Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

15 points

In need of assistance please...

Good Morning and Happy New Year,

I have been having difficulties with remote management on all of my devices... has anyone ever seen anything like this? Is there anything in this .plist that gives any clues on what I am dealing with? what ever it is?? I have erased and reinstalled clean versions of os on my macbook pro, macbook air , iphone and ipad multiple times via recovery and boot drive; all problems return. Yes.. The remote access returns. Today sudo "runs" my computer ever though I am logged in as myself / admin. Please know, I have never touched my disks, re-formatted anything on this computer... Sorry for the pictures... I could not upload the file.

Jan 1 12:01:46 sudo diagnosticd[2620]: allowing Console (9598) access to stream due to admin status

Jan 1 12:01:46 sudo diagnosticd[2620]: Posting stream filter: "{

global = 47245099008;

And this one;

Jan 1 12:04:19 sudo syncdefaultsd[12336]: objc[12336]: Class SYDClient is implemented in both /System/Library/PrivateFrameworks/SyncedDefaults.framework/Versions/A/SyncedDefaults and /System/Library/PrivateFrameworks/SyncedDefaults.framework/Support/syncdefaultsd. One of the two will be used. Which one is undefined.

Jan 1 12:04:19 sudo syncdefaultsd[12336]: objc[12336]: Class SYDJournal is implemented in both /System/Library/PrivateFrameworks/SyncedDefaults.framework/Versions/A/SyncedDefaults and /System/Library/PrivateFrameworks/SyncedDefaults.framework/Support/syncdefaultsd. One of the two will be used. Which one is undefined.

MacBook Pro 13″, macOS 11.1

Posted on Jan 1, 2021 10:57 AM

Best reply

Grant Bennet-Alder

Level 10

127,879 points

Posted on Jan 2, 2021 6:33 PM

The workgroup-name (used for naming the Windows workgroup, if present) is user settable. If you don't like that name, just type something else. On most Macs, it does nothing at all.

Digging in plists and log files without a completely specific item you are looking for is a recipe for madness.

These files are the product of hundreds to thousands of programmer-years of effort, and they are carrying substantial historical baggage, and possibly "hooks" for features we have never heard of, not even as rumors.

View in context

Similar questions

30 replies

Marcees1436 Author

Level 1

15 points

Jan 28, 2021 8:14 AM in response to Grant Bennet-Alder

The graph is pretty... is is a graph of what is running through my Mac.... malware, spyware, and a little ditty called "WANNA CRY"... Ethecheck won't show any of that.....But it did show clues... high CPU... but other than that.. this stuff hides... and looking in your files is the only way to find it.

Jan 28, 2021 9:05 AM in response to Marcees1436

Marcees1436 wrote:

this stuff hides... and looking in your files is the only way to find it.

But, unless you know what you're looking for, you'll find lots of stuff that you think is a problem but which is not. It's sort of like doing abdominal surgery. Unless you're a surgeon, it's all going to look messy and weird and you won't be able to tell a spleen from a tumor.

Nothing you've show so far indicates any kind of malware.

Jan 28, 2021 9:28 AM in response to Marcees1436

<< this stuff hides... >>

Not in Mac OS Catalina and later with a locked system volume and checksummed signed, sandboxed Apps it don't.

Anything that manages to attach itself to a system files cause the system to no longer boot. Anything that manages to add itself to the system Volume is in plain sight, and still has to be approved by you to become executable.

Jan 29, 2021 6:39 AM in response to Marcees1436

Marcees1436 wrote:

Now, I already know, because of the help from Alien Vault and Virus Total I have the Ranson /spyware/ malware Wanna Cry,

This goes to show how little you understand. Alien Vault and Virus Total are taking advantage of you. WannaCry is Windows Malware. It does not affect Macs.

