Does my Macbook have malware?

dr_storm wrote:

I guess if my computer was chatting with some nearby network device named Stacies-iPhone, that device must have followed me around. For I saw the same log messages in separate recovery restarts in two locations separated by 30 miles.

Not necessarily. Those network names are cached. If you had ever encountered Stacies-iPhone with a certain IP address, then your computer would always assume that said IP address was Stacies-iPhone until it decided to renew its cache. Erasing your hard drive is one way to reset the cache. There are easier ways. The easiest method is to just ignore it.

dr_storm wrote:

Does my Macbook have malware?

No.

Don't look at the install log in recovery mode.

Even if your Mac were chock-full of malware, there is no possible way that the malware would show up in recovery. So there is some other explanation. Don't worry about it. Use default settings. Any changes from defaults, and any 3rd party "security" software you install will only reduce your security.

dr_storm wrote:

I'm seeing unknown devices in my install log when in recovery mode. It switches from localhost to Macbook Pro to Stacies-iPhone. I don't know a Stacie?

The transition in the log file that has me worried...

....

Jul 29 21:49:06 MacBook-Pro Installer Progress[192]: Ordering windows front

Jul 29 21:49:06 MacBook-Pro Language Chooser[419]: Mac is connected to power, not shutting down

Jul 29 21:49:06 MacBook-Pro mobileassetd[417]: SUPreferenceManager: Service connection invalidated!

Jul 29 21:49:06 MacBook-Pro mobileassetd[417]: SUPreferenceManager: Connection proxy failure with error:Error Domain=NSCocoaErrorDomain Code=4099 "The connection to service named com.apple.softwareupdated was invalidated: failed at lookup with error 3 - No such process." UserInfo={NSDebugDescription=The connection to service named com.apple.softwareupdated was invalidated: failed at lookup with error 3 - No such process.}

Jul 29 21:49:06 MacBook-Pro mobileassetd[417]: SUPreferenceManager: Service connection invalidated!

Jul 29 21:49:06 MacBook-Pro mobileassetd[417]: SUPreferenceManager: Connection proxy failure with error:Error Domain=NSCocoaErrorDomain Code=4099 "The connection to service named com.apple.softwareupdated was invalidated: failed at lookup with error 3 - No such process." UserInfo={NSDebugDescription=The connection to service named com.apple.softwareupdated was invalidated: failed at lookup with error 3 - No such process.}

Jul 29 21:49:06 MacBook-Pro mobileassetd[417]: SUPreferenceManager: Service connection invalidated!

Jul 29 21:49:06 MacBook-Pro mobileassetd[417]: SUPreferenceManager: Connection proxy failure with error:Error Domain=NSCocoaErrorDomain Code=4099 "The connection to service named com.apple.softwareupdated was invalidated: failed at lookup with error 3 - No such process." UserInfo={NSDebugDescription=The connection to service named com.apple.softwareupdated was invalidated: failed at lookup with error 3 - No such process.}

Jul 29 21:49:08 MacBook-Pro opendirectoryd[196]: [session] Received a network change notification

Jul 29 21:49:08 MacBook-Pro opendirectoryd[196]: [session] Received a network change notification

Jul 29 21:49:09 Stacies-iPhone opendirectoryd[196]: [session] UID: 205, EUID: 205, GID: 205, EGID: 205, PID: 201, PROC: locationd ODNodeCreateWithNameAndOptions request, SessionID: 00000000-0000-0000-0000-000000000000, Name: /Search, Options: 0x0

Jul 29 21:49:09 Stacies-iPhone opendirectoryd[196]: [session] ODNodeCreateWithNameAndOptions failed with result 2000

Jul 29 21:49:10 Stacies-iPhone opendirectoryd[196]: [session] Received a network change notification

Jul 29 21:49:10 Stacies-iPhone Language Chooser[419]: LCA: most frequent language: en

old issue, new issue, what changed?

Why are you in Recovery mode?

Is this a new Mac?

Is this Mac managed or bound to some Enterprise, JAMF, MDM, active directory list (?)

Do you see a Profile in

>System Settings>Privacy & Security>Profiles

Intro to mobile device management profiles - Apple Support

Use configuration profiles to standardize settings on Mac ...

dr_storm wrote:

Any relation to Etrecheck?

Maybe a little bit. 😄

Maybe malware is a misnomer. I was thinking more of an 'Evil Maid' type of boot sector/sequence attack.

Malware would be better. At least malware exists.

Doesn't it seem strange to have the installer go from localhost to Macbook Pro to Stacies-iPhone? There is likely a good explanation but I'm at a loss what it might be given the evidence and would be shocked if it's not nefarious.

Nope. Devices are always chatting with each other for all kinds of reasons. Pretty much all networking logic was designed 40-50 years ago and has been patched many times over to try to function in the modern world. It's absolutely not nefarious. It's a miracle that it still works at all.

dr_storm wrote:

Are you saying that my computer connected to a LAN host named Stacies-iPhone at some point and since then DHCP assigned me that same address?

I have no idea. You seem to have some kind of unusual network setup. Take everything I've said so far, and multiply it by 100.

The only thing I can tell you more is that malware is most definitely never "hidden" anywhere. Malware is very visible and obvious. It is extremely unusual for malware to even attempt to pretend to be anything else. It is absolutely trivial to find, see, and remove. It has absolutely nothing to do with what you are looking at.