Remote management on my computers

Question

Level 1

15 points

Remote management on my computers

Good Morning,

I have had an ongoing problem with possible Remote management on my computers. I understand Nortons is not a prefered application for Mac users but it allows me to block ports, applications etc that I can not do on my Mac. Whatever has taken over the permissions, open directory etc. seems to be able to do what ever it wants. I have erases and reinstalled multiple times... I have a diagnostic tool from Apple support that I ran, I believe it states I have an airport base station which I looked up, it seems to be a wireless router. I do not own an Airport basestation of any sort.. The reason I started to dig into the wifi diagnostics is because I was setting up Nortons "again". I always turn off my wifi when I set it up but my wifi wasn't really off...it just wasn't connected to my router... I know this sounds extremely odd.. believe me it is. Look at the pics.. I also ran a net stat to see what was connected but I don't understand how to read the outcome... other that it was a lot of root connections. Attached are wifi diagnostics, net stat and a description if the airport station? I think... I did set up my Xfinity modem at 10.0.0.1... not allowing any remote access... I have custom setting... I allow nothing through.... While setting up Nortons it froze.. I forced quite and printed report.... Thread 8 Dispatch queue: com.apple.root.default-qos. I believe that's a privacy issue??? Maybe someone can make some sense out of this for me... much appreciated.

Marcee

lsof -i -u^$(whoami)

Problem Report Norton 360

AIRPORT-BASESTATION-3-MIB

[Re-Titled by Moderator]

MacBook Air 13″, macOS 10.15

Posted on Nov 29, 2020 9:49 AM

Reply

Answer 1

Top-ranking reply

Kailula

Level 1

4 points

Dec 1, 2020 8:49 PM in response to Kailula

It comes back because that is the way Remote Management is designed. It is an asset management application for corporations/ schools.

The idea is that if an enrolled device is stolen, the company can still manage the device. Even if it is wiped, the device can not be used.

So, if there a potential that your previous employer or school, rolled up the device... it's a heck of a lot easier to just contact them and have them unenroll you....

The other option is much more difficult to fix.

Reply

Answer 2

t.moe

Level 4

1,305 points

Nov 29, 2020 10:12 AM in response to Marcees1436

Airport is the name of Apple's wireless products, including the networking card in you MacBook. Seeing the airport daemon does not imply you are connected or connection to a Airport Wireless Station.

The MIB file (from /usr/share/snmp/MIB - I would guess) - is just used by snmp utilities. It does not imply you are connected to a Airport base station.

If you want to know what the Norton problem report is, you should probably ask Norton - but it just looks like it can't connect out. You can ask Norton why/if they are using QOS.

Nothing weird here.

Reply

Answer 3

Kailula

Level 1

4 points

Dec 1, 2020 8:42 PM in response to Marcees1436

Ok, then... I think we have the answer.

So, from what I read, you do not know how this was put on your Mac Book. I am guessing that this must be on your other Mac and your I phone, as well.

So... if you don't mind, I have a few more questions.

1) Do all of your devices share the same ICloud, OneDrive, Dropbox, etc?

2) Do you have any idea how this appeared on your computer? (Perhaps you are a student???)

3) What is the current OS running on your Mac Boo?

Reply

Answer 4

Marcees1436 Author

Level 1

15 points

Dec 1, 2020 8:45 AM in response to Kailula

Hi Kailula,

First, thank you for your reply on my last post.. you were actually the first person that said... No... OTA.update logs.. Microsoft at that should probably not be on here computer...

I have been trying desperately to figure out the source of the Remote Management on my computer...This has been going on for over year now, it has infected 2 macs and my phone. I am trying to figure out how this happened... I was hoping these discussion boards could help. I honestly think it is deep within my system.. so I look for odd things, or what I think is odd like this below... why would I have a MS-DOS FAT32 file system??? I never did that...

Device Identifier: disk0s1

Device Node: /dev/disk0s1

Whole: No

Part of Whole: disk0

Volume Name: EFI

Mounted: No

Partition Type: EFI

File System Personality: MS-DOS FAT32

Type (Bundle): msdos

Name (User Visible): MS-DOS (FAT32)

OS Can Be Installed: No

Media Type: Generic

Protocol: PCI-Express

SMART Status: Verified

Volume UUID: E783267B-A4C3-3556-B751-DBED770EB996

Disk / Partition UUID: 928F5A09-8096-4EC2-9DC5-07ABC9BF5EBF

Partition Offset: 24576 Bytes (6 4096-Byte-Device-Blocks)

Disk Size: 314.6 MB (314572800 Bytes) (exactly 614400 512-Byte-Units)

Device Block Size: 4096 Bytes

Reply

Answer 5

Marcees1436 Author

Level 1

15 points

Dec 1, 2020 8:58 AM in response to Kailula

install log gone... look at this

If you want... look at this... you'll see where Managed client takes shape, I just don't know how... I did not sign into Icloud...

