Apps installing self. Console errors. App opening at login.

mekyma wrote:

And until I messaged apple support, for some reason my XProtect had been off. Since contacting them it's been on and I've run it manually using XPROCHECK. Every once in a while the results of the scan change and different MRTv3 locations are marked success.

Sorry. You just got scammed.

I've done several Disc utility erases in recovery mode. I've also reinstalled the MacOS many times. It always comes back.

If you've done that already so many times, one more can't hurt, right?

Only this time, be more careful when you do it. Erase the hard drive. Reinstall the operating system. When you restore from Time Machine backup (yes I mean Time Machine, not clone-app-du-jour), do not restore any apps, software, system settings, or "other files". You can safely restore your user files and user accounts, but that's all. Even so, this will restore some bits and pieces of the software in question, but it should be OK. Then, manually reinstall only the apps that you really, really want, and sincerely need, to use. That does not include any free apps from internet social media "influencers".

Once you do this, you should be fine. Everything will work as it should.

From what you've said so far, I can't really tell what's going on. On one hand, it sounds like it could be malware. All those AppleScripts droplets installed from the internet on Sep. 2nd sound suspicious. Those are things that people create on their own, not download. This was after installing "Little Snitch", which is often used to prevent apps from "phoning home" and verifying their license. And a few days after all this, you felt the need to install some 3rd party antivirus? Why? (That's a rhetorical question. You don't need to answer that.)

That's just one possibility. It could be that all of that activity was perfectly legitimate. It could be that you've been fooled my more than one internet social media influencer. It is quite common for people to start digging around in those Console messages and think they've been hacked. All of those messages are 100% normal. Yes, there should be tens of thousands of them every second. Strangely enough, that's the way Apple likes it. (Yes, that's an exaggeration. There are few thousand of them every minute.)

If you have problems in the future, don't go searching the internet. The internet is lies all the way down. Come here first. If you are still having problems like this:

I've noticed that applications such as Automator Application Stub, cocoa AppleScript applet, group.is.workflow, etc, keep installing themselves on my system information. I can drag most to the trash and delete but they appear again the next time I start the Mac.

Then we can help you track down what is causing it.

mekyma wrote:

Little snitch and Malwarebytes were installed after the problems started. I don't pirate software. I resent the implication.

Sorry. I wasn't implying that you were pirating software. I was implying that you had been scammed. Sometimes people install Little Snitch thinking it will prevent apps from "phoning home" and therefore protect their personal information. That's not true. Apps that want to collect and share your personal information will not be blocked by Little Snitch. Little Snitch is only effective against honest developers trying to make a living.

Also can you somehow prove that XProcheck is a scam? Because it appears to run XProtect and was recommended here XProtect not updated? - Apple Community and endorsed with "The app is from the Electric Light Company site, some of the most knowledgeable Mac people on the internet, if not the most." by a lvl 10 apple community contributor.

XProtect is part of the operating system. It isn't an app and can't be "run" at all. There is nothing you need to do to make it work.

We are all susceptible to scammers and misinformation. The risk increases when we are dealing with a subject area that we don't know much about. I usually don't get scammed by software, usually. But I get scammed in other areas all the time. The author of that XProcheck software is an internet social media influencer. He writes dozens of these little apps, all designed to make you suspicious and untrusting of Apple's built-in software. He's been doing it for years. The software itself isn't reporting falsehoods. It's not like that. What it does is hide the complexities of managing software updates for literally hundreds of millions of devices.

The idea is to make you think that you can't trust Apple software, that Apple software isn't secure, that Apple isn't trustworthy, that your personal information is at risk. You've installed that software and believe what it says. You've installed 3rd party security software in a false belief that you need it. And you've installed software that people use for piracy in a false belief that it will help protect your personal information. In fact, the only people who need 3rd party antivirus in the first place are those who install pirated software on purpose. On a Mac, there is no way to install malware otherwise, in spite of what you've been told.

Your Apple device is most secure, your personal information is most protected, when you use default settings. Every 3rd party software you install will reduce your security by some level. Some software more than others. Software that requires your administrator password to install will reduce your security and privacy by the greatest levels.

Those are part of the operating system. The one you have highlighted clearly shows it is located in /System/, which is a read-only location controlled by Apple.

Some of the other things you've mentioned still merit more investigation. But these files are not part of the problem.

I recommend focusing more on these points:

My system is very slow. The longer I use it the slower it seems to get.

That's not normal.

On login, an application called "Installer progress" is open for a split second. It appears on dock momentarily and in the left top corner of the screen, as any running application would. This application can be found in System >Library>CoreServices>

That's also not normal. However, these things can get complicated. While "Installer" is a normal system app, it should not be doing what you describe. Sometimes Apple apps are directly used by 3rd party apps. That's fine and normal. But all that being said, there are lots of things that you simply shouldn't be installing, even if you use the Apple "installer" to do it.

The most likely explanation for this is some 3rd party auto-updating system. Microsoft Office, for example, will display a message very similar to this. But the Office message clearly says what app it is updating.

My firewall preferences seem to keep switching themselves to allow built in software to receive connections when I had that switched off whenever I close system settings.

That's a well-known bug. Don't worry about it. The built-in Application Firewall is useless anyway. It's just Security Theatre. There is a reason why Apple hasn't bothered to fix this bug for years. Whether the bug is fixed or not, the Application Firewall isn't going to do anything either way.

But by "focus on these issues", I mean ask about them. Provide more details. Please don't go looking or digging around. There are far too many irrelevant details about the operating system that will prevent you from finding anything. You'll see something that looks obviously wrong, not realizing it is perfectly normal.