Peculiar dialog PASSWORD_ALERT...

I got the dialog just now for the first time on my Mac Air on High Sierra. It could be associated with the fact that I changed my Apple password recently. After changing that password, all my Mac devices seemingly went nuts, constantly requiring me to enter my new password and enter 6 digit codes sent to me. I ran and saved the results of EtreCheck. Then I shutdown all programs and requested the system to shutdown. It didn't seem to shutdown completely, though the screen was completely dark (no little circle rotating wheel thing). I finally held the power button down for 15 seconds, then released, then pressed it again. System came up, but said a couple of things indicating some kind of OS upgrade: "setting up analytics" (or something like that) and asking me if it's OK to send diagnostic reports to Apple. It's not unusual for my laptop not to shutdown. I haven't bothered to check into it, but so far it's always worked to forcibly power it off and on. Below are the results from EtreCheck:

Problem description:

Received a weird popup, PASSWORD_ALERT_TITLE_WITH_USERNAME_OSX.

EtreCheck version: 2.2 (132)

Report generated 12/3/17, 10:45 AM

Download EtreCheck from http://etresoft.com/etrecheck

Click the [Click for support] links for help with non-Apple products.

Click the [Click for details] links for more information about that line.

Hardware Information: ℹ

MacBook Air (11-inch, Early 2014) (Technical Specifications)

MacBook Air - model: MacBookAir6,1

1 1.7 GHz Intel Core i7 CPU: 2-core

8 GB RAM Not upgradeable

BANK 0/DIMM0

4 GB DDR3 1600 MHz ok

BANK 1/DIMM0

4 GB DDR3 1600 MHz ok

Bluetooth: Good - Handoff/Airdrop2 supported

Wireless:
en0: 802.11 a/b/g/n/ac

Battery: Health = Normal - Cycle count = 105 - SN = D86441401BDF90CAV

Video Information: ℹ

Intel HD Graphics 5000

Color LCD 1280 x 720

System Software: ℹ

macOS 10.13.1 (17B1003) - Time since boot: 3 days 17:25:47

Disk Information: ℹ

APPLE SSD SM0512F disk0 : (500.28 GB)

EFI (disk0s1) <not mounted> : 210 MB

disk0s2 (disk0s2) <not mounted> : 500.07 GB

USB Information: ℹ

Apple Inc. BRCM20702 Hub

Apple Inc. Bluetooth USB Host Controller

Thunderbolt Information: ℹ

Apple Inc. thunderbolt_bus

Configuration files: ℹ

/etc/hosts - Count: 38

Gatekeeper: ℹ

Mac App Store and identified developers

Kernel Extensions: ℹ

/Applications/NoMachine.app

[not loaded] com.nomachine.driver.nxtun (4.1.b4) [Click for support]

[not loaded] com.nomachine.driver.nxusb (4.3.b1 - SDK 10.7) [Click for support]

[not loaded] com.nomachine.kext.nxfs (4.1.b1 - SDK 10.6) [Click for support]

/Applications/ScreenFlow.app

[not loaded] com.vara.driver.VaraAudio (1.0.2) [Click for support]

/Applications/TorGuard.app

[not loaded] net.tunnelblick.tap (1.0) [Click for support]

[not loaded] net.tunnelblick.tun (1.0) [Click for support]

/Applications/VMware Fusion.app

[not loaded] com.vmware.kext.vmci (90.8.1) [Click for support]

[not loaded] com.vmware.kext.vmioplug.15.2.1 (15.2.1) [Click for support]

[not loaded] com.vmware.kext.vmnet (0582.40.40) [Click for support]

[not loaded] com.vmware.kext.vmx86 (0582.40.40) [Click for support]

/Library/Extensions

[loaded] com.sophos.kext.oas (9.6.53 - SDK 10.11) [Click for support]

[loaded] com.sophos.nke.swi (9.6.52 - SDK 10.11) [Click for support]

/System/Library/Extensions

[loaded] com.digidesign.iokit.DigiDal (8.0.3d1) [Click for support]

[loaded] com.digidesign.iokit.DigiIO (8.0.3d1) [Click for support]

[loaded] com.nomachine.driver.nxau (4.1.b2 - SDK 10.8) [Click for support]

[not loaded] com.paceap.kext.pacesupport.master (5.7.2) [Click for support]

/System/Library/Extensions/PACESupportFamily.kext/Contents/PlugIns

[not loaded] com.paceap.kext.pacesupport.leopard (5.7.2) [Click for support]

[not loaded] com.paceap.kext.pacesupport.panther (5.7.2) [Click for support]

[loaded] com.paceap.kext.pacesupport.snowleopard (5.7.2) [Click for support]

[not loaded] com.paceap.kext.pacesupport.tiger (5.7.2) [Click for support]

Startup Items: ℹ

PACESupport: Path: /Library/StartupItems/PACESupport

FanControlDaemon: Path: /Library/StartupItems/FanControlDaemon

Startup items are obsolete in OS X Yosemite

Problem System Launch Agents: ℹ

[killed] com.apple.CallHistorySyncHelper.plist

[killed] com.apple.apfsuseragent.plist

[killed] com.apple.SafariNotificationAgent.plist

[running] com.openssh.ssh-agent.plist [Click for support]

[killed] com.apple.audio.AudioComponentRegistrar.plist

[killed] com.apple.protectedcloudstorage.protectedcloudkeysyncing.plist

[killed] com.apple.CoreLocationAgent.plist

[killed] com.apple.cmfsyncagent.plist

[killed] com.apple.xpc.loginitemregisterd.plist

[killed] com.apple.talagent.plist

[killed] com.apple.icloud.fmfd.plist

[killed] com.apple.printuitool.agent.plist

[killed] com.apple.printtool.agent.plist

[killed] com.apple.OSDUIHelper.plist

[killed] com.apple.CallHistoryPluginHelper.plist

[killed] com.apple.navd.plist

[killed] com.apple.SafariCloudHistoryPushAgent.plist

16 processes killed due to memory pressure

Problem System Launch Daemons: ℹ

[killed] com.apple.periodic-weekly.plist

[killed] com.apple.audio.AudioComponentRegistrar.daemon.plist

[killed] com.apple.colorsync.displayservices.plist

[killed] com.apple.icloud.findmydeviced.plist

[killed] com.apple.bootinstalld.plist

[killed] com.apple.tailspind.plist

[not loaded] org.ntp.ntpd-legacy.plist [Click for support]

[killed] com.apple.emond.aslmanager.plist

[killed] com.apple.driver.ethcheck.plist

[killed] com.apple.nfcd.plist

[killed] com.apple.captiveagent.plist

10 processes killed due to memory pressure

Launch Agents: ℹ

[loaded] com.google.keystone.agent.plist [Click for support]

[running] com.motive.alertDetectorHost.plist [Click for support]

[loaded] com.adobe.CS5ServiceManager.plist [Click for support]

[running] com.sophos.agent.plist [Click for support]

[loaded] org.macosforge.xquartz.startx.plist [Click for support]

[failed] com.motive.userAgent.plist [Click for support]

[loaded] com.parallels.mobile.prl_deskctl_agent.launchagent.plist [Click for support]

[not loaded] com.adobe.AAM.Updater-1.0.plist [Click for support]

[failed] org.chromium.chromoting.plist [Click for support]

[running] com.sophos.uiserver.plist [Click for support]

[running] com.nomachine.localnxserver.plist [Click for support]

Launch Daemons: ℹ

[failed] com.parallels.mobile.dispatcher.launchdaemon.plist [Click for support]

[running] com.adobe.agsservice.plist [Click for support]

[loaded] org.wireshark.ChmodBPF.plist [Click for support]

[running] com.sophos.common.servicemanager.plist [Click for support]

[loaded] org.macosforge.xquartz.privileged_startx.plist [Click for support]

[loaded] com.google.keystone.daemon.plist [Click for support]

[failed] com.parallels.mobile.kextloader.launchdaemon.plist [Click for support]

[running] com.nomachine.server.plist [Click for support]

[running] com.oracle.oss.mysql.mysqld.plist [Click for support]

[loaded] PACESupport.plist [Click for support]

[loaded] com.nomachine.uninstall.plist [Click for support]

[loaded] com.adobe.fpsaud.plist [Click for support]

[loaded] com.adobe.SwitchBoard.plist [Click for support]

[loaded] com.microsoft.office.licensingV2.helper.plist [Click for support]

[failed] com.motive.systemDaemon.plist [Click for support]

User Launch Agents: ℹ

[loaded] com.adobe.ARM.[...].plist [Click for support]

[loaded] com.skype.skype.shareagent.plist [Click for support]

User Login Items: ℹ

ShareFile Desktop Application
(/Applications/ShareFile Desktop.app)

Google Drive Application
(/Applications/Google Drive.app)

VMware Fusion Start Menu Application
(/Applications/VMware Fusion.app/Contents/Library/VMware Fusion Start Menu.app)

Sophos Anti-Virus Application
(/Applications/Sophos Anti-Virus.app)

Google Chrome Application
(/Applications/Google Chrome.app)

iTunesHelper Application
(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

Internet Plug-ins: ℹ

o1dbrowserplugin: Version: 5.41.3.0 - SDK 10.8 [Click for support]

Flip4Mac WMV Plugin: Version: 2.3.6.5 [Click for support]

npMotive: Version: 1.0.0 - SDK 10.7 [Click for support]

Silverlight: Version: 5.1.20913.0 - SDK 10.6 [Click for support]

FlashPlayer-10.6: Version: 27.0.0.187 - SDK 10.12 [Click for support]

SmartCamFinder: Version: SmartCamFinder 1.0.0.0 - SDK 10.7 [Click for support]

QuickTime Plugin: Version: 7.7.3

Flash Player: Version: 27.0.0.187 - SDK 10.12 [Click for support]

npwViewer_turn: Version: Unknown - SDK 10.8 [Click for support]

googletalkbrowserplugin: Version: 5.41.3.0 - SDK 10.8 [Click for support]

AdobePDFViewer: Version: 9.5.5 [Click for support]

GarminGpsControl: Version: 4.0.2.6 Beta - SDK 10.6 [Click for support]

npwViewer: Version: Unknown - SDK 10.8 [Click for support]

iPhotoPhotocast: Version: 7.0

JavaAppletPlugin: Version: 15.0.1 - SDK 10.13 Check version

Safari Extensions: ℹ

Open in Internet Explorer

3rd Party Preference Panes: ℹ

Flash Player
[Click for support]

Flip4Mac WMV
[Click for support]

MacFUSE
[Click for support]

MySQL
[Click for support]

SwitchResX
[Click for support]

Time Machine: ℹ

Mobile backups: ON

Auto backup: YES

Volumes being backed up:

Destinations:

Seagate4Tb [Network]

Total size: 4.00 TB

Total number of backups: 22

Oldest backup: 2017-10-06 00:14:39 +0000

Last backup: 2017-12-02 21:24:31 +0000

Size of backup disk: Excellent

Backup size 4.00 TB > (Disk size 0 B X 3)

Top Processes by CPU: ℹ

10% WindowServer

1% SophosScanD

1% apsd

0% fontd

0% SystemUIServer

Top Processes by Memory: ℹ

974 MB kernel_task

573 MB mdworker(19)

483 MB SophosScanD

115 MB Finder

115 MB mds_stores

Virtual Memory Information: ℹ

2.76 GB Free RAM

5.24 GB Used RAM

688 MB Swap Used

Diagnostics Information: ℹ

Dec 2, 2017, 10:26:22 AM /Library/Logs/DiagnosticReports/backupd_2017-12-02-102622_[redacted].cpu_resourc e.diag [Click for details]

Dec 2, 2017, 08:47:04 AM /Users/[redacted]/Library/Logs/DiagnosticReports/Preview_2017-12-02-084704_[reda cted].crash

Dec 1, 2017, 01:52:06 PM /Library/Logs/DiagnosticReports/backupd_2017-12-01-135206_[redacted].cpu_resourc e.diag [Click for details]

