“Unknown” pops up wanting to find devices every time computer starts

Mike Naylor wrote:

I'll report back here when Bitdefender is done - if I haven't been banned by then.

Oh you won’t be banned, you’ll just be ignored by your fellow users here. With your attitude no one will be willing to help you in any way in the future. And as has been pointed out no Apple employees see this forum except for moderation and terms of use violations. Apple Support neither participates in nor monitors these user forums. Good luck.

Mike Naylor wrote:

Some people say EtreCheck is malware, so I'm not prepared to download it.

Are you, Mac Jim ID, an Apple employee?

No one here is an Apple employee, no one! We’re all just fellow users trying to help each other with issues and problems.

As for EtreCheck it is developed by a longtime and trusted member of these user forums. He has responded to your post below. Again, @etresoft is a longtime and respected contributor to these forums. EtreCheck is definitely not malware by any means and has saved many users bacon by sorting out the cruft that they install without thinking. Many times it’s something that was installed years ago and forgotten about. Then when an update or upgraded is released it rears its ugly head to cause trouble.

I don't have Xcode installed, but I do have the compiler, etc, installed (I forget what these "extras" are called). However, the "Unknown" msg box issue after logging out has ceased since upgrading to macOS 27.2 update.

I traced this to Xcode and having intelligence turned on

To fix it launch Xcode

then settings-> intelligence -> set Allow External Agents to Use Xcode Tools to Never

Mac Jim ID wrote:

Every user has those 3 Launch Folders

The one in the user's home folder only exists if there are launchd config files there.

All of these folders are obsolete. The modern way to implement launch agents and launch daemons is inside an app bundle. So just because there aren't any files there, doesn't mean there aren't any launch agents.

The EtreCheck report is the best approach to see what is running on your computer

But it's not going to help in this case.

This is a well-known bug with certain 3rd party apps. There's no way to fix it except for uninstalling those apps. Apple support can't help either.

The malware concerns are just standard internet-fuelled paranoia. There's nothing that anyone can do about any of this.

Every user has those 3 Launch Folders, but instead of using the Finder to view them with the clear steps to follow, you resorted to Terminal where that resulted in the last one not being found. I do suspect you have User Launch Agents running on your computer, but it is now unknown.

The EtreCheck report is the best approach to see what is running on your computer, but you have chosen not to use that which then becomes a much longer back and forth of screenshots and further steps to take. You seem to be concerned about being banned with your post, but don't you think a user that created software that is recommended here would be banned if that software was Malware, and also the user who created the User Tip for the steps to take to post that report on this website.

BitDefender is useless. Expect to find many files it flags and false positives. They really want you to subscribe to their service and claim that doing that will solve your problems. It won't.

If you don't want to follow any of the recommendations here, then contact Apple directly or schedule an appointment at the Apple Store.

Contact Apple Support - Apple Support

Mike Naylor wrote:

I've never used pirated software, music, videos or images

Then you don't have any malware. Stop wasting your time.

Furthermore, I've always used the official browsers and email clients, so when you say "You are not" and "Clearly not true", you are completely wrong.

Oh really???

Oh, and my "somebody" comment came from a Google search using the "EtreCheck" and "malware" keywords - try it for yourself.

Yes. I'm well aware of that site. Don't believe what you read on the internet. The internet's not true.

The author of that site was once a user of this site. About ten years ago, he was starting a long list of unhinged threads. Here's just one example. The Apple moderators have cleaned up most of the mess, as they typically do. I tried to engage with this person to explain how things work and ease his anxiety. It didn't work. When I complained that he was resurrecting old threads that had been dead for years, he began his campaign to claim that EtreCheck was malware. But this guy isn't even the stalker I mentioned. That's someone else. At least this guy finally gave up his crusade after a couple of years. Sadly, Google is happy to host his lies for all eternity.

(But curiously, even though I remember this incident well, I had a lot of trouble finding those threads on Google. I had to make the same, repeated search on both Google and DuckDuckGo and then the results magically appeared. Sometimes I can see why people become unhinged after spending too much time on the internet. Perhaps it's by design.)

