ALL System Root Certificates Invalid in 10.12.3!

If Apple tell you to contact the government/ law enforcement then that is what you should do. We can't help via the internet. EFI attacks have been discussed in various research papers but cannot be solved via forums like this (if they can be solved at all). Frankly if the EFI is 'hacked' you need to abandon the Mac, look at the research papers if you think I am being harsh. EFI attacks are potentially insidious alterations that cannot be removed, 3 letter agency stuff beyond most script kiddies & jilted ex's.

Mac's do not have 'BIOS', they use EFI instead. There is a nuanced difference between them. It makes me think you are being duped or not listening to what the technicians are telling you when you claim it had to be 'bios unlocked'. Misunderstanding critical details seems to be part of your problem…

'Disk Utility' as you call it seems more likely to be the recovery system - it has a lot of complex 'juggling' to do. Having many partitions mounted in that mode has always been the case as far as I can tell. It is running an entire OS & repair system from a 650MB partition. I have 17 partitions listed in df when running inside a 10.9 recovery OS, 2 are external disks the rest is part of how recovery works (or maybe everyone is 'EFI hacked' OMG!?!?).

df is disk free space, not disk find.

It may be normal for multiple listings to be shown in df, I have /home, /dev and /net for example in a normal boot, it really depends on what the Mac is doing, certain apps will mount dmgs invisibly for updates etc (Google and Adobe seem to do it a lot).

You keep asserting the certificates 'are not found in root' but that is NOT THE CASE. The certs are valid - look at the text next to the green checkmark! I'm convinced you are simply running tests on a cert that are inappropriate and you have not acknowledged that at all.

Schwigs wrote:

So, here's what I'm thinking -- maybe take the machine back to Best Buy and exchange for new one. Power off my iPhone (who knows, it could be the source of the problem though I have a new one on a new account with a new number like I said and it never "touched" any of the dirty hardware) just in case, setup the machine in the parking lot and see what happens?

Do that or visit any Apple store - run your same certificate validation on their Macs using the same faulty option (code signing) you should see the same thing that you claim is an error. I believe the error is that you are choosing the wrong option to evaluate the cert.

Schwigs wrote:

Idk, maybe I'm a paranoid *******, but we did find that someone put a packet sniffer somewhere near my property when I got hacked. It was attached to my wifi (which has since been disposed of, only use USB tethering now), but I've wondered if it was Bluetooth or NFC capable as well. All you'd have to do is hook it to a cell phone and power supply and poof, you can hack me all day with the right tools.

Have you even read the Etrecheck report you posted?

[loaded] com.apple.bluetooth.PacketLogger.plist (2016-09-09) - /AppleInternal/DevTools/Hardware/PacketLogger.app/Contents/MacOS/PacketLogger: Executable not found!

That looks like a packet logger that is probably part of the Apple store iOS test tools - your Mac is not as clean as you think. Google it…

https://www.theiphonewiki.com/wiki/Apple_Internal_Apps

It was once set to run but now those tools are missing from that location.

Schwigs wrote:

Last question before I do that - is there any way to verify root certs directly with Apple via an SSL connection or something like that? I mean, all of mine match up with what's on their list for Sierra, but if they're in the wrong "place", then that seems screwy.

Apple's site listing the certs already uses SSL the URL is httpS

List of available trusted root certificates in macOS Sierra - Apple Support

View that page on a computer or device that you do not think is 'hacked'. Check the cert on that site too before you trust the page. I don't know what you mean by the certs being in the 'wrong place'. If they were wrong they would not validate.

You can't 'reflash the original firmware' if you believe the EFI is hacked - that is the point of those attacks, seriously get rid of the Mac.

I'm afraid I don't think I can help you beyond the info above.

You appear to be making assumptions & misunderstanding parts of the OS that is normal. You may need to turn your focus towards yourself instead of the Mac - how much do you really know to judge what is faulty or unusual on macOS?

Perhaps it is just how it goes when trying to troubleshoot issues like this via the internet. Unfortunately it appears to be a never ending problem with you finding more reasons to assume, misunderstand & create ideas that the Mac is not correct. I'd wipe it to remove the Apple left overs from Apple's tools.

I suggest you simply erase the Mac & return it or contact the government/ law enforcement.

It is not clear what revelation those image are meant to show - Certification Assistant is for making your own signed certs & vertifying others, provided you choose the correct options. I do not think you should try to use Apple's code signing policy to evaluate that root certificate (or any other root cert - I doubt they have code signing enabled).

If you want to confirm the installed certificates are legit you need to compare to the ones that Apple list…

List of available trusted root certificates in macOS Sierra - Apple Support

Or for earlier OS's Lists of available trusted root certificates in macOS - Apple Support

and iOS…

Lists of available trusted root certificates in iOS - Apple Support

I get the same 'error' when trying to evaluate Apple Root CA as a code signing cert on 10.9. I also get an 'error' when I hit screws into wood with a hammer, something about using the wrong tools to do a job springs to mind… 🙂

I may be totally wrong, certificates are a minefield of complexity if you want to get into detail, however I think you are evaluating using the wrong settings & assuming everything is bad.

It looks fine if I evaluate as a generic (certificate chain validation). Hit the 'learn more' button to get info on trust policies if you have that button…

Schwigs wrote:

Drew,

Again, thank you very much for the help. I hope you know I take no offense to what you said.

Excellent, that was my intention 🙂

I don't doubt that your experience can make you try to ensure everything is safe, as far as I can tell you don't trust this device and should return/ exchange it if that is at all possible.

The keychain is not intended to be used to codesign apps for that you need an Apple developer account with a certificate & then use the tools in Xcode (or Terminal). I do not believe the Apple root cert is suited to code signing - which is why I am convinced your test is invalid. I'll see if any developers can help clarify.

The codesign manual may help (or add to the complexity & confusion)

'man codesign' in Terminal or…

https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPag es/man1/codesign.1.html

Good luck with it.

To clarify some things...

In the screen shots posted to start this thread, Schwigs was attempting to evaluate Apple system certificates based on a "code signing" trust policy meant for Apple developers. (See https://developer.apple.com/library/prerelease/content/documentation/Security/Co nceptual/CertKeyTrustProgGuide/Trust.htm…). Perhaps Schwigs was following instructions from this Apple Support Document (see Keychain Access: Determine if a certificate is valid). Unfortunately, that document is incorrect. Certificates and code signing is very complicated, sometimes too complicated for even Apple support itself.

Those "AppleInternal" items in the EtreCheck report are completely normal. All macOS installations have a long list of such leftover internal files and known failures. By default, EtreCheck hides those things and for good reason.

There is no evidence in this thread of any kind of hacking whatsoever, either on this machine or the previous one. I can't comment on any other internet hacking or identity theft issues. Sadly, those are all too common. But digging into the internals of a Mac is the wrong place to be looking.

<Edited by Host>

This is going over my head right now. Mr. Etresoft guy are you saying that the PacketLogger is a normal term for the PF that's on every Mac (which imho is sadly neglected and relegated to the Terminal)? I second the OPs comment on AppleCare's diminished capacity here. Please look at what recently happened to me: 10.12.3 Combo update failing code sign verification, certificates fail, and mysterious error message from the Mac Store. I've ran the Etresoft before and had similar complaints. I feel like I have some modified OS too as out there as that sounds. I've seen weird things in my Installer Log during restoration. I know that a computer of mine was configured to send something to an IP address in Japan, found a Japanese migration assistant, and I'm afraid to say more.

Look at this Installer Log (errors only) from Recovery Mode. It was dated Sept. 18, 2004 and this was last week:

Sep 17 22:53:29 localhost Unknown[307]: Launching the Language Chooser for an OS Install

Sep 17 22:53:37 localhost configd[112]: bootp_session_transmit: bpf_write(en1) failed: Network is down (50)

Sep 17 22:53:37 localhost configd[112]: DHCP en1: INIT transmit failed

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /System/Library/CoreServices/Archive Utility.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /System/Library/CoreServices/Dock.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /System/Library/CoreServices/Finder.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /System/Library/CoreServices/Screen Sharing.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /Applications/Address Book.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /Applications/App Store.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /Applications/FaceTime.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /Applications/iCal.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /Applications/iChat.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /Applications/Mail.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /Applications/Preview.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /Applications/QuickTime Player.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /Applications/System Preferences.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /Applications/TextEdit.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /Applications/iTunes.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /Applications/Utilities/Console.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /Applications/Utilities/VoiceOver Utility.app

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /System/Library/Services/AppleSpell.service

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /System/Library/Services/OpenSpell.service

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /System/Library/Services/SpeechService.service

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /System/Library/Services/Spotlight.service

Sep 17 22:53:38 localhost LCA[308]: Error -10811 retgisting path /System/Library/Image Capture/Support/Image Capture Extension.app

Sep 17 22:53:39 localhost diskmanagementd[329]: DM ->T+[DMToolBootPreference getPartitionBootability:]: inUDS=0x1110efc30=disk1s3=Mac OS X Base System

Sep 17 22:53:39 localhost diskmanagementd[329]: DM ..T+[DMToolBootPreference getPartitionBootability:]: PMBootable=1 (bootable right now without any further action)

Sep 17 22:53:39 localhost diskmanagementd[329]: DM ..T+[DMToolBootPreference getPartitionBootability:]: PMBootCapable=0 (bootable if you call MKCFPrepareBootDevice)

Sep 17 22:53:39 localhost diskmanagementd[329]: DM ..T+[DMToolBootPreference getPartitionBootability:]: PMBootSurgeryRequired=0 (for primitive MBR on BIOS, add boot block and loader)

Sep 17 22:53:39 localhost diskmanagementd[329]: DM ..T+[DMToolBootPreference getPartitionBootability:]: PMFSSurgeryRequired=0 (for primitive MBR on BIOS, add boot block and loader)

Sep 17 22:53:39 localhost diskmanagementd[329]: DM ..T+[DMToolBootPreference getPartitionBootability:]: PMNewfsRequired=1 (bootable with MKCFPrep but it will rudely carve)

Sep 17 22:53:39 localhost diskmanagementd[329]: DM <-T+[DMToolBootPreference getPartitionBootability:]: MKerr=0 out=12=0xc

Sep 17 22:53:45 localhost diskmanagementd[329]: DM ->T+[DMToolBootPreference getPartitionBootability:]: inUDS=0x1110efc30=disk1s3=Mac OS X Base System

Sep 17 22:53:45 localhost diskmanagementd[329]: DM ..T+[DMToolBootPreference getPartitionBootability:]: PMBootable=1 (bootable right now without any further action)

Sep 17 22:53:45 localhost diskmanagementd[329]: DM ..T+[DMToolBootPreference getPartitionBootability:]: PMBootCapable=0 (bootable if you call MKCFPrepareBootDevice)

Sep 17 22:53:45 localhost diskmanagementd[329]: DM ..T+[DMToolBootPreference getPartitionBootability:]: PMBootSurgeryRequired=0 (for primitive MBR on BIOS, add boot block and loader)

Sep 17 22:53:45 localhost diskmanagementd[329]: DM ..T+[DMToolBootPreference getPartitionBootability:]: PMFSSurgeryRequired=0 (for primitive MBR on BIOS, add boot block and loader)

Sep 17 22:53:45 localhost diskmanagementd[329]: DM ..T+[DMToolBootPreference getPartitionBootability:]: PMNewfsRequired=1 (bootable with MKCFPrep but it will rudely carve)

Sep 17 22:53:45 localhost diskmanagementd[329]: DM <-T+[DMToolBootPreference getPartitionBootability:]: MKerr=0 out=12=0xc

Sep 17 22:53:45 localhost configd[112]: subnet_route_if_index: can't get interface name

Sep 17 22:58:32 localhost LCA[308]: Launching the Springboard using language code "English"

Sep 17 22:58:34 localhost Unknown[309]: Keyboard Layouts: duplicate keyboard layout identifier -16899.

Sep 17 22:58:34 localhost Unknown[309]: Keyboard Layouts: keyboard layout identifier -16899 has been replaced with -28673.

