostic information helpful in investigating system memory/performance issues (will appear in /var/tmp). If you're technical person, you can consider uncompressing the generated file and analyse the logs, or contact Apple support if they can help you.

If you believe you've a virus, just install antivirus (such as Sophos Home) to exclude that. But having antivirus, can cause another extra freezes as well, so it's up to you.