Hacking Issue please help

Question

6/18/16 10:25:41.876 PM LookupViewService[523]: Error in CoreDragRemoveReceiveHandler: -18566/18/16 10:25:49.784 PM LookupViewService[523]: Error in CoreDragRemoveTrackingHandler: -18566/18/16 10:25:49.784 PM LookupViewService[523]: Error in CoreDragRemoveReceiveHandler: -18566/18/16 10:26:04.000 PM kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).6/18/16 10:26:04.000 PM kernel[0]: en0::IO80211Interface::postMessage bssid changed6/18/16 10:26:04.000 PM kernel[0]: IO80211AWDLPeerManager::doDisable   source [handleSIOCSIFFLAGS]6/18/16 10:26:04.000 PM kernel[0]: AirPort: Link Down on awdl0. Reason 1 (Unspecified).6/18/16 10:26:04.000 PM kernel[0]: IO80211AWDLPeerManager::doDisable   source [setLinkState]6/18/16 10:26:04.823 PM airportd[49]: _handleLinkEvent: Got an error trying to query WiFi for power. Resetting state variables.6/18/16 10:26:04.000 PM kernel[0]: ARPT: 17783.438556: AWDL Sync Enabled 06/18/16 10:26:04.824 PM sharingd[225]: 22:26:04.823 : Discoverable mode changed to Off6/18/16 10:26:04.824 PM sharingd[225]: 22:26:04.823 : BTLE scanning stopped6/18/16 10:26:04.970 PM networkd[144]: +[NETLedBelly stopFastFail] Clearing ledbelly failure cache6/18/16 10:26:04.970 PM UserEventAgent[37]: Captive: CNPluginHandler en0: Inactive6/18/16 10:26:04.971 PM configd[45]: network changed: v4(en0-:192.168.12.6) DNS- Proxy-6/18/16 10:26:04.979 PM netbiosd[468]: network_reachability_changed : network is not reachable, netbiosd is shutting down6/18/16 10:26:09.982 PM com.apple.geod[494]: 2016-06-18 22:26:09.982, 494, a400d30, [CountryConfiguration]: Could not determine current country code: Error Domain&#x3D;NSURLErrorDomain Code&#x3D;-1009 "The Internet connection appears to be offline." UserInfo&#x3D;0x7fcc0c901600 {NSUnderlyingError&#x3D;0x7fcc0a400df0 "The Internet connection appears to be offline.", NSErrorFailingURLStringKey&#x3D;http://gsp1.apple.com/pep/gcc, NSErrorFailingURLKey&#x3D;http://gsp1.apple.com/pep/gcc, _kCFStreamErrorDomainKey&#x3D;12, _kCFStreamErrorCodeKey&#x3D;8, NSLocalizedDescription&#x3D;The Internet connection appears to be offline.}6/18/16 10:26:33.353 PM LookupViewService[523]: Error in CoreDragRemoveTrackingHandler: -18566/18/16 10:26:33.353 PM LookupViewService[523]: Error in CoreDragRemoveReceiveHandler: -18566/18/16 10:26:45.000 PM kernel[0]: ARPT: 17823.729454: ChangeVCO &#x3D;&gt; vco:960, xtalF:40, frac: 98, ndivMode: 3, ndivint: 246/18/16 10:26:45.000 PM kernel[0]: ARPT: 17823.729461: Data written into the PLL_CNTRL_ADDR2: 00000c316/18/16 10:26:45.000 PM kernel[0]: ARPT: 17823.729502: Data written into the PLL_CNTRL_ADDR3 (Fractional): 0000100e6/18/16 10:26:45.000 PM kernel[0]: en0: channel changed to 16/18/16 10:26:45.000 PM kernel[0]: AirPort: Link Up on awdl06/18/16 10:26:45.000 PM kernel[0]: IO80211AWDLPeerManager::setAwdlOperatingMode Setting the AWDL operation mode from AUTO to SUSPENDED6/18/16 10:26:45.000 PM kernel[0]: IO80211AWDLPeerManager::setAwdlSuspendedMode() Suspending AWDL, enterQuietMode(true)6/18/16 10:26:45.461 PM sharingd[225]: 22:26:45.460 : Discoverable mode changed to Contacts Only6/18/16 10:26:45.461 PM sharingd[225]: 22:26:45.460 : BTLE scanning started6/18/16 10:26:45.461 PM sharingd[225]: 22:26:45.461 : Scanning mode Contacts Only6/18/16 10:26:45.462 PM sharingd[225]: 22:26:45.462 : BTLE scanner Powered On6/18/16 10:26:45.000 PM kernel[0]: ARPT: 17824.220397: MacAuthEvent en0   Auth result for: f0:8c:fb:81:6f:f0  MAC AUTH succeeded6/18/16 10:26:45.000 PM kernel[0]: AirPort: Link Up on en06/18/16 10:26:45.000 PM kernel[0]: en0: BSSID changed to f0:8c:fb:81:6f:f06/18/16 10:26:45.000 PM kernel[0]: en0: channel changed to 96/18/16 10:26:45.000 PM kernel[0]: en0::IO80211Interface::postMessage bssid changed6/18/16 10:26:45.000 PM kernel[0]: ARPT: 17824.227492: AWDL Sync Enabled 06/18/16 10:26:45.000 PM kernel[0]: AirPort: RSN handshake complete on en06/18/16 10:26:45.685 PM networkd[144]: +[NETLedBelly stopFastFail] Clearing ledbelly failure cache6/18/16 10:26:45.685 PM UserEventAgent[37]: Captive: [CNInfoNetworkActive:1709] en0: SSID &#x27;PLDTHOMEFIBR_LINKSYS&#x27; making interface primary (cache indicates network not captive)6/18/16 10:26:45.686 PM UserEventAgent[37]: Captive: CNPluginHandler en0: Evaluating6/18/16 10:26:45.686 PM configd[45]: network changed: DNS* Proxy6/18/16 10:26:45.686 PM UserEventAgent[37]: Captive: en0: Not probing &#x27;PLDTHOMEFIBR_LINKSYS&#x27; (cache indicates not captive)6/18/16 10:26:45.686 PM UserEventAgent[37]: Captive: CNPluginHandler en0: Authenticated6/18/16 10:26:45.690 PM networkd[144]: +[NETLedBelly stopFastFail] Clearing ledbelly failure cache6/18/16 10:26:45.690 PM configd[45]: network changed: v4(en0!:192.168.12.6) DNS+ Proxy+ SMB6/18/16 10:26:45.000 PM kernel[0]: en0: BSSID changed to f0:8c:fb:81:6f:f06/18/16 10:26:45.000 PM kernel[0]: en0: channel changed to 96/18/16 10:26:45.694 PM mDNSResponder[80]: AwdlD2d AwdlD2dStartAdvertisingPair: &#x27;josephs-macbook-pro&#x27; Advertising service started6/18/16 10:26:45.695 PM mDNSResponder[80]: AwdlD2d AwdlD2dStartAdvertisingPair: &#x27;2c44f3efff45130200000000000008efip6arpa&#x27; Advertising service started6/18/16 10:26:45.000 PM kernel[0]: IO80211AWDLPeerManager::setAwdlOperatingMode Setting the AWDL operation mode from SUSPENDED to AUTO6/18/16 10:26:45.000 PM kernel[0]: IO80211AWDLPeerManager::setAwdlAutoMode Resuming AWDL6/18/16 10:26:50.629 PM CalendarAgent[238]: [com.apple.calendar.store.log.caldav.coredav] [Refusing to parse response to PROPPATCH because of content-type: [text/html; charset&#x3D;UTF-8].]6/18/16 10:26:50.698 PM CalendarAgent[238]: [com.apple.calendar.store.log.caldav.coredav] [Refusing to parse response to PROPPATCH because of content-type: [text/html; charset&#x3D;UTF-8].]6/18/16 10:26:52.078 PM mDNSResponder[80]: AwdlD2d AwdlD2dStartBrowsingForKey: &#x27;2c44f3efff45130200000000000008efip6arpa&#x27; Browsing service started6/18/16 10:26:52.079 PM mDNSResponder[80]: AwdlD2d AwdlD2dStopBrowsingForKey: &#x27;2c44f3efff45130200000000000008efip6arpa&#x27; Browsing service stopped6/18/16 10:26:56.884 PM Notes[511]: No worthy mechs found6/18/16 10:26:56.884 PM Notes[511]: No worthy mechs found6/18/16 10:27:02.531 PM Notes[511]: No worthy mechs found6/18/16 10:27:02.532 PM Notes[511]: No worthy mechs found6/18/16 10:27:04.400 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 989244033 for window 5466/18/16 10:27:04.400 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 989244033 for window 5466/18/16 10:27:04.400 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 989244033 for window 5466/18/16 10:27:04.400 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 989244033 for window 5466/18/16 10:27:04.400 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 989244033 for window 5466/18/16 10:27:04.400 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 989244033 for window 5466/18/16 10:27:04.400 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 989244033 for window 5466/18/16 10:27:04.400 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 989244033 for window 5466/18/16 10:27:04.400 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 989244033 for window 5466/18/16 10:27:20.163 PM LookupViewService[523]: Error in CoreDragRemoveTrackingHandler: -18566/18/16 10:27:20.163 PM LookupViewService[523]: Error in CoreDragRemoveReceiveHandler: -18566/18/16 10:27:24.210 PM LookupViewService[523]: Error in CoreDragRemoveTrackingHandler: -18566/18/16 10:27:24.210 PM LookupViewService[523]: Error in CoreDragRemoveReceiveHandler: -18566/18/16 10:27:30.424 PM LookupViewService[523]: Error in CoreDragRemoveTrackingHandler: -18566/18/16 10:27:30.424 PM LookupViewService[523]: Error in CoreDragRemoveReceiveHandler: -18566/18/16 10:27:59.950 PM LookupViewService[523]: Error in CoreDragRemoveTrackingHandler: -18566/18/16 10:27:59.950 PM LookupViewService[523]: Error in CoreDragRemoveReceiveHandler: -18566/18/16 10:28:02.653 PM com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.i think my pc is hacked

PinoyUser · Answer

please confirm that this is irregular behavior for my mac and its log. I was not using any apps or programs when the activity happened. I can only surmise it has been compromised and being remotely logged and controlled.

PinoyUser · Answer

6/18/16 10:27:04.400 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 989244033 for window 5466/18/16 10:27:04.400 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 989244033 for window 5466/18/16 10:27:04.400 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 989244033 for window 5466/18/16 10:27:20.163 PM LookupViewService[523]: Error in CoreDragRemoveTrackingHandler: -18566/18/16 10:27:20.163 PM LookupViewService[523]: Error in CoreDragRemoveReceiveHandler: -18566/18/16 10:27:24.210 PM LookupViewService[523]: Error in CoreDragRemoveTrackingHandler: -18566/18/16 10:27:24.210 PM LookupViewService[523]: Error in CoreDragRemoveReceiveHandler: -18566/18/16 10:27:30.424 PM LookupViewService[523]: Error in CoreDragRemoveTrackingHandler: -18566/18/16 10:27:30.424 PM LookupViewService[523]: Error in CoreDragRemoveReceiveHandler: -18566/18/16 10:27:59.950 PM LookupViewService[523]: Error in CoreDragRemoveTrackingHandler: -18566/18/16 10:27:59.950 PM LookupViewService[523]: Error in CoreDragRemoveReceiveHandler: -18566/18/16 10:28:02.653 PM com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.6/18/16 10:28:27.714 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 856906432 for window 5466/18/16 10:28:27.714 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 856906432 for window 5466/18/16 10:28:27.714 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 856906432 for window 5466/18/16 10:28:27.714 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 856906432 for window 5466/18/16 10:28:27.714 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 856906432 for window 5466/18/16 10:28:27.714 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 856906432 for window 5466/18/16 10:28:27.715 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 856906432 for window 5466/18/16 10:28:27.715 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 856906432 for window 5466/18/16 10:28:27.715 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 856906432 for window 5466/18/16 10:28:43.219 PM LookupViewService[523]: Error in CoreDragRemoveTrackingHandler: -18566/18/16 10:28:43.219 PM LookupViewService[523]: Error in CoreDragRemoveReceiveHandler: -18566/18/16 10:29:44.689 PM LookupViewService[523]: Error in CoreDragRemoveTrackingHandler: -18566/18/16 10:29:44.689 PM LookupViewService[523]: Error in CoreDragRemoveReceiveHandler: -18566/18/16 10:30:00.900 PM identityservicesd[229]: [Warning] &#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D; IDS Traffic Usage:6/18/16 10:30:00.900 PM identityservicesd[229]: [Warning]    Service: com.apple.private.alloy.icloudpairing6/18/16 10:30:00.900 PM identityservicesd[229]: [Warning]      outgoing-messages: 16/18/16 10:30:00.900 PM identityservicesd[229]: [Warning] 6/18/16 10:30:00.900 PM identityservicesd[229]: [Warning] &#x3D;&#x3D;&#x3D;&#x3D;&#x3D;&#x3D; Done6/18/16 10:31:28.977 PM com.apple.xpc.launchd[1]: (com.apple.imfoundation.IMRemoteURLConnectionAgent) The _DirtyJetsamMemoryLimit key is not available on this platform.6/18/16 10:31:32.080 PM networkd[144]: -[NETClientConnection scrubParametersForEntitlements:] client com.apple.WebKi.554 setting source application without entitlement6/18/16 10:31:32.134 PM networkd[144]: -[NETClientConnection scrubParametersForEntitlements:] client com.apple.WebKi.554 setting source application without entitlement6/18/16 10:31:32.467 PM networkd[144]: -[NETClientConnection scrubParametersForEntitlements:] client com.apple.WebKi.554 setting source application without entitlement6/18/16 10:31:32.532 PM networkd[144]: -[NETClientConnection scrubParametersForEntitlements:] client com.apple.WebKi.554 setting source application without entitlement6/18/16 10:31:32.616 PM networkd[144]: -[NETClientConnection scrubParametersForEntitlements:] client com.apple.WebKi.554 setting source application without entitlement6/18/16 10:32:17.606 PM LookupViewService[523]: Error in CoreDragRemoveTrackingHandler: -18566/18/16 10:32:17.606 PM LookupViewService[523]: Error in CoreDragRemoveReceiveHandler: -18566/18/16 10:33:08.966 PM Notes[511]: No worthy mechs found6/18/16 10:33:08.966 PM Notes[511]: No worthy mechs found6/18/16 10:33:18.521 PM WindowServer[156]: WSGetSurfaceInWindow : Invalid surface 859226387 for window 546

Phil0124 · Answer

Nothing there out of the ordinary. Mostly network and mail actions which would be going on in the background even if you were not doing anything. Computers are always doing things in the background specially when connected to the internet. Just because you weren&#x27;t doing anything does not mean the machine just sits idle. Other than the log, anything else that leads you to believe you&#x27;ve been hacked?

PinoyUser · Answer

The remote service XPC keeps trying to connect. I was unable to post to a hacking site forum because it said i was running through a VPN or Proxy while i am not. I was looking into running processes and found something called Cavalrylogger logging keys

PinoyUser · Answer

6/18/16 10:52:36.897 PM airportd[49]: WARNING: sysdiagnose (614) is not entitled for com.apple.wifi.temporary_log, temporarily allowing request with background priority —— all entitlement requirements will be strictly enforced in a future release6/18/16 10:52:46.558 PM sudo[743]:     root : TTY&#x3D;unknown ; PWD&#x3D;/ ; USER&#x3D;root ; COMMAND&#x3D;/usr/bin/brctl diagnose --sysdiagnose /var/tmp/sysdiagnose_2016.06.18_22-52-04+0800_199/brctl6/18/16 10:52:46.583 PM networkd[144]: networkd-412.20.3 pid 144 will idle exit6/18/16 10:52:46.583 PM networkd[144]: networkd directory: ok, mode: 40755, uid: 24, gid: 246/18/16 10:52:46.583 PM networkd[144]: -- Settings --6/18/16 10:52:46.583 PM networkd[144]: NULL6/18/16 10:52:46.583 PM networkd[144]: -- Interfaces --6/18/16 10:52:46.584 PM networkd[144]:   4 - en0 (IPv4 hash&#x3D;5967492352201383960, IPv6 hash&#x3D;0, LQM&#x3D;100)6/18/16 10:52:46.584 PM networkd[144]:     A3632AB6-804D-45C2-BF27-84E7C1849206, Signature: "IPv4.Router&#x3D;192.168.12.1;IPv4.RouterHardwareAddress&#x3D;f0:8c:fb:81:6f:f0"6/18/16 10:52:46.584 PM networkd[144]:       Address: 192.168.12.6:06/18/16 10:52:46.584 PM networkd[144]: nwi ipv4 interfaces:6/18/16 10:52:46.584 PM networkd[144]:     en0: IPv4, DNS since 178243048803886/18/16 10:52:46.584 PM networkd[144]: nwi ipv6 interfaces:6/18/16 10:52:46.584 PM networkd[144]: n_resolver: 76/18/16 10:52:46.584 PM networkd[144]: resolver[0]6/18/16 10:52:46.584 PM networkd[144]:   domain: NULL6/18/16 10:52:46.584 PM networkd[144]:   n_nameserver: 16/18/16 10:52:46.584 PM networkd[144]:     nameserver[0]: 192.168.12.1:06/18/16 10:52:46.584 PM networkd[144]:   port: 06/18/16 10:52:46.584 PM networkd[144]:   n_search: 16/18/16 10:52:46.584 PM networkd[144]:     search[0]: local6/18/16 10:52:46.585 PM networkd[144]:   n_sortaddr: 06/18/16 10:52:46.585 PM networkd[144]:   options: NULL6/18/16 10:52:46.585 PM networkd[144]:   timeout: 06/18/16 10:52:46.585 PM networkd[144]:   search_order: 06/18/16 10:52:46.585 PM networkd[144]:   if_index: 46/18/16 10:52:46.585 PM networkd[144]:   flags: 26/18/16 10:52:46.585 PM networkd[144]:   reach_flags: 200026/18/16 10:52:46.585 PM networkd[144]: resolver[1]6/18/16 10:52:46.585 PM networkd[144]:   domain: local6/18/16 10:52:46.585 PM networkd[144]:   n_nameserver: 06/18/16 10:52:46.586 PM networkd[144]:   port: 06/18/16 10:52:46.586 PM networkd[144]:   n_search: 06/18/16 10:52:46.586 PM networkd[144]:   n_sortaddr: 06/18/16 10:52:46.586 PM networkd[144]:   options: mdns6/18/16 10:52:46.586 PM networkd[144]:   timeout: 56/18/16 10:52:46.586 PM networkd[144]:   search_order: 3000006/18/16 10:52:46.586 PM networkd[144]:   if_index: 06/18/16 10:52:46.586 PM networkd[144]:   flags: 26/18/16 10:52:46.586 PM networkd[144]:   reach_flags: 06/18/16 10:52:46.586 PM networkd[144]: resolver[2]6/18/16 10:52:46.586 PM networkd[144]:   domain: 254.169.in-addr.arpa6/18/16 10:52:46.586 PM networkd[144]:   n_nameserver: 06/18/16 10:52:46.586 PM networkd[144]:   port: 06/18/16 10:52:46.586 PM networkd[144]:   n_search: 06/18/16 10:52:46.587 PM networkd[144]:   n_sortaddr: 06/18/16 10:52:46.587 PM networkd[144]:   options: mdns6/18/16 10:52:46.587 PM networkd[144]:   timeout: 56/18/16 10:52:46.587 PM networkd[144]:   search_order: 3002006/18/16 10:52:46.587 PM networkd[144]:   if_index: 06/18/16 10:52:46.587 PM networkd[144]:   flags: 26/18/16 10:52:46.587 PM networkd[144]:   reach_flags: 06/18/16 10:52:46.587 PM networkd[144]: resolver[3]6/18/16 10:52:46.587 PM networkd[144]:   domain: 8.e.f.ip6.arpa6/18/16 10:52:46.587 PM networkd[144]:   n_nameserver: 06/18/16 10:52:46.587 PM networkd[144]:   port: 06/18/16 10:52:46.587 PM networkd[144]:   n_search: 06/18/16 10:52:46.587 PM networkd[144]:   n_sortaddr: 06/18/16 10:52:46.587 PM networkd[144]:   options: mdns6/18/16 10:52:46.587 PM networkd[144]:   timeout: 56/18/16 10:52:46.587 PM networkd[144]:   search_order: 3004006/18/16 10:52:46.587 PM networkd[144]:   if_index: 06/18/16 10:52:46.587 PM networkd[144]:   flags: 26/18/16 10:52:46.587 PM networkd[144]:   reach_flags: 06/18/16 10:52:46.588 PM networkd[144]: resolver[4]6/18/16 10:52:46.588 PM networkd[144]:   domain: 9.e.f.ip6.arpa6/18/16 10:52:46.588 PM networkd[144]:   n_nameserver: 06/18/16 10:52:46.588 PM networkd[144]:   port: 06/18/16 10:52:46.588 PM networkd[144]:   n_search: 06/18/16 10:52:46.588 PM networkd[144]:   n_sortaddr: 06/18/16 10:52:46.588 PM networkd[144]:   options: mdns6/18/16 10:52:46.588 PM networkd[144]:   timeout: 56/18/16 10:52:46.588 PM networkd[144]:   search_order: 3006006/18/16 10:52:46.588 PM networkd[144]:   if_index: 06/18/16 10:52:46.588 PM networkd[144]:   flags: 26/18/16 10:52:46.588 PM networkd[144]:   reach_flags: 06/18/16 10:52:46.588 PM networkd[144]: resolver[5]6/18/16 10:52:46.588 PM networkd[144]:   domain: a.e.f.ip6.arpa6/18/16 10:52:46.588 PM networkd[144]:   n_nameserver: 06/18/16 10:52:46.588 PM networkd[144]:   port: 06/18/16 10:52:46.588 PM networkd[144]:   n_search: 06/18/16 10:52:46.589 PM networkd[144]:   n_sortaddr: 06/18/16 10:52:46.589 PM networkd[144]:   options: mdns6/18/16 10:52:46.589 PM networkd[144]:   timeout: 56/18/16 10:52:46.589 PM networkd[144]:   search_order: 3008006/18/16 10:52:46.589 PM networkd[144]:   if_index: 06/18/16 10:52:46.589 PM networkd[144]:   flags: 26/18/16 10:52:46.589 PM networkd[144]:   reach_flags: 06/18/16 10:52:46.589 PM networkd[144]: resolver[6]6/18/16 10:52:46.589 PM networkd[144]:   domain: b.e.f.ip6.arpa6/18/16 10:52:46.589 PM networkd[144]:   n_nameserver: 06/18/16 10:52:46.589 PM networkd[144]:   port: 06/18/16 10:52:46.589 PM networkd[144]:   n_search: 06/18/16 10:52:46.589 PM networkd[144]:   n_sortaddr: 06/18/16 10:52:46.589 PM networkd[144]:   options: mdns6/18/16 10:52:46.589 PM networkd[144]:   timeout: 56/18/16 10:52:46.589 PM networkd[144]:   search_order: 3010006/18/16 10:52:46.589 PM networkd[144]:   if_index: 06/18/16 10:52:46.590 PM networkd[144]:   flags: 26/18/16 10:52:46.590 PM networkd[144]:   reach_flags: 06/18/16 10:52:46.590 PM networkd[144]: n_scoped_resolver: 16/18/16 10:52:46.590 PM networkd[144]: scoped_resolver[0]6/18/16 10:52:46.590 PM networkd[144]:   domain: NULL6/18/16 10:52:46.590 PM networkd[144]:   n_nameserver: 16/18/16 10:52:46.590 PM networkd[144]:     nameserver[0]: 192.168.12.1:06/18/16 10:52:46.590 PM networkd[144]:   port: 06/18/16 10:52:46.590 PM networkd[144]:   n_search: 16/18/16 10:52:46.590 PM networkd[144]:     search[0]: local6/18/16 10:52:46.590 PM networkd[144]:   n_sortaddr: 06/18/16 10:52:46.590 PM networkd[144]:   options: NULL6/18/16 10:52:46.591 PM networkd[144]:   timeout: 06/18/16 10:52:46.591 PM networkd[144]:   search_order: 06/18/16 10:52:46.591 PM networkd[144]:   if_index: 46/18/16 10:52:46.591 PM networkd[144]:   flags: 36/18/16 10:52:46.591 PM networkd[144]:   reach_flags: 200026/18/16 10:52:46.591 PM networkd[144]: -- Proxies --  __SCOPED__    en0      ExceptionsList        0 : *.local        1 : 169.254/16      FTPPassive : (SInt64) 1  ExceptionsList    0 : *.local    1 : 169.254/16  FTPPassive : (SInt64) 16/18/16 10:52:46.591 PM networkd[144]: -- VPN --6/18/16 10:52:46.591 PM networkd[144]: -- Power --6/18/16 10:52:46.591 PM networkd[144]: XPC activity last run: 0s ago, next run scheduled with delay: 23766s, grace period: 360s6/18/16 10:52:46.591 PM networkd[144]: Unplugged, Good Thermal Condition, Policy:  power policy slot 1:    max_workload: 5242880  workload-policy #1: allowed, expensive: prohibited    max_workload: 18446744073709551615  workload-policy #1: requires power, expensive: prohibited  power policy slot 2:    max_workload: 102400  workload-policy #1: allowed, expensive: requires power    max_workload: 5242880  workload-policy #1: allowed, expensive: prohibited    max_workload: 18446744073709551615  workload-policy #1: requires power, expensive: prohibited  power policy slot 3:    max_workload: 102400  workload-policy #1: allowed, expensive: requires power  workload-policy #2: allowed, expensive: allowed, minimum link quality metric: 51  workload-policy #3: allowed, expensive: requires radio active, minimum link quality metric: 11    max_workload: 5252880  workload-policy #1: allowed, expensive: requires power    max_workload: 52528800  workload-policy #1: requires power, expensive: allowed    max_workload: 18446744073709551615  workload-policy #1: requires power, expensive: prohibited  power policy slot 4:    max_workload: 5252880  workload-policy #1: allowed, expensive: requires power  workload-policy #2: allowed, expensive: allowed, minimum link quality metric: 51  workload-policy #3: allowed, expensive: requires radio active, minimum link quality metric: 11    max_workload: 52528800  workload-policy #1: allowed, expensive: requires power    max_workload: 18446744073709551615  workload-policy #1: requires power, expensive: prohibited  power policy slot 5:    max_workload: 102400  workload-policy #1: allowed, expensive: allowed, minimum link quality metric: 11    max_workload: 5252880  workload-policy #1: allowed, expensive: requires power  workload-policy #2: allowed, expensive: allowed, minimum link quality metric: 51  workload-policy #3: allowed, expensive: requires radio active, minimum link quality metric: 11    max_workload: 52528800  workload-policy #1: allowed, expensive: requires power  workload-policy #2: allowed, expensive: allowed, minimum link quality metric: 51    max_workload: 18446744073709551615  workload-policy #1: requires power, expensive: prohibited6/18/16 10:52:46.592 PM networkd[144]: -- Data Protection Class: 0 --6/18/16 10:52:46.592 PM networkd[144]: -- Clients -- (name.PID/bundle uuid/cellular/fallback/transactions/last-req)6/18/16 10:52:46.592 PM networkd[144]: Mail.203, darkwake-allowed/com.apple.mail/&lt;uuid: 0x7f82abd08330&gt; 18491884-5A2F-362C-B764-C075616582BE/cell ok/slow/1/1551NETClientConnection Mail.203.2832, started 1554s ago, reachability sent 1554s ago, last error 0  parameters  : connect-by hostname imap.gmail.com:993, tc: 200, custom proxies  reachability: satisfied, is viable, better route: 0, predicted: 0  established : 192.168.12.6:49713 &lt;-&gt; 64.233.187.108:993 via en0NETClientConnection Mail.203.2830, started 1556s ago, reachability sent 1556s ago, last error 0  parameters  : connect-by hostname imap.gmail.com:993, tc: 200, custom proxies  reachability: satisfied, is viable, better route: 0, predicted: 0  established : 192.168.12.6:49705 &lt;-&gt; 64.233.187.108:993 via en0NETClientConnection Mail.203.2829, started 