I think I might have spyware on my MacBook Pro

EtreCheckPro version: 6.8.1 (68024)
Report generated: 2023-09-15 00:04:45
Download EtreCheckPro from https://etrecheck.com
Runtime: 20:25
Performance: Poor

Problem: Other problem
Description:
I think I might have spyware

Major Issues:
Anything that appears on this list needs immediate attention.
No Time Machine backup - Time Machine backup not found.
Battery failure - Your battery is reporting that it needs to be serviced.
Failing hard drive - This computer has a hard drive that appears to be failing.
Obsolete hardware - This computer may be considered obsolete.
Adobe Flash Player installed - Adobe Flash Player is installed on this computer. This is a security risk and no longer supported.

Minor Issues:
These issues do not need immediate attention but they may indicate future problems or opportunities for improvement.
Configuration profiles found - This computer may have configuration profiles installed.
Upgradeable hard drive - This computer’s hard drive could be replaced with an SSD. This would dramatically improve your computer’s performance.
Out of RAM - This computer is running short on RAM and has a mechanical hard drive, reducing the speed of the virtual memory system.
High battery cycle count - Your battery may be losing capacity.
Apps crashing - There have been numerous app crashes.
Unsigned files - There are unsigned software files installed. These files could be old, incompatible, and cause problems. They should be reviewed.
System modifications - There are a large number of system modifications running in the background.
Kernel extensions present - This computer has kernel extensions that may not work in the future.
Sharing enabled - This computer has sharing services enabled that could be a security risk.

Hardware Information:
MacBook Pro (13-inch, Mid 2010)
Status: Obsolete
MacBook Pro Model: MacBookPro7,1
2.4 GHz Intel Core 2 Duo (Duo) CPU: 2-core
8 GB RAM - At maximum
BANK 0/DIMM0 - 4 GB DDR3 1067
BANK 1/DIMM0 - 4 GB DDR3 1067
Battery: Health = Service Battery - Cycle count = 864

Video Information:
NVIDIA GeForce 320M - VRAM: 256 MB
Color LCD 1280 x 800

Drives:
disk0 - WDC WD5000BPVT-11HXZT3 500.11 GB (Mechanical - 5400 RPM)
Internal SATA 3 Gigabit Serial ATA
disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB
disk0s2 - Macintosh HD (Journaled HFS+) 499.25 GB (441.09 GB used)
disk0s3 - Recovery HD (Journaled HFS+) [Recovery] 650 MB (536 MB used)

disk1 - SanDisk Cruzer Glide 31.41 GB
External USB 480 Mbit/s USB
disk1s1 - N*****E (MS-DOS FAT32) 31.41 GB (2.77 GB used)

Mounted Volumes:
disk0s2 - Macintosh HD
Filesystem: Journaled HFS+
Mount point: /
Used: 441.09 GB
Size: 499.25 GB
Free: 57.90 GB
Available: 346.36 GB

disk0s3 - Recovery HD [Recovery]
Filesystem: Journaled HFS+
Mount point: /Volumes/Recovery HD
Used: 536 MB
Size: 650 MB
Free: 114 MB

disk1s1 - N*****E
Filesystem: MS-DOS FAT32
Mount point: /Volumes/N*****E
Used: 2.77 GB
Size: 31.41 GB
Free: 28.62 GB
Available: 28.71 GB

Network:
Interface Bluetooth-Modem: Bluetooth DUN
Interface en0: Ethernet
Interface en3: iPhone
Interface en1: AirPort
802.11 a/b/g/n
Interface en2: Bluetooth PAN

Printer sharing: Enabled

System Software:
macOS High Sierra 10.13.6 (17G14042)
Time since boot: About 72 days

Configuration Profiles:
com.apple.wifi.managed
AutoJoin
ProxyType
SSID_STR
IsHotspot
Password
HIDDEN_NETWORK
EncryptionType

Security:
Gatekeeper: App Store and identified developers
System Integrity Protection: Enabled

Antivirus software: Apple

Security Risk! - Adobe Flash Player installed!

Printer sharing: Enabled

Unsigned Files:
Launchd: /Library/LaunchDaemons/com.adobe.fpsaud.plist
Executable: /Library/Application Support/Adobe/Flash Player Install Manager/fpsaud
Details: Exact match found in the legitimate list - probably OK

Plugin: /Library/Internet Plug-Ins/Flash Player.plugin/Contents/PlugIns/FlashPlayer-10.6.plugin
Plugin: /Library/Internet Plug-Ins/Default Browser.plugin
Plugin: /Library/Internet Plug-Ins/Flash Player.plugin
Plugin: ~/Library/Internet Plug-Ins/CitrixOnlineWebDeploymentPlugin.plugin

Preference panel: /Library/PreferencePanes/Flash Player.prefPane

Applications:
484 apps
37 32-bit apps
25 unsigned apps

Kernel Extensions:
/Library/Extensions
[Not Loaded] EPSONUSBPrintClass.kext - com.epson.print.kext.USBPrintClass (2.2.7)
[Not Loaded] hp_io_enabler_compound.kext - com.hp.kext.io.enabler.compound (3.4.0)

System Launch Daemons:
[Not Loaded] 38 Apple tasks
[Loaded] 173 Apple tasks
[Running] 117 Apple tasks
[Killed] 9 Apple tasks

System Launch Agents:
[Not Loaded] 17 Apple tasks
[Loaded] 159 Apple tasks
[Running] 110 Apple tasks
[Killed] 8 Apple tasks

Launch Daemons:
[Running] com.adobe.ARMDC.Communicator.plist (Adobe Inc. - installed 2023-07-10)
Executable: /Library/PrivilegedHelperTools/com.adobe.ARMDC.Communicator

[Loaded] com.adobe.ARMDC.SMJobBlessHelper.plist (Adobe Inc. - installed 2023-07-10)
Executable: /Library/PrivilegedHelperTools/com.adobe.ARMDC.SMJobBlessHelper

[Loaded] com.adobe.acc.installer.v2.plist (Adobe Inc. - installed 2022-10-05)
Executable: /Library/PrivilegedHelperTools/com.adobe.acc.installer.v2

[Loaded] com.adobe.agsservice.plist (Adobe Inc. - installed 2023-04-02)
Executable: /Library/Application Support/Adobe/AdobeGCClient/AGSService

[Other] com.adobe.fpsaud.plist (Not signed - installed 2017-12-06)
Executable: /Library/Application Support/Adobe/Flash Player Install Manager/fpsaud

[Not Loaded] com.apple.installer.osmessagetracing.plist (Apple - installed 2020-11-16)
Executable: /System/Library/PrivateFrameworks/OSInstaller.framework/Resources/OSMessageTracer

[Loaded] com.google.keystone.daemon.plist (Google LLC - installed 2022-10-19)
Executable: /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/GoogleSoftwareUpdateDaemon

[Loaded] com.smithmicro.netwise.osx.helper.plist (Smith Micro Software, Inc.; Consumer Division - installed 2017-12-06)
Executable: /Library/PrivilegedHelperTools/com.smithmicro.netwise.osx.helper

Launch Agents:
[Not Loaded] com.adobe.AAM.Updater-1.0.plist (Adobe Systems, Inc. - installed 2019-09-27)
Command: /Library/Application Support/Adobe/OOBE/PDApp/UWA/UpdaterStartupUtility -mode=logon

[Other] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist (Adobe Inc. - installed 2023-07-10)
Executable: /Library/Application Support/Adobe/ARMDC/Application/Acrobat Update Helper.app/Contents/MacOS/Acrobat Update Helper

[Running] com.adobe.AdobeCreativeCloud.plist (Adobe Inc. - installed 2022-03-26)
Command: /Applications/Utilities/Adobe Creative Cloud/ACC/Creative Cloud.app/Contents/MacOS/Creative Cloud --showwindow=false --onOSstartup=true

[Running] com.adobe.GC.AGM.plist (Adobe Inc. - installed 2023-04-02)
Command: /Library/Application Support/Adobe/AdobeGCClient/Adobe Genuine Software Monitor Service -mode=logon

[Not Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Inc. - installed 2023-04-02)
Command: /Library/Application Support/Adobe/AdobeGCClient/agcinvokerutility -mode=logon

[Loaded] com.adobe.ccxprocess.plist (Adobe Inc. - installed 2022-03-26)
Command: /usr/bin/open -a '/Applications/Utilities/Adobe Creative Cloud Experience/CCXProcess/CCXProcess.app'

[Running] com.epson.Epson_Low_Ink_Reminder.launcher.plist (EPSON - installed 2017-12-06)
Executable: /Applications/Epson Software/Epson Low Ink Reminder.app/Contents/EpsonLowInkReminderAgent.app/Contents/MacOS/EpsonLowInkReminderAgent

[Loaded] com.epson.esua.launcher.plist (Seiko Epson Corporation - installed 2020-12-25)
Executable: /Applications/Epson Software/EPSON Software Updater.app/Contents/EPSON Software Updater Agent.app/Contents/MacOS/EPSON Software Updater Agent

[Running] com.epson.eventmanager.agent.plist (EPSON - installed 2017-12-06)
Executable: /Applications/Epson Software/Event Manager.app/Contents/Resources/Assistants/Event Manager/EEventManager.app/Contents/MacOS/EEventManager

[Loaded] com.google.keystone.agent.plist (Google LLC - installed 2022-10-19)
Command: /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded

[Loaded] com.google.keystone.xpcservice.plist (Google LLC - installed 2022-10-19)
Command: /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode xpchost

[Running] jp.co.canon.ScanGearMF.appl.Canon-MF-Scan-Agent.plist (Canon Inc. - installed 2023-01-11)
Executable: /Library/Printers/Canon/MFScanner/Utilities/Canon MF Scan Agent.app/Contents/MacOS/Canon MF Scan Agent

[Running] jp.co.canon.ScanGearMF.appl.Canon-MFSU-Agent.plist (Canon Inc. - installed 2023-01-11)
Executable: /Library/Printers/Canon/MFScanner/Utilities/Canon MFSU Agent.app/Contents/MacOS/Canon MFSU Agent

User Launch Agents:
[Loaded] com.adobe.AAM.Updater-1.0.plist (Adobe Systems, Inc. - installed 2019-09-27)
Command: /Library/Application Support/Adobe/OOBE/PDApp/UWA/UpdaterStartupUtility -mode=scheduled

[Loaded] com.adobe.GC.Invoker-1.0.plist (Adobe Inc. - installed 2023-04-02)
Command: /Library/Application Support/Adobe/AdobeGCClient/agcinvokerutility -mode=scheduled

[Not Loaded] com.adobe.ccxprocess.plist (Adobe Inc. - installed 2022-03-26)
Command: /usr/bin/open -a '/Applications/Utilities/Adobe Creative Cloud Experience/CCXProcess/CCXProcess.app'

[Other] com.apple.CSConfigDotMacCert-***@***-SharedServices.Agent.plist (Not signed - installed 2014-11-05)
Command: /System/Library/Frameworks/CoreServices.framework/Frameworks/OSServices.framework/Versions/A/Support/CSConfigDotMacCert -l /Users/scharmon95/Library/Logs/CSCohttps://etrecheck.com
SharedServices -s

User Login Items:
[Running] AdobeResourceSynchronizer (Adobe Systems, Inc. - installed 2021-04-08)
Application
/Applications/Adobe Acrobat Reader DC.app/Contents/Helpers/AdobeResourceSynchronizer.app

[Loaded] App Store (Apple - installed 2017-12-06)
Application
/Applications/App Store.app

[Not Loaded] StartupHelper (App Store - installed 2017-12-06)
Modern Login Item
/Applications/Battery Guard.app/Contents/Library/LoginItems/StartupHelper.app

[Not Loaded] DSLoginItemHelper (App Store - installed 2017-12-06)
Modern Login Item
/Applications/DrSafety.app/Contents/Library/LoginItems/DSLoginItemHelper.app

[Not Loaded] Keeper Password Manager Login Helper (App Store - installed 2022-04-07)
Modern Login Item
/Applications/Keeper Password Manager.app/Contents/Library/LoginItems/Keeper Password Manager Login Helper.app

[Not Loaded] StartUpHelper (Spotify - installed 2020-05-19)
Modern Login Item
/Applications/Spotify.app/Contents/Library/LoginItems/StartUpHelper.app

[Not Loaded] PhotoStreamAgent (App Store - installed 2017-12-06)
Modern Login Item
/Applications/iPhoto.app/Contents/Library/LoginItems/PhotoStreamAgent.app

[Not Loaded] HP Device Monitor (HP Inc. - installed 2017-10-25)
Modern Login Item
/Library/Printers/hp/Frameworks/HPDeviceMonitoring.framework/Versions/1.0/Helpers/HP Device Monitor Manager.app/Contents/Library/LoginItems/HP Device Monitor.app

App Extensions:
Finder sync extensions:
Core Sync Helper - /Applications/Utilities/Adobe Sync/CoreSync/Core Sync.app

Safari extensions:
KeeperFill - /Applications/Keeper Password Manager.app

Share services:
OneNote - /Applications/Microsoft OneNote.app

Widgets:
Nozbe - /Applications/Nozbe.app

QuickLook Previews (legacy):
GBQLGenerator - /Library/QuickLook/GBQLGenerator.qlgenerator
com.apple.garageband.project *.band
com.apple.garageband.template.magic *.wand
com.apple.garageband.template.magicmentor *.mwand

Internet Plug-ins:
AdobeAAMDetect: 3.0.0.0 (Adobe Inc. - installed 2022-03-26)
FlashPlayer-10.6: 22.0.0.192 (? - installed 2016-06-16)
Default Browser: (? - installed 2019-09-23)
AdobePDFViewerNPAPI: 17.012.20098 (Adobe Systems, Inc. - installed 2017-12-06)
AdobePDFViewer: 21.001.20142 (Adobe Systems, Inc. - installed 2017-12-06)
Flash Player: 22.0.0.192 (? - installed 2017-12-06)
iPhotoPhotocast: 7.0 (Apple - installed 2017-12-06)

Audio Plug-ins:
BluetoothAudioPlugIn: 6.0.7 (Apple - installed 2020-11-04)
iSightAudio: 7.7.3 (Apple - installed 2020-11-04)
AirPlay: 2.0 (Apple - installed 2020-11-04)
AppleAVBAudio: 683.1 (Apple - installed 2020-11-04)
BridgeAudioSP: 4.69.2 (Apple - installed 2020-11-16)
AppleTimeSyncAudioClock: 1.0 (Apple - installed 2020-11-04)

CoreMediaIO Plug-ins:
AppleCamera: 400.6.01 (Apple - installed 2017-12-06)
iOSScreenCapture: 814.0 (Apple - installed 2017-12-06)

Safari Extensions:
KeeperFill (App Store - installed 2022-04-07)

3rd Party Preference panels:
Flash Player (? - installed 2017-12-06)

Backup:
Time Machine Not Configured!

Performance:
System Load: 1.49 (1 min ago) 1.73 (5 min ago) 2.13 (15 min ago)
Nominal I/O usage: 1.39 MB/s
File system: 120.71 seconds (timed out)
Write speed: 39 MB/s
Read speed: 47 MB/s

CPU Usage Snapshot:
Type Overall
System: 14 %
User: 34 %
Idle: 52 %

Top Processes Snapshot by CPU:
Process (count) CPU (Source - Location)
EtreCheckPro 11.46 % (Etresoft, Inc.)
kernel_task 9.50 % (Apple)
system_profiler 6.92 % (Apple)
Activity Monitor 6.76 % (Apple)
trustd (3) 3.58 % (Apple)

Top Processes Snapshot by Memory:
Process (count) RAM usage (Source - Location)
com.apple.WebKit.WebContent (6) 1.10 GB (Apple)
kernel_task 940 MB (Apple)
EtreCheckPro 490 MB (Etresoft, Inc.)
system_profiler 293 MB (Apple)
Safari 253 MB (Apple)

Top Processes Snapshot by Network Use:
Process (count) Input / Output (Source - Location)
mDNSResponder 12 MB / 4 MB (Apple)
com.apple.WebKit.Networking 8 MB / 1 MB (Apple)
netbiosd 45 KB / 30 KB (Apple)
rapportd 14 KB / 4 KB (Apple)
apsd 4 KB / 13 KB (Apple)

Top Processes Snapshot by Energy Use:
Process (count) Energy (0-100) (Source - Location)
trustd (3) 13 (Apple)
system_profiler 10 (Apple)
Activity Monitor 3 (Apple)
WindowServer 2 (Apple)
com.apple.WebKit.WebContent (6) 2 (Apple)

Virtual Memory Information:
Physical RAM: 8 GB

Free RAM: 17 MB
Used RAM: 6.09 GB
Cached files: 1.89 GB

Available RAM: 1.91 GB
Swap Used: 370 MB

Software Installs (past 60 days):
Install Date Name (Version)
2023-09-11 XProtectPlistConfigData (2170)

Diagnostics Information (past 7-30 days):
2023-09-14 14:22:14 VTEncoderXPCService Crash (7 times)
Executable: /System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTEncoderXPCService.xpc/Contents/MacOS/VTEncoderXPCService
Details:
API MISUSE: Over-release of an object

