I have a new Mac Pro and a Mac Mini on the same network. Twice a message has appeared saying files are being copied from the Mac Pro to the Mac Mini when I did not initiate the copy and in fact had sharing features turned off. How can this happen?

Could the "Allow Handoff between this Mac and your iCloud devices" service possibly cause the Mac Mini to mirror the messages when copying files on the Mac Pro? Or does this indicate some security problem?

The Mac Pro is running Catalina. The Mac Mini is running High Sierra.

Posted on Mar 8, 2020 4:10 PM

Reply

Similar questions

16 replies

Mar 8, 2020 4:15 PM in response to TimeTraveler2020

Next time it happens, get a screen shot. The text of the message and any details of the files involved will be of interest.


There can be shared network caches available and used for app installs, and add-on apps may well copy files around.


Continuity will definitely allow links and resources to be available, but that doesn’t show as a file copy dialog.


Download and run and post the output of EtreCheck here. Open a new reply here, press the button that looks like a printed page to get a text input box large enough to paste the hardware and software configuration report here.

Mar 9, 2020 4:54 PM in response to BobHarris

Nothing is set up to copy to the Mac Pro or from the Mac Pro. The documentation for Universal Clipboard does not mention the possibility to see messages such as this but I've now tested it and it seems this feature is the source. I say this because I did the following test. I disabled it by turning off blue tooth and the Allow Handoff setting. I did a test copy from an external disk to the Mac Pro as I did when this happened previously to see if it triggered any message on the Mac Mini but it did not. Then I re-enabled the Universal Clipboard and again copied from an external disk to the Mac Pro and went to my mac mini screen and got the same message. See attached.

Meanwhile in the activity monitor the only significant change I was was that the Parallels processes were not responding.

I looked to see what files it had copied but could find nothing on the Mac Mini.

Is this behavior expected? Any idea why this causes parallels to stop responding?

Mar 8, 2020 11:32 PM in response to MrHoffman

Are you suggesting that one of the programs I have installed is somehow taking control of my apple id and copying files via the handoff functionality? Or do you think Malewarebytes is able to bypass firewall and os security of the Mac Pro on its own even though its not installed there? This has never happened before in all the years I've had these programs and multiple computers on my network until I got the new mac pro with catalina.

Mar 10, 2020 5:56 AM in response to TimeTraveler2020

The Apple store page you’ve linked to doesn’t match the icon shown. There’s no (obvious) use of the old cheese-grater on the new cheese-grater page. This is either old Apple software and/or something that doesn’t appear very often, or it’s not Apple software. You’re probably going to end up removing a package at a time, and see when this disappears, if this isn’t something that somebody here recognizes.

Mar 8, 2020 5:25 PM in response to TimeTraveler2020

Various candidates here, unfortunately. No good culprits, though.

See if removing the anti-malware clears this.

Four backup tools are worth a look, for what they’re copying around.

GPG has its issues, but those are with the security of its intended purpose.

Haven’t looked at the status of TrueCrypt.

Flash and Java security has been problematic over the years.

Skype has been updated since 2018.


Mar 8, 2020 8:14 PM in response to TimeTraveler2020

The TrueCrypt project was shut down several years ago so you are using really outdated software. You should be able to use VeraCrypt instead which is a fork of TrueCrypt that is still being maintained and updated.


I find the "Copy" and "Pasting" to be interesting, but I don't how to identify the reason for it.


Since you have a VM, then maybe you need to investigate the VM. The easiest thing would be to disable the VM.


Try booting into Safe Mode to see if you still have the problem.


Is FileSharing enabled?


Is remote access of any kind enabled?

Mar 9, 2020 5:40 AM in response to TimeTraveler2020

The Pasting from "Ray's Mac Pro"... sounds a lot like the macOS Universal Clipboard actions

https://support.apple.com/en-us/HT209460


  /Library/Extensions
    [Loaded]     SophosFileProtection.kext (9.9.4 - SDK 10.14)
    [Loaded]     SophosWebProtection.kext (9.9.4 - SDK 10.14)

Suggest removing the anti-virus


Where is your iDrive pointing? Is it to a cloud server or to your Mac Pro?


Where is Carbon Copy Cloner pointing? Do you have a schedule CCC backup, although CCC does not generally have Finder style messages.


CrashPlan used to allow backing up to your own server, but they discontinued that, so I assume your CrashPlan is backing up to CrashPlan servers which you are paying for. Also CrashPlan did not display Finder style copy messages.


What is the Paragon software doing? I'm used to seeing Paragon's name associated with Windows NTFS file system access, but I'm not seeing the kernel extension I normally see when accessing an NTFS file system. So I'm wondering if you are running some other product from Paragon.


What is MySQL doing? Are you running some kind of database app that uses the Mac Pro for storage?


What are you using MacFUSE for. It is generally associated with file systems not native to macOS, or with file systems accessed over the network via ftp, ssh or sftp.

Mar 9, 2020 5:32 PM in response to MrHoffman

I'm afraid you're mistaken about the icons. These are the same as show on apple's website when I login. Also their product page has the same icon: https://www.apple.com/shop/buy-mac/mac-pro/tower

Removing my work environment is not a viable solution. I could shut down the VM - but I already know how to turn it off via the handoff feature. I am still interested to find out if this is intended behavior.

Mar 10, 2020 10:14 PM in response to MrHoffman

Well its a bit too subtle for my eyes but your comment got me thinking about the fact that parallels tools stops responding each time the message appears so I did another test and found that when I turn on the universal clipboard feature BUT turn off parallels toolbox that the message does not appear. So my conclusion is that this message relates to the interaction of parallels toolbox and the universal clipboard feature of Sierra and above systems. This never came up before because the other computers on my network are running older operating systems. So I think the icon that you say is an old mac pro must be generated by parallels because this version came out before the new mac pro.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

I have a new Mac Pro and a Mac Mini on the same network. Twice a message has appeared saying files are being copied from the Mac Pro to the Mac Mini when I did not initiate the copy and in fact had sharing features turned off. How can this happen?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.