1557s ago, reachability sent 1557s ago, last error 0  parameters  : connect-by hostname p38-imap.mail.me.com:993, tc: 200, custom proxies  reachability: satisfied, is viable, better route: 0, predicted: 0  established : 192.168.12.6:49699 &lt;-&gt; 17.143.177.10:993 via en0NETClientConnection Mail.203.2834, started 1551s ago, reachability sent 1551s ago, last error 0  parameters  : connect-by hostname p38-imap.mail.me.com:993, tc: 200, custom proxies  reachability: satisfied, is viable, better route: 0, predicted: 0  established : 192.168.12.6:49723 &lt;-&gt; 17.143.177.10:993 via en0NETClientConnection Mail.203.2831, started 1554s ago, reachability sent 1554s ago, last error 0  parameters  : connect-by hostname p38-imap.mail.me.com:993, tc: 200, custom proxies  reachability: satisfied, is viable, better route: 0, predicted: 0  established : 192.168.12.6:49712 &lt;-&gt; 17.143.177.10:993 via en0NETClientConnection Mail.203.2828, started 1560s ago, reachability sent 1560s ago, last error 0  parameters  : connect-by hostname p38-imap.mail.me.com:993, tc: 200, custom proxies  reachability: satisfied, is viable, better route: 0, predicted: 0  established : 192.168.12.6:49698 &lt;-&gt; 17.143.177.10:993 via en06/18/16 10:52:46.593 PM networkd[144]: syncdefaultsd.577/&lt;NULL&gt;/&lt;uuid: 0x7f82abc044e0&gt; 7A7E67C4-04A5-3C79-85EB-394151AB72BE/cell ok/slow/1/15NETClientConnection syncdefaultsd.577.3, started 15s ago, reachability sent 15s ago, last error 0  parameters  : connect-by hostname p38-keyvalueservice.icloud.com:443, tc: 200  reachability: satisfied, is viable, better route: 0, predicted: 0  established : 192.168.12.6:50074 &lt;-&gt; 17.248.152.176:443 via en06/18/16 10:52:46.593 PM networkd[144]: apsd.68, darkwake-allowed/&lt;NULL&gt;/&lt;uuid: 0x7f82adb015c0&gt; 686104E1-80C4-3121-9F25-3A4B1FB1E24A/cell ok/slow/1/1506NETClientConnection apsd.68.403, started 1556s ago, reachability sent 1556s ago, last error 0  parameters  : connect-by hostname 30-courier.push.apple.com:5223, custom proxies  reachability: satisfied, is viable, better route: 0, predicted: 0  established : 192.168.12.6:49707 &lt;-&gt; 17.172.232.120:5223 via en06/18/16 10:52:46.593 PM networkd[144]: com.apple.WebKi.274/com.apple.WebKit.Networking/&lt;uuid: 0x7f82ad80d530&gt; FDA61EC1-1917-389F-8454-3135F9672C9C/cell ok/slow/1/28NETClientConnection com.apple.WebKi.274.417, started 1277s ago, reachability sent 1277s ago, last error 0  parameters  : connect-by hostname www.facebook.com:443  reachability: satisfied, is viable, better route: 0, predicted: 0  established : 192.168.12.6:49830 &lt;-&gt; 31.13.95.36:443 via en0NETClientConnection com.apple.WebKi.274.591, started 49s ago, reachability sent 49s ago, last error 0  parameters  : connect-by hostname scontent.fmnl4-5.fna.fbcdn.net:443  reachability: satisfied, is viable, better route: 0, predicted: 0  established : 192.168.12.6:50072 &lt;-&gt; 124.106.11.17:443 via en0NETClientConnection com.apple.WebKi.274.424, started 1274s ago, reachability sent 1274s ago, last error 0  parameters  : connect-by hostname 4-edge-chat.facebook.com:443  reachability: satisfied, is viable, better route: 0, predicted: 0  established : 192.168.12.6:49841 &lt;-&gt; 31.13.95.8:443 via en0NETClientConnection com.apple.WebKi.274.330, started 1553s ago, reachability sent 1552s ago, last error 0  parameters  : connect-by hostname comet.yahoo.com:443  reachability: satisfied, is viable, better route: 0, predicted: 0  established : 192.168.12.6:49718 &lt;-&gt; 106.10.184.41:443 via en0NETClientConnection com.apple.WebKi.274.592, started 