Sep 17 22:58:34 localhost Unknown[309]: Keyboard Layouts: duplicate keyboard layout identifier -16900.

Sep 17 22:58:34 localhost Unknown[309]: Keyboard Layouts: keyboard layout identifier -16900 has been replaced with -28674.

Sep 17 22:58:43 localhost Unknown[309]: 2004-09-17 22:58:43.103 Safari[546:9f03] WARNING: BookmarkedFeedsManager couldn't get PSClient!

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.1 - Client: webfilterproxyd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.1 - ODNodeCreateWithName request, SessionID: 00000000-0000-0000-0000-000000000000, Name: /Local/Default

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.1 - loading configuration for '/Local' from '/System/Library/OpenDirectory/Configurations/Local.plist'

Sep 17 23:00:22 localhost opendirectoryd[101]: Loaded bundle at path '/System/Library/OpenDirectory/Modules/PlistFile.bundle'

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.1 - unable to find authentication module 'ConfigurationProfiles'

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.1 - unable to find service discovery callback for module 'PlistFile'

Sep 17 23:00:22 localhost opendirectoryd[101]: Registering for network changes

Sep 17 23:00:22 localhost opendirectoryd[101]: Registered subnode with name '/Local/Default'

Sep 17 23:00:22 localhost opendirectoryd[101]: failed to open local node for internal record copy

Sep 17 23:00:22 localhost opendirectoryd[101]: Registering for power changes

Sep 17 23:00:22 localhost opendirectoryd[101]: Registering for network power changes

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.1, Node: /Local/Default - node assigned UUID - E4968901-0192-4790-A0A9-15704A3BE171

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.1, Node: /Local/Default - ODNodeCreateWithName completed

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.2 - Client: webfilterproxyd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.2 - ODQueryCreateWithNode request, NodeID: E4968901-0192-4790-A0A9-15704A3BE171, RecordType(s): dsRecTypeStandard:Users, Attribute: dsAttrTypeStandard:UniqueID, MatchType: EqualTo, Equality: Number, Value(s): 0, Requested Attributes: dsAttributesAll, Max Results: 2147483647

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.2, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed, delivered 1 result

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.3 - Client: webfilterproxyd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.3 - ODQueryCreateWithNode request, NodeID: E4968901-0192-4790-A0A9-15704A3BE171, RecordType(s): dsRecTypeStandard:Users, Attribute: dsAttrTypeStandard:RecordName, MatchType: EqualTo, Equality: CaseIgnore, Value(s): root, Requested Attributes: dsAttributesAll, Max Results: 1

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.3, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed, delivered 1 result

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.4 - Client: webfilterproxyd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.4 - ODQueryCreateWithNode request, NodeID: E4968901-0192-4790-A0A9-15704A3BE171, RecordType(s): dsRecTypeStandard:Users, Attribute: dsAttrTypeStandard:RecordName, MatchType: EqualTo, Equality: CaseIgnore, Value(s): root, Requested Attributes: dsAttrTypeStandard:GeneratedUID,dsAttrTypeNative:_writers_LinkedIdentity,dsAttr TypeStandard:RealName,dsAttrTypeNative:_writers_realname,dsAttrTypeNative:Linked Identity,dsAttrTypeStandard:Picture,dsAttrTypeNative:_writers_UserCertificate,ds AttrTypeStandard:Password,dsAttrTypeStandard:CopyTimestamp,dsAttrTypeStandard:Ap pleMetaNodeLocation,dsAttrTypeStandard:RecordType,dsAttrTypeStandard:PrimaryGrou pID,dsAttrTypeStandard:AuthenticationAuthority,dsAttrTypeNative:_writers_hint,ds AttrTypeNative:_shadow_passwd,dsAttrTypeNative:_defaultLanguage,dsAttrTypeStanda rd:MCXSettings,dsAttrTypeStandard:JPEGPhoto,dsAttrTypeNative:_writers_passwd,dsA ttrTypeStandard:RecordName,dsAttrTypeStandard:AuthenticationHint,dsAttrTypeNativ e:_writers_picture,dsAttrTypeNative:_writers__defaultLanguage,dsAttrTypeNative:e xternal,dsAttrTypeNative:_guest,dsAttrTypeStandard:HomeDirectory,dsAttrTypeStand ard:UserShell,dsAttrTypeNative:_writers_jpegphoto,dsAttrTypeStandard:UniqueID,ds AttrTypeStandard:AppleMetaRecordName,dsAttrTypeStandard:NFSHomeDirectory, Max Results: 1

