I have an iMac (early 2010) running 10.7.2 but the problem has been seen on 10.6.x also. The symptom is simple, one of my 2 cores is sitting at 100% utilization with the Java process responsible for the excessive usage.

What have I done to troubleshoot?

  • Reboot - The java process simply restarts and the same condition is seen.
  • Kill the Java process - As with a reboot.
  • Uninstall and reinstall Java - Soon after installing Java the CPU is back at 100%.
  • Using ps "process id" I can see that it is launchd spawning the process and that the command used to start the process is:

    java -Djava.awt.headless=true -jar /tmp/ics29586
  • The ics29586 file is an 11mb binary file.

  • Deleted the ics29586 file - File is recreated at next process restart and same condition is seen
  • Created a new user account, rebooted and logged in as the new user - Same condition is seen.
  • Played with Java settings and restarted the process after each change - Same condition seen.
  • Complete machine rebuild - Soon after installing Java the CPU is back at 100%.

So, has anyone either got the the answer for what is causing it and how to fix it, or some advice on ways of further troubleshooting the issue?

In response to some of the comments asking for more info:

  • I'm not running crashplan.
  • I couldn't work out how to get Activity Monitor to show me open files, but googling suggested LSOF was a good match for what you wanted to know. It showed no open files:

    Deep-Desk:LaunchAgents photo$ sudo lsof -c java
    Deep-Desk:LaunchAgents photo$ 
  • There are 220 ports open for the Java process at present

  • The only file of interest in either the LaunchDaemons or LaunchAgents folders is:

    -rw-r--r--   1 root  wheel   568B 10 Mar  2011 com.microsoft.office.licensing.helper.plist     
  • Everything else is either com.apple or has a date well after the problem first manifested. By way of a test I have renamed the com.microsoft file to old.com.microsoft but it made no difference. I also moved the file completely out the LaunchDaemons directory and that made no difference either, the process still respawns, hangs around not doing much for a few minutes, then goes out of control and consumes all the CPU on 1 core.

  • 1
    What open files does the java process have? In the Activity Monitor, click the process, choose "inspect", and look at "Open Files and Ports". Edit that into your question, it will help us know what the process is actually doing.
    – Josh
    Jan 6, 2012 at 15:04
  • 1
    What are the contents of the system-wide LaunchAgents/LaunchDaemons folders? Anything whose name doesn't start with com.apple and has e.g. a modification date different from all others? Jan 6, 2012 at 15:18
  • 1
    Are you using CrashPlan? Some users reported trouble with it in a topic on another site Jan 6, 2012 at 15:22
  • Did you restart the system after moving away the com.microsoft.office.licensing.helper.plist file? What happens when you run launchctl unload -w com.microsoft.office.licensing.helper? Jan 7, 2012 at 12:36
  • I didn't but have now to no affect. Jan 7, 2012 at 13:22

3 Answers 3


I don't know either, but here's how to find out more

In cases of entirely unknown binaries, strings(1) is often helpful in getting a hint about what the file might be

strings /tmp/ics29586 | less

Have a look through the output and see if it's anything familiar.

Failing that, find out which launchd job it is being launched from:

launchctl list|awk '{id=$3; print "### " id; system("launchctl list " id)}'|awk '/^###/ {id=$2} /.*ics29586.*/ {print id}'

This should output one or more job tags in the form of (for example) com.apple.scrod (and a few errors, which you can ignore).

Once you have the job tag(s), get the launchd config for a job by running:

launchctl list com.apple.scrod    # insert your tag instead

This (and the tag itself, which often contains an internet domain name in reverse notation) should give you some more information about what this process is. Feel free to post it here if you need further help.

Update: Forgot to mention this, but since it's a jar file, you can copy it somewhere and unzip it (jar files are really just zip files) and have a look at what sort of Java classes are in there.

  • 1
    +1 -> Had the same issue. Personally I ended up removing Java and use it only in Parallel on an XP VM... I never seem to need Java on Lion, anyway, so why leave it installed? Jan 6, 2012 at 19:51
  • The strings output showed a whole heap of info, a sample of which is here: org/apache/commons/io/output/ByteArrayOutputStream.class org/lwjgl/NondirectBufferWrapper.class org/xbill/DNS/GPOSRecord.class net/freehaven/tor/control/TorControlConnection$ReplyLine.class org/mozilla/classfile/ClassFileWriter.class org/mozilla/javascript/Script.class; org/bouncycastle/asn1/BERFactory.class redstone/xmlrpc/serializers/json/IntrospectingSerializer.class org/codehaus/jackson/map/JsonMappingException.class org/joda/time/chrono/ISOChronology$Stub.class Jan 7, 2012 at 9:52
  • Also the attempt to find the job launching the process was unsuccessful: Deep-Desk:LaunchAgents photo$ launchctl list|awk '{id=$3; print "### " id; system("launchctl list " id)}'|awk '/^###/ {id=$2} /.*ics29586.*/ {print id}' launchctl list returned unknown response launchctl list returned unknown response launchctl list returned unknown response Deep-Desk:LaunchAgents photo$ Jan 7, 2012 at 9:56
  • So I also unzipped the JAR as you suggested and can see some the file structure. There is a bit coin miner in there called DiabloMiner.cl and something called klog which worries me Jan 7, 2012 at 18:04

If you drop into terminal, you can type ps -ef | grep java

You'll see all the processes with "java" in their descriptions and details on the process which launched each of them.

In my case, CrashPlan is doing a restore and the client app is Java-based. I see:

0    85     1   0 10:35PM ??        98:28.26 /usr/bin/java -Dapp=**CrashPlanService** -Xmn10m -Xms15m -Xmx512m -DappBaseName=**CrashPlan** -Djava.awt.headless=true -...

Once you know who is using it, you can decide if it's something you want to remove or not...


Got it. After help from two friends, I can say the following.

  • in /etc/crontab there was an entry:

    */5 * * * * root /usr/bin/adjkerntz

    -in /usr/bin there was a program called adjkerntz. I believe that this a genuine name for a valid binary in some unix/linux implementations, but not OSX. It also has different permissions to every other executable in /us/bin:

    -rwxr-xr-x    1 root   wheel     74688 18 Sep 00:26 addftinfo
    -rwx------    1 root   wheel   2841604 18 Sep 20:49 adjkerntz
    -rwxr-xr-x    1 root   wheel    223312 18 Sep 00:26 afconvert
  • I hashed out the cron entry and killed the java process and hey presto no further issues.

  • I also deleted adjkerntz and on the suggestion of my excellent friends, I did the following to make sure it doesn't reoccur:

    sh-3.2# touch adjkerntz
    sh-3.2# chflags schg adjkerntz
  • This makes the file immutable and even root can't modify that file.

This does leave the question of how this got there in the first place, but I guess the Internet can be a dangerous place. Thanks to all who have contributed their time to helping me get to the bottom of this.

  • 1
  • I haven't installed the software specified but I am by no means innocent of such things. Karma's a bitch aint it. Jan 8, 2012 at 0:36
  • 1
    Ouch :) Poor implementation though, if it was only using one core ;-) Jan 8, 2012 at 2:52
  • @ingmar HaHa ;) Jan 8, 2012 at 8:31
  • Thanks for documenting this program and what it's doing / how to track it. Most people are keeping java off their systems, but with legitimate tools like CrashPlan using it, some choose to still be open to running code from the internet.
    – bmike
    Dec 28, 2012 at 16:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .