Process in /System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd taking almost all ressources (Catalina - MacOS 10.15.6)
I have Catalina 10.15.6
There is something running in the background at /System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd that takes 50-90% of the CPU and 1Gig of memory. I fear that it's a virus. I saw that there is a similar question there, but there was no feedback. I tried to remove it with
I run malwarebyte: it told me that there is no malware on the machine
override rwxr-xr-x root/wheel restricted,compressed for accountsd? y rm: accountsd: Operation not permitted
I'm affraid of breaking somethin if I go further
I tried to follow the following points of the comments/answers
-
I deleted all the account in `system preferences > Internet accounts'
-
I rebooted 2x the machine in safe mode by holding shift
Despite those steps nothing happened: the fan is still full on an almost all ressources of the CPU taken
in <user>/Library/Keychains, there is the following list:
login.keychain
login.keychain-db
login_renamed_1.keychain-db
metadata.keychain
metadata.keychain-db
metadata.keychain-db.C07BBB57-D5A7-435B-9CAD-1AE65E5FBCC5
Which one should I delete?
What finally solved the problem:
So what finally solved the problem was to reset the NVRAM (Non-Volatile Random Access Memory) with the command alt+cmd+p+r upon starting
thanks for hints below
Solution 1:
On Catalina, anything in /System is mounted in a read-only, protected volume, and so almost certainly is part of the OS and not malware.
Secondly, ramping up CPU or memory is usually not indicative of malware. Malware generally tries to hide itself, not advertise. It can be poorly written, of course. (As can the OS.)
There are many reports of MacOS processes going a bit wild every now and again: sometimes they may need to do a bit of work and then calm down; other times they may suggest a problem which needs to be fixed.
Why is the accountsd process eating so much CPU?
Accountsd using lots of CPU constantly
Process "accountsd" has over 500% CPU usage
This blog suggests that you may need to delete a local keychain folder inside <user>/Library/Keychains (which may cause some passwords to be forgotten).
https://waal70blog.wordpress.com/2019/12/16/accountsd-and-secd-high-cpu-usage-on-catalina/
An alternative offered is just to reboot to Safe Mode (hold Shift at restart), then restart normally.
Solution 2:
I would get the 10.15.7 update which brings you to build 19H2. (And apply the combo installer if you see this issue on 19H2 if you upgraded incrementally)
On Mojave, Apple has released a supplemental update that addresses this as they didn’t have a .7 ready to release - I would make a backup and then apply all updates either on Catalina or Mojave as we’ve seen great results with both in the past 24 hours at work with no issues new and old issues fixed well.
- https://support.apple.com/kb/DL2052 (10.15.7 Combo)
- https://support.apple.com/kb/DL2015 (10.14.6 Mojave supplemental)
If you’re interested in testing or analysis, these two authors are superb at describing the issue and fix.
- https://eclecticlight.co/2020/10/02/apple-has-released-macos-mojave-10-14-6-supplemental-update-2/
- https://mrmacintosh.com/10-14-6-supplemental-update-safari-14-released-to-fix-previous-issues/