Sep 17 23:00:22 localhost opendirectoryd[101]: 616.4, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed, delivered 1 result

Sep 17 23:01:04 localhost opendirectoryd[101]: Processing a network change notification

Sep 17 23:20:36 localhost Unknown[309]: 2004-09-17 23:20:36.458 Safari[1428:9f03] WARNING: BookmarkedFeedsManager couldn't get PSClient!

Sep 17 23:20:36 localhost Unknown[309]: 2004-09-17 23:20:36.983 WebProcess[1429:2e03] Failed to communicate with qtkitserver: Connection invalid

Sep 17 23:20:36 localhost Unknown[309]: 2004-09-17 23:20:36.983 WebProcess[1429:2e03] Failed to initializeServer(), returned 5

Sep 17 23:36:34 localhost opendirectoryd[101]: Received power notification - disabling network activity

Sep 17 23:56:17 localhost opendirectoryd[101]: Received power notification - enabling network activity

Sep 17 23:56:18 localhost opendirectoryd[101]: Received power notification (system has powered on)

Sep 17 23:56:26 localhost configd[112]: subnet_route_if_index: can't get interface name

Sep 17 23:56:30 localhost opendirectoryd[101]: Processing a network change notification

Sep 18 00:07:56 localhost opendirectoryd[101]: Received power notification - disabling network activity

Sep 18 03:46:25 localhost opendirectoryd[101]: Received power notification - enabling network activity

Sep 18 03:46:25 localhost opendirectoryd[101]: Received power notification (system has powered on)

Sep 18 03:46:27 localhost opendirectoryd[101]: Processing a network change notification

Sep 18 03:46:33 localhost configd[112]: subnet_route_if_index: can't get interface name

Sep 18 03:46:37 localhost opendirectoryd[101]: Processing a network change notification

Sep 18 03:47:07 localhost opendirectoryd[101]: Processing a network change notification

Sep 18 03:57:14 localhost Unknown[309]: 2004-09-18 03:57 Disk Utility[1435] (CarbonCore.framework) FSEventStreamStart: ERROR: FSEvents_connect() => Unknown service name (1102)

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.5 - Client: coreservicesd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.5 - ODNodeCreateWithName request, SessionID: 00000000-0000-0000-0000-000000000000, Name: /Local/Default

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.5, Node: /Local/Default - node assigned UUID - 566E251B-0D5D-4809-9B14-2AA29283473F

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.5, Node: /Local/Default - ODNodeCreateWithName completed

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.6 - Client: coreservicesd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.6 - ODQueryCreateWithNode request, NodeID: 566E251B-0D5D-4809-9B14-2AA29283473F, RecordType(s): dsRecTypeNative:config, Attribute: dsAttrTypeStandard:RecordName, MatchType: EqualTo, Equality: CaseExact, Value(s): SharePoints, Requested Attributes: dsAttributesAll, Max Results: 1

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.6, Node: /Local/Default, Module: PlistFile - client is using a native record type 'config' which is not portable

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.6, Node: /Local/Default, Module: PlistFile - client is using a native record type 'config' which is not portable

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.6, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.7 - Client: coreservicesd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.7 - ODNodeCreateRecord request, NodeID: 566E251B-0D5D-4809-9B14-2AA29283473F, RecordType: dsRecTypeNative:config, RecordName: SharePoints, Attributes: <none>

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.7, Node: /Local/Default, Module: PlistFile - client is using a native record type 'config' which is not portable

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.7, Node: /Local/Default, Module: PlistFile - ODNodeCreateRecord completed, delivered 1 result