Marcees1436 Author

Level 1

15 points

Jan 30, 2021 12:44 PM in response to Grant Bennet-Alder

Hi Grant,

Of what actually occurring? My Mac being hacked? Well OK, I asked you about the glowing boxes, the boot cache above, Sudo in the console even though I was logged in as well as my Netbios name... you told me to look in a specific folder..whitch was /library/managed preferences which I did... I showed you a screen shot that stated that folder could not be found. You told me to look for MCX.plist files... I showed you the below.... its on the first page of this thread... I showed you the text I was typing at that time with every word underlined (spellcheck).... I showed you everything you asked for.. I put it right in front of you then some... and your answer to my question was this

"Looking in logs without knowing exactly what you are looking for is the path to madness"

Now above you are telling me I am not providing "Symptoms" Can you help with the symptoms I've put in front of you and the .plist you asked for and we can move on from there?

/Untitled 2/System/Library/SystemProfiler/SPManagedClientReporter.spreporter

?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>BuildAliasOf</key>

<string>MCXTools</string>

<key>BuildVersion</key>

<key>CFBundleShortVersionString</key>

<key>CFBundleVersion</key>

<key>ProjectName</key>

<string>MCXTools</string>

<key>SourceVersion</key>

</dict>

</plist>

I did and showed you there were no profiles there. My machine is literally honking at me now..

Marcees1436 Author

Level 1

15 points

Jan 30, 2021 12:53 PM in response to IdrisSeabright

Well thats offensive but I won't take it personally. You have to understand that someone has a virtual machine hooked up to my computer....and there is one exception to Macs and WannaCry.... if someone were using Boot Camp or a virtual machine to run Windows on a Mac.

Jan 30, 2021 3:45 PM in response to Marcees1436

One file you showed with wannacry inside is inside diskpart.exe. (or something like that the letters are too fuzzy to make out exactly.)

.exe files are Windows executables. No matter how hard you try, you will NOT be able to execute stuff from inside an .exe file under MacOS.

It is just random junk. I dunno how it got on your Mac, but it does not matter. It cannot possibly become executable, and is not a threat.

another one you analyzed was named filemaker17.advanced .pkg or something like that. I do not know whether that is what it is supposed to be, but if you got a garbage file from somewhere, why not just chuck it out and be done with it?

Marcees1436 Author

Level 1

15 points

Jan 4, 2021 1:41 PM in response to Grant Bennet-Alder

Marcees1436 Author

Level 1

15 points

Jan 27, 2021 8:00 AM in response to Marcees1436

Grant, Are you still there?? I want to pass something by you..... if you don't mind...

Thanks

marcee

Marcees1436 Author

Level 1

15 points

Jan 27, 2021 8:11 AM in response to Marcees1436

This is what I found while I was file digging...

https://www.virustotal.com/graph/embed/ge9360076daab458185304df5bbe36fceb94c81c94df3488d972c37d79b9b7f66

Marcees1436 Author

Level 1

15 points

Jan 27, 2021 8:12 AM in response to Marcees1436

this one should have been first... Called" file maker... " in my dropbox..

https://www.virustotal.com/graph/embed/g227ce17472eb49cb8c826b254de0f199a3a3d0b39e324d578227dd296765e6eb

Marcees1436 Author

Level 1

15 points

Jan 28, 2021 5:41 AM in response to Grant Bennet-Alder

Yes, I know that, Did you click on the links? Thats what I wanted you to look at.

Jan 28, 2021 7:05 AM in response to Marcees1436

The graphs are very pretty. What they have to do with your situation eludes me. Your Etrecheck report does not show any of the graphed items running at the time of the report.

Marcees1436 Author

Level 1

15 points

Jan 28, 2021 7:19 AM in response to Marcees1436

I'm not sure why this was marked solved... It wasn't solved... and wouldn't I, the one that asked the question mark the thread solved???

Jan 28, 2021 5:03 PM in response to Marcees1436

<< I have had problems with someone having remote access to my computer for over a year. >>

You are now on your second page without providing any SYMPTOMS of this actually occurring.

In need of assistance please...