'curl' attempting to connect to the internet

Is curl an application that comes with Sierra 10.12.2?


I have Intego virus scan installed,

Just had a popup appear that said 'curl is attempting to make a connection to the internet'


Thought this seemed weird. Is this normal?

Posted on Jan 23, 2017 11:15 AM

Reply
14 replies

Jan 23, 2017 11:33 AM in response to pseudo0099

It is a fault with the Anti virus. I would recommend uninstalling it. Does it give you any valuable information? The pop is more than likely self serving, to give you the impression the Intego is actually doing something.


The Curl is normal UNIX command for retrieving content:


https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPag es/man1/curl.1.html


https://curl.haxx.se/docs/manpage.html

Jan 24, 2017 11:05 AM in response to thomas_r.

Thanks for the advice. I appreciate it.


Here are the results from EtreCheck:


EtreCheck version: 3.1.5 (343)

Report generated 2017-01-24 15:02:22

Download EtreCheck from https://etrecheck.com

Runtime 3:24

Performance: Good


Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.


Problem: Other problem


Hardware Information:

MacBook Air (13-inch, Early 2015)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Air - model: MacBookAir7,2

1 1.6 GHz Intel Core i5 (i5-5250U) CPU: 2-core

4 GB RAM Not upgradeable

BANK 0/DIMM0

2 GB DDR3 1600 MHz ok

BANK 1/DIMM0

2 GB DDR3 1600 MHz ok

Bluetooth: Good - Handoff/Airdrop2 supported

Wireless: en0: 802.11 a/b/g/n/ac

Battery: Health = Normal - Cycle count = 443


Video Information:

Intel HD Graphics 6000

Color LCD 1440 x 900


System Software:

macOS Sierra 10.12.2 (16C67) - Time since boot: about 17 hours


Disk Information:

APPLE SSD SM0128G disk0 : (121.33 GB) (Solid State - TRIM: Yes)

[Show SMART report]

EFI (disk0s1) <not mounted> : 210 MB

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB

Macintosh SSD (disk1) / [Startup]: 120.10 GB (89.77 GB free)

Core Storage: disk0s2 120.47 GB Online


USB Information:

Apple Inc. BRCM20702 Hub

Apple Inc. Bluetooth USB Host Controller


Thunderbolt Information:

Apple Inc. thunderbolt_bus


Gatekeeper:

Mac App Store


Kernel Extensions:

/System/Library/Extensions

[loaded] com.intego.ContentBarrier.safe-boot (10.7.5 - SDK 10.8 - 2016-12-23) [Support]


/System/Library/Extensions/ContentBarrier Safe Boot_Legacy.kext/Contents/MacOS

[loaded] com.intego.ContentBarrier.extension (10.8.8 - SDK 10.7 - 2016-12-13) [Support]


System Launch Agents:

[not loaded] 7 Apple tasks

[loaded] 178 Apple tasks

[running] 70 Apple tasks

[killed] 25 Apple tasks

25 processes killed due to insufficient RAM


System Launch Daemons:

[not loaded] 42 Apple tasks

[loaded] 167 Apple tasks

[running] 89 Apple tasks

[killed] 13 Apple tasks

13 processes killed due to insufficient RAM


Launch Agents:

[running] com.intego.ContentBarrier.agent.plist (2016-12-13) [Support]

[loaded] com.intego.Personal-Backup.agent.plist (2016-11-14) [Support]

[running] com.intego.commonservices.integomenu.plist (2016-11-14) [Support]

[running] com.intego.commonservices.taskmanager.plist (2016-11-14) [Support]

[loaded] com.intego.commonservices.uninstaller.plist (2016-11-14) [Support]

[running] com.intego.netbarrier.alert.plist (2016-11-14) [Support]

[running] com.intego.netupdate.agent.plist (2016-11-14) [Support]

[loaded] com.intego.virusbarrier.alert.plist (2017-01-24) [Support]

[running] com.intego.virusbarrier.events.plist (2017-01-24) [Support]


Launch Daemons:

[failed] com.adobe.fpsaud.plist (2016-12-10) [Support]

[running] com.intego.ContentBarrier.daemon.plist (2017-01-23) [Support]

[running] com.intego.Personal-Backup.daemon.plist (2016-09-19) [Support]

[running] com.intego.WashingMachine.service.plist (2016-10-31) [Support]

[running] com.intego.commonservices.daemon.integod.plist (2016-06-07) [Support]

[running] com.intego.commonservices.daemon.taskmanager.plist (2016-06-28) [Support]