Dec 1, 2017, 10:25:34 AM /Library/Logs/DiagnosticReports/backupd_2017-12-01-102534_[redacted].cpu_resourc e.diag [Click for details]

I have now run into this on two Macs, the second replaced the first one when I couldn't stop it happening, and now a month later the second one is doing it too. Both are older machines with spinning HDs, and running High Sierra. That means they're slow, but it doesn't matter as all they do is curate a daisy chain of firewire disks used to store photographs, and run daily backups of one disk to another. In neither case did EtreCheck, Malwarebytes or Detect X show any malware, and Clam XAV says they're clean. EtreCheck did say I was having crashes of a process com.aladdin.hasplmd.plist in /Library/LaunchDaemons (this is some digital rights management process that could have got there from an installation of X-Plane with a USB key to confirm the app is registered, or more likely from X-Rite i1 software for a screen calibration device (though why that should need it isn't clear to me) and noted errors related to 'too many files open'. I see others have noticed that as well. I've deleted the files related to the HASP software and I'll see if makes a difference. The first mac to be affected by this had been doing that job without complaint for several years, and this began after it was 'upgraded' to 10.13. I see others have been getting this on older versions of the OS so that's probably not relevant. I'm thinking Garrett Davidson might be on the right track with his suggestion that some rogue app or process that crashes repeatedly is causing the error related to too may open files. Until we know for sure, simply restarting once a day might be a temporary fix.

It came back again, and did so shortly after restarting the machine. Evidently removing the launch agent associated with HASP hasn't fixed it. So knowing that ClamXAV, Malwarebytes and EtreCheck all report nothing, I decided to be brave and click on the 'PASSWORD_ALERT_SETTINGS_BUTTON_OSX' and it opened System Preferences/iCloud with a drop down dialog from the top of the pane that I have seen before 'You need to sign into iCloud again to continue using iCloud on this Mac' (as best as I can remember it) with my Apple ID already filled in. Not having a vast supply of nude selfies stored in iCloud, and not being famous, I entered my password and disabled iCloud Keychain to be on the safe side. No ill-effects so far and it hasn't returned nearly 24 hours later. This may turn out to be a screw-up with iCloud rather than a form of malware.

I just got the same message in conjunction with Chrome crash. I'm running Sierra 10.12.3, and have NO security "crapware"

i would uninstall all of the supposed "security" crapware and test. All of it seems to provide little added security, but large amounts of problems.

I too have this problem and can't figure out where it is originating from. I don't think removing the "security crapware" as suggested below will solve it, and I wouldn't be able to test it since I can't reproduce the issue. Can you provide any further information AlexLB? I can state that my user had Finder, Chrome, Outlook, Slack, Word, and Adobe Acrobat DC applications opened up at the time without any .dmg or usb drives mounted to the FS.

I just received this message for the first time on macOS Sierra 10.12.1 Beta (16B2548a). Shortly after seeing the dialog, I tried to open a new file in VLC and received the Unix error too many open files. I'm wondering if some rogue program on my computer ate up all of the available file descriptors and prevented opening of new files. In that case, not being able to "find" the login keychain actually means it just can't open it, or anything else. This would also explain why restarting fixes the issue.

Had the same alert appear on my macbook pro (el capitan 10.11.6) 2 days ago.

I had left my macbook pro open overnight (I was uploading stuff to google drive)

and I only saw the popup the next morning. I have no idea when it appeared.

And aside from dropbox sync and uploading to google drive I don't think anything else was opened...

BabaO

I have the same issue. Any suggestion?

Is it a virus? I noticed it when I'd opened an email - I've never seen it before. I know that the person who I received the email from has previously had an issue.

I just had the same window pop up on my MacBook Pro as well. Do I his the cancel button or the settings button??

I wold hit the cancel button. You don't know what attempting a change would do.

I would not hit either of the buttons. If it's malicious, the coder simply made both buttons do the exact thing they wanted. Neither buttons do what you think they do (if it's malicious software).

If that's the case, what are we supposed to do?

I received the same screen alert this morning. Running El Capitan 10.11.6 on Mac Pro 2009. Could not trust the warning. Shut down system instead. Anyone hit the buttons? If so, what happened?