I just named my computer... with dashed.... Its insane I know... it is created before Im done setting up preferences.

Reply

Answer 6

Kailula

Level 1

4 points

Dec 1, 2020 9:14 AM in response to Marcees1436

Also, I have to be careful in my response. Don't want to upset any Apple folks...

FYI...I was blocked from responding to you the other day... and then was kicked off after my last post. So..... I can't even search for that thread to see any resolution.

Reply

Answer 7

Marcees1436 Author

Level 1

15 points

Dec 1, 2020 8:02 PM in response to Kailula

Wonderful idea!.... Here you go.... There are a few of each.... I do believe the MCX and Student may be closely connected.... there is a text file in there somewhere with "??????" next to it... perhaps instructions on how to set it up... maybe I can break it down? But that still doesn't explain how it ALWAYS comes back... or how/why those accounts are set up. But this is progress anyway...

?????

Reply

Answer 8

Marcees1436 Author

Level 1

15 points

Dec 3, 2020 8:36 AM in response to Kailula

I have know idea who, why are when, although I have an idea, I am not a student, I bought both macs brand new. I do share apple ID although I do not sign in. I a not signed in to icloud on this computer. I set up my preferences offline i.e. language, display etc. I have not opened drop box in months....

Reply

Answer 9

Marcees1436 Author

Level 1

15 points

Nov 30, 2020 4:09 AM in response to t.moe

Thank you t. moe, your help is greatly appreciated! My internal card is AirPort Extreme... I found it all to close for comfort!

Thank you for the explanation😊

Marcee

Reply

Answer 10

Kailula

Level 1

4 points

Nov 30, 2020 5:18 PM in response to Marcees1436

What kind of issues are you having that makes you run all of these logs?

Reply

Answer 11

Marcees1436 Author

Level 1

15 points

Dec 3, 2020 10:03 AM in response to Kailula

Kailula,

From what you have seen; the OTA logs, the above accounts and everything else would say me computer is "enrolled" in some sort of remote management?

Reply

Answer 12

Marcees1436 Author

Level 1

15 points

Dec 3, 2020 10:43 AM in response to Kailula

Kailula,

What is a file called a .blob ?

Reply

Answer 13

Kailula

Level 1

4 points

Dec 3, 2020 8:53 PM in response to Marcees1436

Blobs are large binary files and are usually images, audio or other types of large media.

Reply

Answer 14

t.moe

Level 4

1,305 points

Dec 1, 2020 9:14 AM in response to Marcees1436

The EFI (Electronic Firmware) volume is MS-DOS formatted. Shows up the same way on my laptop.

It should be there and it should formatted M-DOS.

diskutil info EFI

Device Identifier: disk0s1

Device Node: /dev/disk0s1

Whole: No

Part of Whole: disk0

Volume Name: EFI

Mounted: No

Partition Type: EFI

File System Personality: MS-DOS FAT32

Type (Bundle): msdos

Name (User Visible): MS-DOS (FAT32)

OS Can Be Installed: No

Media Type: Generic

Protocol: PCI-Express

SMART Status: Verified

Volume UUID: E783267B-A4C3-3556-B751-DBED770EB996

Disk / Partition UUID: 688C00B1-1E7D-4208-A29F-1CAB5FF3FD90

Partition Offset: 24576 Bytes (6 4096-Byte-Device-Blocks)

Disk Size: 314.6 MB (314572800 Bytes) (exactly 614400 512-Byte-Units)

Device Block Size: 4096 Bytes

Volume Total Space: 0 B (0 Bytes) (exactly 0 512-Byte-Units)

Volume Free Space: 0 B (0 Bytes) (exactly 0 512-Byte-Units)

Media OS Use Only: No

Media Read-Only: No

Volume Read-Only: Not applicable (not mounted)

Device Location: Internal

Removable Media: Fixed

Solid State: Yes

Hardware AES Support: Yes

Reply

Answer 15

Kailula

Level 1

4 points

Dec 1, 2020 9:23 AM in response to t.moe

Marcee,

First, I would not focus on file formats and such. There are so SO many processes that are going on in the background that it is easy to get in the weeds and misunderstand naming conventions.

So, let's just start at square one.

It appears that you have MDM or Remote Management on your MacBooks and phone. Is this correct?

Reply

Remote management on my computers

Similar questions