[loaded] com.intego.commonservices.icalserver.plist (2016-06-07) [Support]

[loaded] com.intego.commonservices.metrics.kschecker.plist (2016-06-28) [Support]

[running] com.intego.netbarrier.daemon.logger.plist (2016-09-19) [Support]

[running] com.intego.netbarrier.daemon.monitor.plist (2016-09-19) [Support]

[running] com.intego.netbarrier.daemon.plist (2016-09-19) [Support]

[running] com.intego.netupdate.daemon.plist (2016-07-08) [Support]

[loaded] com.intego.virusbarrier.daemon.emlparser.plist (2017-01-18) [Support]

[running] com.intego.virusbarrier.daemon.logger.plist (2017-01-18) [Support]

[running] com.intego.virusbarrier.daemon.plist (2017-01-18) [Support]

[running] com.intego.virusbarrier.daemon.scanner.plist (2017-01-18) [Support]

[loaded] com.malwarebytes.HelperTool.plist (2016-11-14) [Support]

[loaded] com.microsoft.autoupdate.helper.plist (2016-11-16) [Support]

[loaded] com.microsoft.office.licensingV2.helper.plist (2016-11-15) [Support]


User Launch Agents:

[loaded] com.google.keystone.agent.plist (2017-01-13) [Support]

[running] com.spotify.webhelper.plist (2017-01-23) [Support]


User Login Items:

Flux Application

(/Applications/Flux.app)

iTunesHelper Application (2016-12-14)

(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

Android File Transfer Agent Application

(~/Library/Application Support/Google/Android File Transfer/Android File Transfer Agent.app)

Spotify Application Hidden

(/Applications/Spotify.app)


Internet Plug-ins:

FlashPlayer-10.6: 24.0.0.186 - SDK 10.9 (2016-12-29) [Support]

QuickTime Plugin: 7.7.3 (2016-12-23)

Flash Player: 24.0.0.186 - SDK 10.9 (2016-12-29) Outdated! Update


3rd Party Preference Panes:

Flash Player (2016-12-10) [Support]


Time Machine:

Time Machine not configured!


Top Processes by CPU:

10% mdworker(13)

5% kernel_task

4% WindowServer

1% fontd

1% com.apple.AmbientDisplayAgent


Top Processes by Memory:

634 MB kernel_task

352 MB com.apple.WebKit.WebContent(3)

315 MB mdworker(13)

135 MB Safari

90 MB Mail


Virtual Memory Information:

1020 MB Available RAM

32 MB Free RAM

3.00 GB Used RAM

988 MB Cached files

94 MB Swap Used


Diagnostics Information:

Jan 23, 2017, 10:21:13 PM /Library/Logs/DiagnosticReports/Spotify_2017-01-23-222113_[redacted].cpu_resour ce.diag [Details]

/Applications/Spotify.app/Contents/MacOS/Spotify

Jan 23, 2017, 09:49:55 PM Self test - passed

Jan 25, 2017 9:35 AM in response to VikingOSX

I also have malwarebytes.

I fell victim to the Intego virus scan marketing when I had a situation that caused me to be paranoid over internet security. It works !!


Anyways, after having multiple people tell me its no good on the system, I have uninstalled it per Intego's instructions.


Here is the new EtreCheck log:


EtreCheck version: 3.1.5 (343)

Report generated 2017-01-25 13:34:34

Download EtreCheck from https://etrecheck.com

Runtime 3:19

Performance: Good


Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.


Problem: No problem - just checking


Hardware Information:

MacBook Air (13-inch, Early 2015)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Air - model: MacBookAir7,2

1 1.6 GHz Intel Core i5 (i5-5250U) CPU: 2-core

4 GB RAM Not upgradeable

BANK 0/DIMM0

2 GB DDR3 1600 MHz ok

BANK 1/DIMM0

2 GB DDR3 1600 MHz ok

Bluetooth: Good - Handoff/Airdrop2 supported

Wireless: en0: 802.11 a/b/g/n/ac

Battery: Health = Normal - Cycle count = 444


Video Information:

Intel HD Graphics 6000

Color LCD 1440 x 900


System Software:

macOS Sierra 10.12.2 (16C67) - Time since boot: about 12 hours


Disk Information:

APPLE SSD SM0128G disk0 : (121.33 GB) (Solid State - TRIM: Yes)

[Show SMART report]

EFI (disk0s1) <not mounted> : 210 MB

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB

Macintosh SSD (disk1) / [Startup]: 120.10 GB (89.99 GB free)