2023-09-14 13:42:28 ScreenSaverEngine.app Memory (2 times)
Executable: /System/Library/CoreServices/ScreenSaverEngine.app

2023-09-14 13:00:08 iCloudPref.prefPane Crash
Executable: /System/Library/PreferencePanes/iCloudPref.prefPane
Details:
Crashing on exception: NSDictionaryOfVariableBindings failed because e
ither one of the values is nil, or there's something wrong with the wa
y the macro is being invoked. Cannot assign value nil for key "sview2
". Keys:(
sview2
)

2023-09-13 09:21:55 accountsd Memory
Executable: /System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd


End of report


[Edited by Moderator]

MacBook Pro 13″, macOS 10.13

Posted on Sep 16, 2023 6:43 AM

Reply
Question marked as Top-ranking reply

Posted on Sep 16, 2023 7:07 AM

I've asked the moderators to edit your EtreCheck report. I added a new feature recently to help users with a specific problem on macOS Ventura. Unfortunately, that feature could show the e-mail address for people running on very old computers. It's really annoying when developers (3rd party and Apple) put people e-mail addressed on the command line. Anyway, I fixed that bug yesterday, but you had already downloaded and used the older version of EtreCheck.


Your EtreCheck report does not show any malicious activity. However, the kind of spying you are referring to usually isn't going to show up on an EtreCheck report. What you are worried about are issues with your online accounts. EtreCheck doesn't look at any of that.


I recommend you review Apple's support documents for personal safety. Start here: Personal Safety User Guide - Apple Support


As for your computer, I'm afraid you should get a new one. That computer is ancient. The battery and hard drive are failing.

Similar questions

4 replies
Question marked as Top-ranking reply

Sep 16, 2023 7:07 AM in response to PRD_555

I've asked the moderators to edit your EtreCheck report. I added a new feature recently to help users with a specific problem on macOS Ventura. Unfortunately, that feature could show the e-mail address for people running on very old computers. It's really annoying when developers (3rd party and Apple) put people e-mail addressed on the command line. Anyway, I fixed that bug yesterday, but you had already downloaded and used the older version of EtreCheck.


Your EtreCheck report does not show any malicious activity. However, the kind of spying you are referring to usually isn't going to show up on an EtreCheck report. What you are worried about are issues with your online accounts. EtreCheck doesn't look at any of that.


I recommend you review Apple's support documents for personal safety. Start here: Personal Safety User Guide - Apple Support


As for your computer, I'm afraid you should get a new one. That computer is ancient. The battery and hard drive are failing.

Sep 16, 2023 8:18 AM in response to PRD_555

Your computer's hard drive and battery are failing. You best make a backup of your files now before you have no access because they've failed. Due to the age, it is not worthwhile to replace the drive and battery. You need a new computer.


As for your other problem, change your bank accounts, use new passwords and usernames, and consult with a lawyer and/or the police.

Sep 16, 2023 9:03 AM in response to PRD_555

This:


Drives:

disk0 - WDC WD5000BPVT-11HXZT3 500.11 GB (Mechanical - 5400 RPM)


suggests to me that the drive has already been replaced at some point. Even had Apple used a WD drive at time of manufacture, it would be a bespoke drive for Apple and show "Apple" where yours shows "WDC."


Although not significant to your current question, it is possibly a hint of prior drives issues in that computer.


To verify, I just checked the factory drive in my iMac and, although the model number suggests it is from Samsung, the main identifier reads "Apple."


Drives:

    disk0 - APPLE SSD SM1024L 1.00 TB (Solid State - TRIM: Yes)

    Internal PCI-Express 8.0 GT/s x4 NVM Express


Based on EtreCheck drive scores I've observed for 2009-2012 13" Macbook Pros with similar drive specs, your hard drive is running at about 1/2 expected speed.



A restart every so often does no harm:


System Software:

macOS High Sierra 10.13.6 (17G14042)

Time since boot: About 72 days




Sep 16, 2023 3:21 PM in response to PRD_555

That Mac has problems, that much is certain.


However, your question concerns "spyware". Please explain what you consider that to be.


Your answer is important, because if your definition of "spyware" includes a product that captures and uploads every single keystroke and stores it in a central database forever, then yes that Mac is infested with spyware. It's called Google.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

I think I might have spyware on my MacBook Pro

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.