I'm security conscious

You. Are. Not.

suspicious of anything recommended by someone I don't know

I've already told you that EtreCheck isn't going to help you in any way. I developed the app and I'm recommending that you don't use it. Please don't download it!

So how do you feel about recommendations from people you don't trust? Are you going to download EtreCheck now? Please don't!

think your attitude is agressive and arrogant.

You are the one who came onto this site and took over someone else's legitimate question about local network access so you could insult people, spread malware paranoia, and repeat malicious lies you found on the internet.

That said, and getting back to the topic, I'm currently running a Bitdefender Deep System Scan.

That is not the topic. That's just nonsense you started spouting when you came here to take over the thread.

It's taking a very long time, because its also scanning the Time Machine.

Can't be too safe...better scan it all...

This isn't because I'm blaming Apple, but because the hackers are always one step ahead.

Aren't they always?

My only ground for suspecting malware is for what happened when I clicked on one of links Google came up with

Right...because you're so "security conscious"?

Then followed panic and prayer. Shutdown, reboot, search for reported incidents, etc. and blah, blah blah.

You obviously didn't come here. Those fake pop-up scams are very common. You could have asked a question about that and gotten a quick answer that would have saved yourself a lot of time, panic, and prayer.

One other thing I haven't mentioned is the occasional display flickering, which may or may not be relevant.

It is not.

the 2 Visual Studio switches (why 2?)

Because it's poorly made software that causing mysterious pop-ups on your computer.

Regarding the recommendation to post screenshots. There is no point

I'll give you that one...

I'll report back here when Bitdefender is done - if I haven't been banned by then.

You're wasting your time.

I had no idea who the developer of EtreCheck was and neither had I heard of it until it was recommended here. My first computer was a Commodore PET, one of the first imported to the UK, and I've been writing software ever since. I've never used pirated software, music, videos or images - even when I used Windows for a number of years. Furthermore, I've always used the official browsers and email clients, so when you say "You are not" and "Clearly not true", you are completely wrong. Oh, and my "somebody" comment came from a Google search using the "EtreCheck" and "malware" keywords - try it for yourself. So now you know, I'm security conscious and suspicious of anything recommended by someone I don't know and think your attitude is agressive and arrogant.

That said, and getting back to the topic, I'm currently running a Bitdefender Deep System Scan. It's taking a very long time, because its also scanning the Time Machine. This isn't because I'm blaming Apple, but because the hackers are always one step ahead. My only ground for suspecting malware is for what happened when I clicked on one of links Google came up with when I was searching for a better photo catalog than what I currently have - something like Apple had back in the day.

The link took me to a black screen with the standard Apple alert waring the webpage would not be secure. Simultaneously, a small white text box with black text flashed up in or near the top right of the tab bar, accompanied by a loud tone of about 3kHz. Both vanished after a few hundred milliseconds. During some of the black text contained the word "Malware". Naturally, I chose not to open the page and closed Safari.

Then followed panic and prayer. Shutdown, reboot, search for reported incidents, etc. and blah, blah blah. But during this phase I logged out (something I rarely do) and was presented with the "Allow "<unknown>" to find devices on local networks?" message box.

One other thing I haven't mentioned is the occasional display flickering, which may or may not be relevant.

The apps listed in System Settings->Privacy & Security->Local Network

Visual Studio Code.app

Visual Studio Code.app

Arduino IDE.app

BambuStudio.app

I suspect this page is not behaving correctly. When first entered I have all the switches set to the right, but the colour is grey. Clicking any switch changes the colour to blue, but they revert to grey after about one second. Also, the 2 Visual Studio switches (why 2?) operate together. However, I have tried setting all the swipes to the left, but this hasn't affected the log out message happening.

Regarding the recommendation to post screenshots. There is no point, because both folders are empty - in the finder and from the command line.

I'll report back here when Bitdefender is done - if I haven't been banned by then.

Mike Naylor wrote:

I didn't intend to insult anyone

You literally called me a malware developer. Is that not an insult?

only wished to know who I was talking to.