Core Storage: disk0s2 120.47 GB Online


USB Information:

Apple Inc. BRCM20702 Hub

Apple Inc. Bluetooth USB Host Controller


Thunderbolt Information:

Apple Inc. thunderbolt_bus


Gatekeeper:

Mac App Store


System Launch Agents:

[not loaded] 7 Apple tasks

[loaded] 180 Apple tasks

[running] 93 Apple tasks


System Launch Daemons:

[not loaded] 42 Apple tasks

[loaded] 168 Apple tasks

[running] 101 Apple tasks


Launch Agents:

[failed] com.intego.commonservices.integomenu.plist (2013-12-13) [Support] - /Library/Intego/commonservices.bundle/Contents/MacOS/IntegoMenu.app/Contents/Ma cOS/IntegoMenu: Executable not found!

[loaded] com.intego.commonservices.taskmanager.plist (2013-11-12) [Support] - /Library/Intego/TaskManager/TM_Notifier.app/Contents/MacOS/TM_Notifier: Executable not found!

[loaded] com.intego.commonservices.uninstaller.plist (2013-12-04) [Support] - /Library/Intego/Intego Uninstaller.app/Contents/MacOS/Intego Uninstaller: Executable not found!


Launch Daemons:

[loaded] com.adobe.fpsaud.plist (2016-12-16) [Support]

[failed] com.intego.commonservices.daemon.integod.plist (2013-11-12) [Support] - /Library/Intego/integod: Executable not found!

[failed] com.intego.commonservices.daemon.taskmanager.plist (2013-11-12) [Support] - /Library/Intego/TaskManager/TaskManagerDaemon: Executable not found!

[loaded] com.intego.commonservices.icalserver.plist (2013-11-12) [Support] - /Library/Intego/IntegoiCalServer: Executable not found!

[failed] com.intego.commonservices.metrics.kschecker.plist (2013-11-12) [Support] - /Library/Intego/im_ks_tool: Executable not found!

[loaded] com.malwarebytes.HelperTool.plist (2016-11-14) [Support]

[loaded] com.microsoft.autoupdate.helper.plist (2016-11-16) [Support]

[loaded] com.microsoft.office.licensingV2.helper.plist (2016-11-15) [Support]


User Launch Agents:

[loaded] com.google.keystone.agent.plist (2017-01-13) [Support]

[running] com.spotify.webhelper.plist (2017-01-25) [Support]


User Login Items:

Flux Application

(/Applications/Flux.app)

iTunesHelper Application (2017-01-24)

(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

Android File Transfer Agent Application

(~/Library/Application Support/Google/Android File Transfer/Android File Transfer Agent.app)

Spotify Application Hidden

(/Applications/Spotify.app)


Internet Plug-ins:

FlashPlayer-10.6: 24.0.0.194 - SDK 10.9 (2017-01-24) [Support]

QuickTime Plugin: 7.7.3 (2016-12-23)

Flash Player: 24.0.0.194 - SDK 10.9 (2017-01-24) [Support]


3rd Party Preference Panes:

Flash Player (2016-12-16) [Support]


Time Machine:

Time Machine not configured!


Top Processes by CPU:

2% kernel_task

1% com.apple.WebKit.WebContent(3)

1% WindowServer

0% Safari

0% Spotify


Top Processes by Memory:

605 MB kernel_task

475 MB com.apple.WebKit.WebContent(3)

139 MB Safari

131 MB Spotify Helper(2)

115 MB Mail


Virtual Memory Information:

1.43 GB Available RAM

371 MB Free RAM

2.57 GB Used RAM

1.07 GB Cached files

47 MB Swap Used


Diagnostics Information:

Jan 25, 2017, 01:14:22 AM Self test - passed

Jan 23, 2017, 10:21:13 PM /Library/Logs/DiagnosticReports/Spotify_2017-01-23-222113_[redacted].cpu_resour ce.diag [Details]

/Applications/Spotify.app/Contents/MacOS/Spotify

Jan 23, 2017 6:45 PM in response to Limnos

ditto


it's often been suggested (if not proven) that the people selling "anti-virus" are the same people writing viruses


the software is probably using curl(1) "phoning home" to get updates. but on the other hand: do you trust this company with complete control over your computer and everything you do on it?


curl(1) means curl has a manpage in section 1.


open Terminal from LaunchPad, and type:


# man curl


or first, assuming you haven't yet, ...


