My 2015 MacBook running Mojave has been acting strange lately, especially whilst browsing. Sometimes Safari will freeze up, or reload a page out of the blue. I can feel my computer struggling, so I'm quick to open Activity Monitor to try and see what's going on. Several times now, I've noticed a root process named 'phonetism' at the top, but it usually vanishes before I can read anything about it. Today, I finally managed to get a screenshot of it.

Screenshot taken shortly before 'phonetism' disappears

I can't find anything in the activity monitor about the process after it disappears, but I did check the console, where the only results are from ReportCrash, and look like this: SenderMachUUID is partially censored because I'm not sure whether it's harmless thing to put out there or not. However, these crash reports don't appear to have been written at times where I've noticed the CPU problems.

I've tried searching the web for anything related to this, but I'm at a complete loss. Any help or general ideas would be greatly appreciated! Thanks in advance.

  • Check what other processes are running as root & see if there is a naming pattern of 'real but obscure words of a similar category that aren't often used in real life'. I think you may have a variant of this malware - apple.stackexchange.com/questions/361687/… - it's been seen using people's names, plant & animal genera, etc. – Tetsujin Aug 9 '19 at 16:51
  • Tying these all together to try keep a track on the name variations - apple.stackexchange.com/questions/364276/… & apple.stackexchange.com/questions/362613/… – Tetsujin Aug 9 '19 at 16:58
  • You can keep a terminal window open, ready for when you see this happening, then execute this command: lsof -R +c40 and it will list all open files, including that process. The parameter -R will show if it has any parent PID who started it, so you can see the path on disk from that strange process, and also who/what other process started it, also along with its path on disk. And delete or investigate it deeper. (the parameter +c40 is to extend the first column of the listing up to 40 chars) – Prado Aug 9 '19 at 19:01

You must log in to answer this question.

Browse other questions tagged .