Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

ARDAgent hacked?

Can someone tell me why disk utilities disk permission repair keeps turning up the same problems? I'm particularly curious about this problem:


Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAg ent" has been modified and will not be repaired.


I'm nervous because I recently realized that my firewall was inactive, both on my wireless modem as well as on my computer, and when I google ardagent, it seems to have something to do with remote access. Have I been hacked? I ran "iantivirus" and "macscan" which didn't turn up any issues...


My sydtem has been acting weird lately. In photoshop all of a sudden I can't crop an image or a background file is active and I can't activate a front document. also when saving files. typing in the file name in the save dialogue box takes forever...




Repairing permissions for “Macintosh HD”

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/zh_TW.lproj/RemoteDesktopMenu.nib" , should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/zh_TW.lproj/RemoteDesktopMenu.nib" .

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/zh_TW.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/zh_TW.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/zh_TW.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/zh_TW.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/zh_CN.lproj/RemoteDesktopMenu.nib" , should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/zh_CN.lproj/RemoteDesktopMenu.nib" .

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/zh_CN.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/zh_CN.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/zh_CN.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/zh_CN.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/ko.lproj/RemoteDesktopMenu.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/ko.lproj/RemoteDesktopMenu.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/ko.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/ko.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/ko.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/ko.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Dutch.lproj/RemoteDesktopMenu.nib" , should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Dutch.lproj/RemoteDesktopMenu.nib" .

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/Dutch.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/Dutch.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Dutch.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Dutch.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Italian.lproj/RemoteDesktopMenu.ni b", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Italian.lproj/RemoteDesktopMenu.ni b".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Italian.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Italian.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Spanish.lproj/RemoteDesktopMenu.ni b", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Spanish.lproj/RemoteDesktopMenu.ni b".

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/Spanish.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/Spanish.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Spanish.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Spanish.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/French.lproj/RemoteDesktopMenu.nib ", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/French.lproj/RemoteDesktopMenu.nib ".

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/French.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/French.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/French.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/French.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/German.lproj/RemoteDesktopMenu.nib ", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/German.lproj/RemoteDesktopMenu.nib ".

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/German.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/German.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/German.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/German.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Japanese.lproj/RemoteDesktopMenu.n ib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Japanese.lproj/RemoteDesktopMenu.n ib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/Japanese.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/Japanese.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Japanese.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Japanese.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/English.lproj/RemoteDesktopMenu.ni b", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/English.lproj/RemoteDesktopMenu.ni b".

Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAg ent" has been modified and will not be repaired.

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/English.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/English.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/English.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rwxr-xr-x .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/English.lproj/MainMenu.nib".

MacBook Pro, Mac OS X (10.6.8), 2x2.26 quad core, 32gb ram

Posted on Dec 3, 2011 7:40 AM

Reply
Question marked as Best reply

Posted on Dec 3, 2011 9:22 AM

Disk Utility permissions repair messages you can safely ignore.


Basically as updates come and go some items get moved, but DU is still looking for them in the original location because that's where the original installer package says they should be. That's the case with ARD (Apple Remote Desktop). Others have had permissions changed during updates and DU dutifully sets them back to the original.

The list will be longest if you've done an 'install in place' over Leopard.


The bottom line is that if you're not having problems, there's no need to repair permissions. And if you are having problems, permissions repair will be irrelevant in most cases (though harmless time-wasting).

17 replies
Question marked as Best reply

Dec 3, 2011 9:22 AM in response to blabladkojwio

Disk Utility permissions repair messages you can safely ignore.


Basically as updates come and go some items get moved, but DU is still looking for them in the original location because that's where the original installer package says they should be. That's the case with ARD (Apple Remote Desktop). Others have had permissions changed during updates and DU dutifully sets them back to the original.

The list will be longest if you've done an 'install in place' over Leopard.


The bottom line is that if you're not having problems, there's no need to repair permissions. And if you are having problems, permissions repair will be irrelevant in most cases (though harmless time-wasting).

Dec 3, 2011 2:48 PM in response to blabladkojwio

There are a curious number of them, but the majority appear to be language localisation files and the permissions differences are minor.


Having your firewalls down is of course potentially dangerous.


You say there's been erratic behaviour too, so I guess nothing can be ruled out. There are more expert contributors than me in this field, but my first instinct would be to disconnect the suspect machine from the internet by removing the modem phone cable and switching off Airport, then connecting to the router by ethernet (assuming it has wired ports). Reset the firewall and enable stealth mode, check for open ports, make sure Up&P is off.


If your wi-fi is using WEP change it to WPA2 personal if possible and in any case change the password for a seriously robust one. Reset the Airport settings in Network Preferences and Airport Utility as required.


For belt and braces you can also enable the OS firewall, but that shouldn't really be necessary and can cause some connectivity problems.


Re-connect to the net when you're happy that all's as secure as it can be.

Mar 6, 2012 2:12 PM in response to blabladkojwio

Ah, one more thing... Two, actually. When you look in the core services folder for Remote Management, do yourself a favor- hit 'date modified' up at the top to organize the Core Services folder. There may be some files changed that shouldn't be, such as languages- you'll want to check your Java folder as well, because that's how this gets in. All those files that have been changed more recently than they should've been you'll want to get info on, add yourself under permissioms (read and write) and change 'everbody' to no access. Don't toss the folders- you need them. There may also be some other weird folders hanging out- such as 'deferred install' next to library in system, or 'damaged files' (which would be quarantined in a different location if it were supposed to be there). Those you can toss. You may want to do the safe compression trick first (zip+lock) just in case, but it didn't hurt anything for me...


The second thing is, yes you should have your firewall on, and by that I mean the Apple firewall. You can even set it to block all incoming connections- it won't hamper your ability to use anything unless you do P2P sharing or certain sorts of gaming. Keep in mind this won't prevent things like ARD agent and such from showing up, because they get in through a program or [Java]script you run. That could be a great many things- video players, Facebook, Gmail elements, and add-ons of all kinds. It's not necessarily the apps themselves that are bad, then just provide port access into your computer. Once inside, the bad program sets about changing all sorts of things, and hides itself pretty well. It will also employ anti-detection and removal methods, such as you accessing information on it or doing certain sort of wipes/repairs- things get worse the longer the problem exists, so it's much better to protect your machine first with the Intego/Deep Freeze/Cocktail combo I mentioned. Apple would be wise to create its own protection services and charge some outlandish fee for it, but for whatever reason they haven't caught onto that. Too busy counting stacks of million dollar bills to worry about user security, I suppose. Yes, I know those don't exist... Or (in Big App's case) do they?

Mar 6, 2012 4:44 PM in response to blabladkojwio

blabladkojwio wrote:


Can someone tell me why disk utilities disk permission repair keeps turning up the same problems?

The information provided by noondaywitch is accurate. I strongly suggest ignoring jhillgate's posts (not just because his manners leave much to be desired).


When Apple's installer performs an installation, it leaves behind 'receipts' which indicate what files were installed, where, and with what permissions. When Disk Utility repairs permissions, it goes through these receipts and restores a file's permissions to their values at installation. (You need to understand that Disk Utility only goes through Apple's receipts and resets permissions only on software installed by Apple; third-party software may use the same installer and leave receipts, but DU will not check these. Nor does DU check permissions in your Home folder; the latter may be reset with a different method.)


Current permissions may differ from the installation values for various reasons. In some cases, it could simply be a mistake -- Apple engineers simply forgot to set them to the correct values, or just ignored them, or the engineer in charge of the installer script didn't get the memo from the engineer in charge of the ARD software. In many cases, though, there's no mistake involved -- the OS resets some file permissions during normal operation. Consequently, messages such as the ones you cited can be ignored, as the Apple KB document to which noondaywitch referred you indicates. For practical purposes, again as noondaywitch told you, as long as DU completes the operation successfully, you needn't worry. And, also as noondaywitchtold you, in the overwhelming majority of cases, repairing permissions is pointless as well as harmless.