# man man

Jan 24, 2017 9:40 AM in response to pseudo0099

As has been pointed out, curl is a command-line tool for downloading from the internet. The question in my mind is, why is it running? By itself, curl does nothing... you have to run it for it to download anything.


Most likely, some software you have installed is using curl legitimately to download something. It's a lot easier for a small, hobbyist developer to simply call curl to download a file than to actually write all the code to do the same job.


However, curl has also been abused by malware creators. I'd recommend downloading EtreCheck, running it and posting the report it generates here, so that we can see if you've got anything suspicious installed.


https://etrecheck.com


(Edited to add the link I forgot...)

Jan 24, 2017 9:35 AM in response to QuietMacFan

QuietMacFan wrote:


it's often been suggested (if not proven) that the people selling "anti-virus" are the same people writing viruses


It has been suggested that the government is tracking everyone through implants that are injected when you get a vaccination. I'd caution against listening to those kinds of paranoid suggestions.


The idea that anti-virus developers are also writing viruses is an urban legend - dating back to the time when the first computer viruses began to appear and when people didn't believe in them - that was debunked decades ago.

Jan 24, 2017 12:45 PM in response to pseudo0099

Should I be worried about the 2 Flash Players? ('Flashplayer-10.6: 24.0.0.194' & 'FlashPlayer: 24.0.0.194')

I updated the flash software and here are the new results:

Internet Plug-ins:

FlashPlayer-10.6: 24.0.0.194 - SDK 10.9 (2017-01-24) [Support]

QuickTime Plugin: 7.7.3 (2016-12-23)

Flash Player: 24.0.0.194 - SDK 10.9 (2017-01-24) [Support]


3rd Party Preference Panes:

Flash Player (2016-12-16) [Support]

Jan 24, 2017 1:50 PM in response to pseudo0099

The curl utility is installed by the operating system from the Essentials package into /usr/bin/curl. It normally will not run unless you deliberately run it in the Terminal, or it is invoked from within an application, or script.


There are no viruses on OS X, so an anti-virus tool (in name only) will need to provide occasional false positives to make you believe that an annual subscription is not worthless — which it is. The operating system has several layers of protection built into it that are regularly updated from Apple, and anti-virus products continuously interfere with this internal protection — to the chagrin of the user.


I don't run anti-virus products, and neither should you, if you value a stable, running Mac. Remove your anti-virus product per the vendor's full removal procedure, and then reboot afterward.


There is a growing population of malware products that can be unknowingly downloaded from advertisement polluted web sites, and you do need a anti-malware product to detect, and remove that crap. I use the free Malwarebytes product.

Jan 24, 2017 6:17 PM in response to pseudo0099

That could be an artifact of Etrecheck, but I'm not sure. They both seem to have the same version. You can look in /Library/Internet Plug-Ins to see if there really are two. There should be a plugin and an .xpt file.


However, what you should really be worried about is the man system daemons that have been terminated to make room for all of the useless anti-virus crap.

Jan 25, 2017 10:49 AM in response to pseudo0099

I don't see anything concerning installed on your system, beyond the deluge (24!!!) of Intego launch agents & daemons. I don't understand why Intego needs so many of those, but it's just too much. And one of the components that's installed is a worthless "cleaning" app. I'd agree with those who convinced you to remove it.


As for the warning about curl, I wouldn't worry about it at this point. You don't appear to have anything but legit software installed.

Jan 25, 2017 11:43 AM in response to pseudo0099

You only have a 4GB MacBook Air, and with Sierra's memory footprint, you have to be very careful on what you configure for iCloud Services in that specific System Preferences panel, and the number of applications that you can run concurrently. When the Air runs out of RAM, as it is still showing, it will begin swapping, and that makes the overall system annoyingly sluggish. If you use Launchpad : Other : Activity Monitor, and click the Memory tab, you want to see green memory pressure, and no Swap Used.


I would clear out all of those login items from System Preferences : Users & Groups : Login Items, and decide if you want to drag and drop the Applications icons to your Dock, where they wont draw down on your remaining memory until you use them. Again, in the spirit of memory conservation, quit the applications that you are not using. That may not be by clicking the red traffic light in the application, or document title bar.


I see that you are not using Time Machine backups to an external drive. Many believe that copying files to iCloud Drive is their backup plan, but Apple is not backing your files up on iCloud. Time Machine will not only backup up changes on your boot drive, it will also get what has changed out on iCloud Drive as part of its backup. No backup strategy is high risk.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

'curl' attempting to connect to the internet

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.