5

I have Catalina 10.15.6

There is something running in the background at /System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd that takes 50-90% of the CPU and 1Gig of memory. I fear that it's a virus. I saw that there is a similar question there, but there was no feedback. I tried to remove it with

I run malwarebyte: it told me that there is no malware on the machine

override rwxr-xr-x root/wheel restricted,compressed for accountsd? y rm: accountsd: Operation not permitted I'm affraid of breaking somethin if I go further

I tried to follow the following points of the comments/answers

  • I deleted all the account in `system preferences > Internet accounts'

  • I rebooted 2x the machine in safe mode by holding shift

Despite those steps nothing happened: the fan is still full on an almost all ressources of the CPU taken

in <user>/Library/Keychains, there is the following list:

login.keychain
login.keychain-db
login_renamed_1.keychain-db
metadata.keychain
metadata.keychain-db
metadata.keychain-db.C07BBB57-D5A7-435B-9CAD-1AE65E5FBCC5

Which one should I delete?

What finally solved the problem:

So what finally solved the problem was to reset the NVRAM (Non-Volatile Random Access Memory) with the command alt+cmd+p+r upon starting

thanks for hints below

Improve this question
6
  • Please do not include answers in the question, it makes it difficult to find them in the future. Can you post it as an answer to one of the questions linked at the top instead (assuming it's not there already)?
    – nohillside ♦
    Commented Sep 28, 2020 at 8:10
  • @nohillside. Thanks for the comment. That's what I already did about 2 days ago in the first one ("apple.stackexchange.com/questions/182059/…). Unfortunately, there are already many answers to this questions (and didn't find among them a suitable answer). I'm suspecting that the cause of the problem that caused the question (I think in 2015) is a different one than the present on (in Catallina).
    – ecjb
    Commented Sep 28, 2020 at 8:55
  • Bottom line: I don't know what you think but I'm not conviced that closing this question as a duplicate was the wisest thing to do as I could have edited the title concerning catalina and posted my answer as an answer (I tried but couldn't and assumed that it was du to the question being a duplicate)
    – ecjb
    Commented Sep 28, 2020 at 8:56
  • Fair point, I've reopened the question here.
    – nohillside ♦
    Commented Sep 28, 2020 at 8:57
  • @nohillside. Many thanks. I posted the answer under this question and edited the title accordingly
    – ecjb
    Commented Sep 28, 2020 at 9:02

5 Answers 5

Reset to default
3

On Catalina, anything in /System is mounted in a read-only, protected volume, and so almost certainly is part of the OS and not malware.

Secondly, ramping up CPU or memory is usually not indicative of malware. Malware generally tries to hide itself, not advertise. It can be poorly written, of course. (As can the OS.)

There are many reports of MacOS processes going a bit wild every now and again: sometimes they may need to do a bit of work and then calm down; other times they may suggest a problem which needs to be fixed.

Why is the accountsd process eating so much CPU?

Accountsd using lots of CPU constantly

Process "accountsd" has over 500% CPU usage

This blog suggests that you may need to delete a local keychain folder inside <user>/Library/Keychains (which may cause some passwords to be forgotten).

https://waal70blog.wordpress.com/2019/12/16/accountsd-and-secd-high-cpu-usage-on-catalina/

An alternative offered is just to reboot to Safe Mode (hold Shift at restart), then restart normally.

Improve this answer
2

I would get the 10.15.7 update which brings you to build 19H2. (And apply the combo installer if you see this issue on 19H2 if you upgraded incrementally)

On Mojave, Apple has released a supplemental update that addresses this as they didn’t have a .7 ready to release - I would make a backup and then apply all updates either on Catalina or Mojave as we’ve seen great results with both in the past 24 hours at work with no issues new and old issues fixed well.

If you’re interested in testing or analysis, these two authors are superb at describing the issue and fix.

Improve this answer
2

Q: What is accountsd?

A: Process to find some links at data with your ID

Q: Why it happens?

A: Your OS want to make indexes with your ID and so on with all data on your data-drives

Q: How can I fix it?

A: Just add to ignore folders/drives at Spotlight (tool to index data at Mac OS)

Also consider patching your OS if it’s Mojave or Catalina

  1. Navigate to:

    • System preferences
    • Spotlight
    • Privacy

  2. Add a folder with your projects to list (in my case node_modules folder used a lot of indexes)

Example of Privacy window at Mac OS Catalina 10.15.7

Mac OS Catalina 10.15.7 Privacy window

Improve this answer
5
  • Which folders am I supposed to add?
    – benwiggy
    Commented Oct 3, 2020 at 16:30
  • @benwiggy it depends on you, in developer case it looks like that I need add folders that contains references to development. Some users can add a whole data-device to ignore list, but it will lose a some cases with search through Spotlight
    – Marat Zimnurov
    Commented Oct 3, 2020 at 17:13
  • +1 thanks for sharing. Knowing what works to relieve the trigger on this daemon will be very useful as people struggle with cpu waste.
    – bmike ♦
    Commented Oct 3, 2020 at 17:15
  • So, I've got to test every folder to see what works? And then I can't search in it? That's not ideal.
    – benwiggy
    Commented Oct 3, 2020 at 17:31
  • Also, what does "Process to find some links at data with your ID" mean?
    – nohillside ♦
    Commented Oct 4, 2020 at 14:00
1

So what finally solved the problem was to reset the NVRAM (Non-Volatile Random Access Memory) with the command alt+cmd+p+r upon starting

Improve this answer
2
  • Wonderful - did you stay on 10.15.6 or upgrade to 10.15.7?
    – bmike ♦
    Commented Sep 30, 2020 at 14:40
  • No I'm still on 10.15.6. Didn't know there was 10.15.7. I guess I should update then ;)
    – ecjb
    Commented Sep 30, 2020 at 19:37
0

I started seeing these symptoms after upgrading to osx 10.15.7 even after several reboots

100% cpu on these two processes as identifed from terminal running top

accountsd 
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd

and

commerce                
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/commerce

SOLUTION - System Pref -> Spotlight -> Privacy -> add Macintosh HD so it effectively disables Spotlight which I never use anyway

however if you use Spotlight just get more granular than whole HD

Improve this answer
2
  • 1
    I think we need not to select whole drive and can use only a few folders with a lot references to inspect
    – Marat Zimnurov
    Commented Oct 3, 2020 at 16:19
  • I’m with @МаратЗимнуров if we can be surgical about which folders or files trigger spotlight what will help the most people. +1 and thank you for sharing your results.
    – bmike ♦
    Commented Oct 3, 2020 at 17:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .