Does it mean that my mac could've been remotely controlled? Can I delete this somehow? Or this ARD feature appears among every Mac?
MacBook Pro, OS X Yosemite (10.10.3)
The Apple Remote Desktop client software is part of Mac OS X; the administration application isn't. It's typically used in educational and corporate networks; if you're not on one, you can just ignore the update.
(128655)
The Remote Desktop Client Update Version 3.8.4 that is being distributed by the Apple App Store has been modified and is not the same version that is included in the Yosemite OS X 10.10.5 installer. Upon running 'Verify Disk Permissions' from Disk Utility, I receive this; "Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAg ent" has been modified and will not be repaired." This "Update" has been distributed by the Apple App Store since March, 2015.
The full installer of Yosemite OS X 10.10.5, released August 14, 2015 installs Remote Desktop Client version 3.8.3, and this file has not been modified. This led me to the question, if the Remote Desktop Client version 3.8.4 is the newest version released by Apple in March, then why is this version not the same version that is included in the Yosemite OS X 10.10.5 released on August 14, 2015? Why do I have to install this version from the App Store after a clean install of Yosemite OS X 10.10.5?
After opening both versions in Console and comparing these files, it is obvious that version 3.8.4 has definitely been very modified and appears to be a hacked file. How did this version get into the Apple App Store? Was this version really released by Apple?
If you have installed version 3.8.4 from the App Store at any time since March 2015 and have only updated your Yosemite OS through the App Store updates then this modified file is in your system.
To uninstall Remote Desktop Client completely from your system follow this path: System/Library/CoreServices/RemoteManagement, select this folder, right click and select "Move to Trash", you will then be asked for your Password.
To remove only the modified file, follow the same path and then continue to /ARDAgent.app, right click on the app and select "Show Package Contents" then continue this path, /Contents/MacOS/ARDAgent, right click on this ARDAgent file, select "Move to Trash" and authorize with your Password.
Then go to Finder > Empty Trash... or better yet, Secure Empty Trash....
The 3.8.4 version is current. The permissions warning is irrelevant.
It is very relevant, I have been having someone getting into my system and I believe this is how. Open the ARDAgent file in Console and read it, I believe you will find it alarming. I have been in contact with Apple all morning and they are sending this to engineering for investigation.
Think about it! Why would Yosemite 10.10.5, just released Aug. 14th, not include the most current version on a clean install if the most current version was released in March??
Ask Apple, I am not parley to their OS development procedure.
I did ask Apple, as I said, and they are investigating.
Let us know when they tell you the result.
JWDemon, the message you keep claiming to be some kind of a 'warning of a hack' is actually explained by Apple as something you can safely ignore…
Mac OS X: Disk Utility's Repair Disk Permissions messages that you can safely ignore - Apple Support
You have put 2+2 together & made 5, try again.
stranger22, ARD is a built in part of the OS & nothing to worry about. You can use it on a local network if you have multiple Macs or use Back To My Mac via iCloud. Messages app also has the ability to allow you to hand control over to someone else (if they are helping you fix something etc). It is all managed by you and having the service turned off is fine if you do not need to use it.
stranger22 wrote:
Does it mean that my mac could've been remotely controlled? Can I delete this somehow? Or this ARD feature appears among every Mac?
Your Mac has not been remotely controlled, and you should not delete parts of OS X (which will be replaced at the next OS update/upgrade. Stop worrying and enjoy your Mac.
HAHAHAHAHAHA! I've been enjoying my Macs for 20 years, I started with Mac OS 6! And the Remote Desktop Client files are only required if needed by a Remote Desktop Admin application, which my machine does not!
But as to your remark that they will only be replaced upon the next OS update/upgrade, Yes, that is my point! The version being installed by the App Store was available 5 months before the OS version that I installed Fresh and Clean, I should not have had to install it from the App Store! And BTW, I was also involved in the Yosemite Public Beta Testing so I know when the 3.8.4 update was installed on my system from the App Store, it was never included in the OS.
But you enjoy your Mac! HAHAHAHAHAHAHA!
I was not addressing you (you can tell by reading the post, the bit where it says 'in response to stranger22 is clear enough even for you to comprehend it)
JWDemon wrote:
HAHAHAHAHAHA! I've been enjoying my Macs for 20 years, I started with Mac OS 6! And the Remote Desktop Client files are only required if needed by a Remote Desktop Admin application, which my machine does not!
That is not true. Screensharing is built in to OS X, it uses ARD. The Remote Desktop application is not required to use the ARDAgent.
Please drop the comedy attitude & post logs, if you want your claims to be taken seriously give us something to go on.
I don't use Screensharing either so why would I need it for that, and Yes, the Remote Desktop Client is needed for the Remote Desktop Admin Application to make a connection!
Just delete it, in fact just delete everything you don't need. That'll take care of the issue.
Why do I get this update? I never use ARD. How do I delete this?