I'm nervous because I recently realized that my firewall was inactive, both on my wireless modem as well as on my computer

How serious this is depends on your set-up. Probably the most common home set-up is


ISP → network device → router → Mac


The network device can be a DSL 'modem', or CATV 'modem', etc, and it may be combined in a single device with the router.


Contemporary routers, as well as Macs, come with the firewall enabled by default, so, if they were disabled, you (or someone who has access to them) must have disabled them for whatever reason (eg, troubleshooting). In a set-up as above, the router's firewall is the most important, because that's the interface between the Internet and your LAN (home network). Although turning off the router's firewall is extremely unwise, the router also does NAT, so chances of someone from the Internet penetrating your Mac are quite small. Once again, noondaywitch's advice in this respect is sound, and you should follow it.

My sydtem has been acting weird lately.

A common reaction to computer problems is to ask, "have I been hacked?" or, "do I have a virus?". The answer is, in all likelihood, no. Although malware does exist, and it does cause problems, in most cases that's about the last thing you need to worry about. IMHO, I think this reaction is due to the fact that most users don't really understand how computers work and how software is written. Given the way it's all put together, the surprising fact is not that it sometimes acts weirdly, but that, often enough, it actually does work.

Mar 6, 2012 4:50 PM in response to fane_j

My God, that's a load of false comfort... incredibly vague, inspecific, and misleading false comfort. Because you and your friend are too lazy to simply look for yourselves, let me refer you and all seekers of the actual truth to this:


http://www.macworld.com/article/134165/2008/06/ardagent.html


That's just a very general, top-of-the-heap article. The fact that you both assume all items originally installed by Apple must be correct and cannot be modfied tells me where you're at with things... Please quit spreading disinformation, and piggybacking each other's attempts to confirm it. You're making me laugh.

Mar 6, 2012 4:59 PM in response to blabladkojwio

blabladkojwio wrote:


For some reason I can't go onto this website on my computer after posting this message

Coincidence.

how can I know for sure that nobody is logged onto my computer?

As for "logged in", you can use the users command in Terminal


$ users


More details can be obtained with the who and finger commands. You can read the manual pages for these commands with the man command; eg,


$ man who


will display the description, syntax, and supported options for who.

Mar 6, 2012 5:21 PM in response to jhillgate

jhillgate wrote:


let me refer you

(1) Which part of the statement, "Anyone running OS X 10.4 or 10.5" in that article did you fail to read?


(2) Which part of the statement, "You, as a user, must run a malicious program for your machine to be compromised" in that article did you fail to comprehend?


(3) Which sentence in the article says that changed permissions is an indication of anything?


This forum is dedicated to Mac OS X v10.6 Snow Leopard. The security hole discussed in that article does not exist in this version of the OS, which you can test. Indeed, as you should have tested prior to posting. I draw your attention to §2.5 of the Terms of Use ("Test your answer. When possible, make sure your Submission works on your own computer before you post it."). I draw your attention also to §2.2. If, for some reason, you are unable to find the Terms of Use, they are available here


<Apple Support Communities Terms of Use>

Mar 6, 2012 5:24 PM in response to fane_j

Of course, those commands only work at the time of their use... Won't help a bit if you're not asking during the brief windows the captured data is being transmitted, at which point the unauthorized user will most likely only show up as 'root' (which doesn't seem suspicious). After all, once the bad data is written in, no continued direct access is needed to ping for information- only to update/add to the malicious files already installed. If a simple Terminal command showed 'hacker' or 'backdoor trojan', that wouldn't be a very good job, would it?


All the manners in the world won't make up for lack of pertinent information... ; ) You think I'm rude? You should meet some of the people designing methods of infiltration... Actually, taking that into consideration, politeness may be a direct indicator of uselessness in these matters!