But the way you said it immediately made me think that you might be a certain malicious stalker. He's primarily the one who's been telling anyone he can find on the internet that I'm a malware developer for the past 10 years.

However, your posting history suggests that you aren't said stalker.

I'm always security conscious

You are not.

and not one of those who downloads everything they can find.

Clearly not true.

So what next could I try? Is there a free malware scanner I could run?

I don't know if you have malware installed or not. The only way Mac users get malware is by installing it on purpose. Usually they are installing a pirate version of some expensive app. Or perhaps they installed their malware trying to watch some paid video stream or sporting event. But in all these cases, they will have to purposefully bypass multiple layers of Apple malware protection. If you didn't do this, then you don't have any malware.

This thread was started by someone reporting a well-known problem with local networks. You said you also experienced this problem, but attributed it to your attempts to access a malicious website. Most likely, the operating system kept you well-protected and the worst you experienced was a fake pop-up message trying to get you install, ahem... some "clean up" app.

If you're still interested in solving the "local network" issue, the cause is one or more of those apps you've downloaded. Certain popular apps are neither built, nor updated, correctly. This problem has been reported to the developers of those apps, but they've dismissed those reports, choosing to simply blame Apple instead. So here we are.

Certainly Google Chrome or any variation is the top offender here. But because everyone wants to be like Google, their incorrect build practices are being copied by other apps. So if you have Chrome or some variant installed, it could be that. Or it could be some other app. If you look in System Settings > Privacy & Security > Local network, anything you see that is, or has been, duplicated will be the cause.

So what next could I try? Is there a free malware scanner I could run?

You already have a free one running.

So, who are the "some people?" I'm beginning to think they are just the security voices in your head.

I would recommend posting a screenshot of each of those locations from the Finder with the instructions that have been provided.

Thank you for responding. I didn't intend to insult anyone, but only wished to know who I was talking to. I'm always security conscious and not one of those who downloads everything they can find.

/Library/LaunchDaemons contains:

-rw-r--r--  1 root  wheel  599 May 20 14:05 com.nektony.ACUpdaterHelper.plist

/Library/LaunchAgents is empty

~/Library/LaunchAgents is not a file or directory

nektony: refers to my paid copy of App Cleaner & Uninstaller.app, so I uninstalled it using their recommended "remove" method. It also removed the plist file. Restarted and logged out - with the same "Unknown" message as before. Next I reinstalling App Cleaner & Uninstaller - this time the plist has not reappeared.

So what next could I try? Is there a free malware scanner I could run?

Mike Naylor wrote:

Some people say EtreCheck is malware, so I'm not prepared to download it.

Are you, Mac Jim ID, an Apple employee?

No, none of us here are Apple employees. If you want to talk to an Apple employee you would have to use this link:

Contact Apple Support - Apple Support

No, EtreCheck is not malware. With the moderation of this website, you would not see links posted here to download malware, and specifically a User Tip that was created by a respected Level 10 user for the instructions to post the report which contains no personal information.

You either have a process in your Launch Folders that is Not Signed or an app that contains an incomplete plist file where the Developer did not provide a name for the app to allow access to the Local Network. This could be from a much older install of software that was either migrated when another computer was set up, or an update of that software that did not remove the older unsigned process.

The EtreCheck report would identify Unsigned processes you have installed and which Launch folder it resides in, but you can manually uninstall each package one at a time and verify that the associated Launch process is also removed. You would need to continue and do this until you have successfully found the one that when removed from the Launch folder no longer displays the message on logout. Open a Finder window, choose the Go option in the menu bar and then select Go to Folder. In the text box copy/paste each of these locations to view the processes. Don't forget the "~" character in the last one. The problematic process may be in 1 or more of the 3 different Launch folders.

/Library/LaunchDaemons

/Library/LaunchAgents

~/Library/LaunchAgents

Mike Naylor wrote:

Some people say EtreCheck is malware, so I'm not prepared to download it.

Some people? Friends of yours?

No need to worry. EtreCheck won't help with this problem. Let's just say that you've been downloading too much as it is. 😄

Some people say EtreCheck is malware, so I'm not prepared to download it.

Who says that? Be specific.

Are you a bot?