44s ago, reachability sent 44s ago, last error 0  parameters  : connect-by hostname pixel.facebook.com:443  reachability: satisfied, is viable, better route: 0, predicted: 0  established : 192.168.12.6:50073 &lt;-&gt; 31.13.95.36:443 via en0NETClientConnection com.apple.WebKi.274.387, started 1429s ago, reachability sent 1428s ago, last error 0  parameters  : connect-by hostname mg.mail.yahoo.com:443  reachability: satisfied, is viable, better route: 0, predicted: 0  established : 192.168.12.6:49793 &lt;-&gt; 203.84.197.26:443 via en06/18/16 10:52:46.593 PM networkd[144]: Notes.511, darkwake-allowed/com.apple.Notes/&lt;uuid: 0x7f82abf02980&gt; A4DE630B-467A-36E8-A15E-CF0EA846ABC1/cell ok/slow/1/1177NETClientConnection Notes.511.32, started 1554s ago, reachability sent 1554s ago, last error 0  parameters  : connect-by hostname p38-imap.mail.me.com:993, tc: 200, custom proxies  reachability: satisfied, is viable, better route: 0, predicted: 0  established : 192.168.12.6:49715 &lt;-&gt; 17.143.177.10:993 via en06/18/16 10:52:46.593 PM networkd[144]: Safari.200/com.apple.Safari/&lt;uuid: 0x7f82ad9063f0&gt; 4D9DB548-1D8B-3745-8F70-54D1786368B6/cell ok/slow/1/3207NETClientConnection Safari.200.2, started 19372s ago, reachability sent 19372s ago, last error 0  parameters  : connect-by hostname configuration.apple.com:443, tc: 100, indefinite  reachability: waiting: 3 - Waiting for start time, interface: 0, predicted: 0, fallback: 0, dns service: 0, since: 0  live state  : slot start: 0, slot: 0, interval: 720s, timer: set, timer: resumed, PowerNap XPC Activity scheduled: false6/18/16 10:52:46.594 PM networkd[144]: -- MPTCP Cache -- (expires every 1800s)6/18/16 10:52:46.594 PM networkd[144]: -- Fallback --6/18/16 10:52:46.594 PM networkd[144]:   Not in fallback6/18/16 10:52:46.594 PM networkd[144]:   0 established fellback, last established: 0.000 seconds ago6/18/16 10:52:46.594 PM networkd[144]:   0 established without fallback, last established: 0.000 seconds ago6/18/16 10:52:46.594 PM networkd[144]: -- WiFi --6/18/16 10:52:46.594 PM networkd[144]:   Demand: 0, Use: 0, Type: NULL6/18/16 10:52:46.594 PM networkd[144]: -- Persistent guidance: No guidance6/18/16 10:52:46.594 PM networkd[144]: -- Connection Pools --6/18/16 10:52:46.594 PM networkd[144]: Pool name: com.apple.cloudkit.BackgroundConnectionPool, limit: 6- 0 connections total:- 0 connections running:- 0 connections pending evaluation:6/18/16 10:52:46.594 PM networkd[144]: Pool name: NSURLSessionBackgroundPoolName, limit: 3- 0 connections total:- 0 connections running:- 0 connections pending evaluation:6/18/16 10:52:46.594 PM networkd[144]: -- Waldo --6/18/16 10:52:46.594 PM networkd[144]: URL: http://witwics.apple.com/waldo - &lt;NULL&gt;6/18/16 10:52:46.594 PM networkd[144]: -- LedBelly Connections --6/18/16 10:52:46.594 PM networkd[144]: -- End --6/18/16 10:52:46.677 PM brctl[755]: SQLite[14]: cannot open file at line 33076 of [c8ade949d4]6/18/16 10:52:46.677 PM brctl[755]: SQLite[14]: os_unix.c:33076: (2) open(/var/root/Library/Application Support/CloudDocs/session/db/client.db) -6/18/16 10:52:47.043 PM sudo[768]:     root : TTY&#x3D;unknown ; PWD&#x3D;/ ; USER&#x3D;josephfaugierortega ; COMMAND&#x3D;/bin/launchctl list

Phil0124 · Answer

Nothing in your logs indicate any type of keylogging at all.  There&#x27;s "caldav" which is what the Calendar uses. It&#x27;s not harmful. all your network connections seem to be expected items  such as to Apple servers, mail providers and other innocuous sites.There is absolutely nothing there to indicate any type of malicious logging or hacking.