autoupdate window question

In my case, the same AutoUpdate authentication prompt came from an update to the app, 'Screens Connect', by Edovia Inc:

It isn't part of Mavericks.

Try running this program and then copy and paste the output in a reply. The program was created by Etresoft, a frequent contributor. Please use copy and paste as screen shots can be hard to read.

Etrecheck – System Information

I have the same message when I have "Duet" running on my Mac. If I quit the application, the messages stop coming. Found this by gradually quitting all running applications (remember also the ones running in the background).

Good luck on your hunt

Stan

Why do I keep getting that same pop-up message every few days? This only just started recently after my internet service provider asked me to download something for them to have me share my screen with them. Is this is a virus? Is it spyware?

Andrej wrote:

This only just started recently after my internet service provider asked me to download something for them to have me share my screen with them.

Why did they do that? Did you call them for help with a specific issue? And if so, did you use a known good phone number?

If you Googled the number and just called the first one you saw, or if someone called you out of the blue claiming to be your ISP and telling you that there's a problem somewhere, then you got scammed. If this is the case, your computer is compromised and will need to have its hard drive erased and everything reinstalled from scratch.

That is ridiculous. TWC does not compromise computers. Why would they call me out of the blue?

Stranger things have happened; scammers are everywhere. Did you initiate the call or did they call you? I'd not ever share anything on my computer with a stranger; I didn't even allow Apple support personnel do it (when i called them due to a problem with my MBP) and they understood my hesitation. I would erase and reinstall the OS just to be sure.

Andrej wrote:

That is ridiculous. TWC does not compromise computers. Why would they call me out of the blue?

You seem not to understand the point of the questions. The point is that there are many fake tech support scams out there that will involve gaining remote access to your computer. The point is that we don't know if you were actually talking to TWC or not. An additional point, now that we know you use TWC, is that I have had service from TWC for about a decade and have never had them request remote access to my computer in response to any technical support inquiries. Thus the questions.

Hi, ezdz:

FWIW, I too have recently started seeing this dialogue box from time to time. The (PathFinder) Get Info box for the Trash'ed Autoupdate app starts off as:

I have saved a copy for dissection—if someone can direct me where to look and for what. The system.log contains the following lines including the string "Autoupdate" (and coincident with the time when the dialogue box popped up):

=======

Jan 26 22:34:55 Alina-2.home Autoupdate[14458]: Sparkle: releaseFromQuarantine

Jan 26 22:34:55 Alina-2 kernel[0]: Autoupdate[14458] Unable to quarantine: 93

[ when seen under the "All Messages" heading in the Console, the previous line occurs 499 times with the identical time-stamp ]

Jan 26 22:35:18 Alina-2.home Autoupdate[14458]: Sparkle: releaseFromQuarantine after installing

Jan 26 22:35:18 Alina-2.home Autoupdate[14458]: Sparkle: mdimporting

=======

Highlighting the four above log entries and calling up the Console/Inspector displays (sorry about the screen-shots; I don't know how to copy the text other than highlighting line-by-line):

=======

=======

=======

=======

=======

The sparkle-project web-site (reading from the "Facility" entries above) seems to be legit, and features the icon of the "Autopudate" app that lands in the Trash. So, I'll hazard (wishfully) guessing that this it is a legitimate background app checking for updates on another app that I have installed, apparently on 12/07/2014. I now wish I kept tabs... (Perhaps someone here can guide me to unearth what did I install on 12/07/2014... 😊) However, something's awry with permissions, and when "Autoupdate" cannot write (perhaps to its log, again guessing wishfully), it throws up the permission dialogue box. I cannot seem to find a contact info for the sparkle-project folks, to ask about this behavior and whether it is possible to track which app is initiating these Autoupdate runs and what is the problem.

Although the Autoupdate version you cite is 1.6 while mine is 1.8, can you verify that you have the same "Autoupdate" showing up? Then we could try to figure out whose update (or what else) it is chasing...

Thanks, Tristan

You can go to About this Mac > System Report > scroll down to Software > Installations. It shows the date the app was installed.

Do you know why you have 16 entries in the hosts file?

These can be used to redirect your Mac to malicious sites on the internet. If you didn't create them then it would be a good idea to look at what they are.

They can also be used to setup local websites for development, so they may not be an issue but they are not part of OS X and some bad software can use them against you.

In /Applications/Utilities/Terminal you can run this command to view the contents of that file…

cat /etc/hosts

Hit return after entering that line. Post the output if you want help with it, you cannot just delete the file - parts of it are required by the OS.

I also noticed SIMBL is installed…

net.culater.SIMBL.Agent.plist

http://www.culater.net/software/SIMBL/SIMBL.php

It is very old & is not designed for 10.9, you may want to remove that - it alters the OS to do things that Apple didn't intend, it can make odd things happen.

Another user suspects UTorrent for this Autoupdater - do you have that installed?

I keep getting a message from Autoupdate(1.6) asking for a password for my user login. Is this malware?

Next time it happens if you have Dock icon showing for the app (it should look like that disk with the 3 lines) cmd+click the dock icon - that will reveal the running application in the Finder. Then get info on the application, the file path may help reveal what it is a part of.

Screenshot the Info pane & post it here please.

Hi, babowa:

Thanks; I just did. This shows no installation on 12/07/14, but a day later I installed XtraFinder. If Autoupdate is indeed an update-chaser bundled with other apps, its creation date may well predate the installation. In my case, it may have been bundled with any program I installed after 12/07/14.

Also, to clarify: the "Autoupdate" app does not show up anywhere (at least on my system) until—intermittently—that dialogue box shows up, it gets dismisses one way or the other, and THEN the "Autoupdate" app turns up in the Trash.

By the way, I just noticed that the "About this Mac > System Report > Software > Installations" list does not show all installations! I have just downloaded and installed EtreCheck, and that does not show up. Within the last two weeks, I have installed at least four other programs (AKVIS Refocus, PopChar, Skype and VLC) that do not show up. Hmm...

However, I did find something useful: I had previously moved the "Autoupdate" app from Trash to a folder with other info relating to this issue. Checking "About this Mac > System Report > Software > Applications" did find (only) that copy of "Autoupdate" and shows for it the following information:

=====

Autoupdate (1.8:

Version: 1.8.0

Obtained from: Identified Developer

Last Modified: 12/07/14, 18:35

Kind: Intel

64-Bit (Intel): Yes

Signed by: Developer ID Application: Richard Koch, Developer ID Certification Authority, Apple Root CA

Location: /Users/tristan/Desktop/Test/Autoupdate/Autoupdate (1.8.0).app

=====

and... I happen to know Richard Koch, and will ask him. I'll report back on this when I know more.

Thanks, Tristan

Try cmd+click on the app icon when it reappears it will reveal the item in Finder with luck it will be inside the App that needs updating.

It looks like a known issue too…

https://github.com/sparkle-project/Sparkle/issues/470