I'm enjoying the lols, though... Keep 'em coming.


By all means, bring more friends!

Mar 6, 2012 5:55 PM in response to fane_j

1) At the time the article was written, that was relevant. The issue has certainly not gone away, or been resolved.


2) I did mention that being a very general article- any malicious script will do... such as JavaScript, or that which employs commonly installed programs (Quicktime, Flash, Silverlight).


3) I didn't... Not once. I actually only described the problem I myself was having, and the only way I was able to fix it- and only on one machine. That would be both on a MBP running Snow Leopard, and another on Lion. Not that it's any of your business, but that actually puts me in exactly the right place.


I have indeed suffered the same errors, freezes, glitches, repetitive kernel panics as the obviously less experienced user who asked the initial question. I have indeed emplyed far more knowledgeable sources than yourself, and spent (literally) thousands of dollars trying to correct this and other issues. In the end, only the technique I used above corrected the issue- and only on the one computer.


So I have complied with the terms of service, and tested all of this myself. Please knock off the naysaying- you're not helping anyone. And perhaps the moderators you continue to report my 'rudeness' to would do well to read my actual replies to the person who asked the question- such as where it says 'what I did'.


But I see you've already had it deleted... That's fine. I'm hardly surprised. Confirm my suspicion that this forum is utterly useless- meant only for those who don't know and can't Google ('How do I underline?'). Good luck with that.


I'm sure the poor kid actually learned to help himself after this waste of time!

Mar 6, 2012 6:10 PM in response to jhillgate

jhillgate wrote:


1) At the time the article was written, that was relevant.

That was 2008. This is AD 2012.

The issue has certainly not gone away

Prove it.

that which employs commonly installed programs (Quicktime

Please demonstrate how one may use QuickTime to make ARDAgent launch shell scripts as root. (Which is what the article in MacWorld is about.)

3) I didn't... Not once.

In that case, you're OT. Please read the OP's first sentence.

Mar 6, 2012 6:54 PM in response to fane_j

I see you have a little buddy... That's nice. Again, no surprise.


Why don't you prove to me ARD infiltration isn't a problem for anyone? Especially the OP, who asked their question 12/3/11 AD? As a matter of fact, there's your proof... If it weren't a current problem, they wouldn't have asked the question. You can have the solution deleted, but you're still wrong 😁. If I were you, I'd have them delete the whole thread- just to be safe!

Mar 6, 2012 7:25 PM in response to blabladkojwio

I'm going to post this again, because it's the right😁 thing to do. I have had this problem, and indeed still do on one of my laptops. I am running the relevant version of Leopard to post my solution in this forum. If this solution is deleted, then that is clearly a biased breach of Apple's own guidelines.


Just to be 'polite', we won't call it a 'problem.' Lets just call it an 'unwanted file', as located by a certain permission error which will remain nameless...


Go to mac hd/system/library/coreservices/remote management. Right click for info, and enter your admin password to add yourself as a user with read/write access. Click on the gear next to the lock and hit 'apply to contents'. Then right click on the file again, and compress it so you have a zipped file for later (in case you want to use Remote Desktop yourself in the future). Now drag the original file to the trash, open the trash, and opt-click to delete it. I have had some issues with it saying certain processes were stil running- that weren't connected to the files I was trying to delete- and therefore not being able to continue. However, that was one the computer (running Leopard) that has had this issue for 1 1/2 years. I would be interested to know if anyone has had a similar issue there. However, on the computer I am using right now, this solution worked fine. When I ran DU again, the permissions were fine. I guess it 'will be repaired' after all!


Please look up 'ARD agent' (try to stick to [ahem] non-corporate sites) yourself for further information. I will post this information elsewhere, as I believe this particular thread has been blocked from public view.


I am going to post these pictures as 'proof' of it being a personal issue, uneccessary as that should be.


User uploaded file

User uploaded file


User uploaded file


Good day.

ARDAgent hacked?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.