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.8 - Client: coreservicesd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.8 - ODQueryCreateWithNode request, NodeID: 566E251B-0D5D-4809-9B14-2AA29283473F, RecordType(s): dsRecTypeNative:config/SharePoints, Attribute: dsAttrTypeStandard:RecordName, MatchType: Any, Equality: CaseExact, Value(s): dsRecordsAll, Requested Attributes: dsAttrTypeNative:ftp_guestaccess,dsAttrTypeNative:smb_name,dsAttrTypeNative:sha repoint_account_uuid,dsAttrTypeNative:smb_createmask,dsAttrTypeNative:sharepoint _version,dsAttrTypeStandard:AppleMetaNodeLocation,dsAttrTypeNative:afp_guestacce ss,dsAttrTypeNative:afp_shared,dsAttrTypeStandard:RecordType,dsAttrTypeNative:ft p_shared,dsAttrTypeNative:afp_name,dsAttrTypeNative:smb_oplocks,dsAttrTypeNative :afp_use_parent_owner,dsAttrTypeNative:smb_directorymask,dsAttrTypeStandard:Reco rdName,dsAttrTypeNative:afp_use_parent_privs,dsAttrTypeNative:smb_guestaccess,ds AttrTypeNative:smb_inherit_permissions,dsAttrTypeStandard:AppleMetaRecordName,ds AttrTypeNative:smb_shared,dsAttrTypeNative:directory_path,dsAttrTypeNative:smb_s trictlocking,dsAttrTypeNative:sharepoint_group_id,dsAttrTypeNative:ftp_name, Max Results: 2147483647

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.8, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.8, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.8, Node: /Local/Default, Module: PlistFile - flushing record '/private/var/db/dslocal/nodes/Default/config/SharePoints'

Sep 18 03:57:14 localhost opendirectoryd[101]: Module: PlistFile - ___index_record_block_invoke_1: sqlite3_prepare_v2: 21

Sep 18 03:57:14 localhost opendirectoryd[101]: Module: PlistFile - ___index_record_block_invoke_1: sqlite3_prepare_v2: 21

Sep 18 03:57:14 localhost opendirectoryd[101]: 310.8, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed

Sep 18 03:57:14 localhost Unknown[309]: 2004-09-18 03:57:14.313 Disk Utility[1435:a003] NSSoftLinking - The iLifeMediaBrowser framework's library couldn't be loaded from (null).

Sep 18 03:57:46 localhost Unknown[309]: 2004-09-18 03:57:46.010 Disk Utility[1435:a003] NSSoftLinking - The iLifeMediaBrowser framework's library couldn't be loaded from (null).

Sep 18 03:58:06 localhost Unknown[309]: 2004-09-18 03:58:06.418 Disk Utility[1435:a003] NSSoftLinking - The iLifeMediaBrowser framework's library couldn't be loaded from (null).

Sep 18 03:59:57 localhost opendirectoryd[101]: 310.9 - Client: coreservicesd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 18 03:59:57 localhost opendirectoryd[101]: 310.9 - ODQueryCreateWithNode request, NodeID: 566E251B-0D5D-4809-9B14-2AA29283473F, RecordType(s): dsRecTypeNative:config/SharePoints, Attribute: dsAttrTypeStandard:RecordName, MatchType: Any, Equality: CaseExact, Value(s): dsRecordsAll, Requested Attributes: dsAttrTypeNative:ftp_guestaccess,dsAttrTypeNative:smb_name,dsAttrTypeNative:sha repoint_account_uuid,dsAttrTypeNative:smb_createmask,dsAttrTypeNative:sharepoint _version,dsAttrTypeStandard:AppleMetaNodeLocation,dsAttrTypeNative:afp_guestacce ss,dsAttrTypeNative:afp_shared,dsAttrTypeStandard:RecordType,dsAttrTypeNative:ft p_shared,dsAttrTypeNative:afp_name,dsAttrTypeNative:smb_oplocks,dsAttrTypeNative :afp_use_parent_owner,dsAttrTypeNative:smb_directorymask,dsAttrTypeStandard:Reco rdName,dsAttrTypeNative:afp_use_parent_privs,dsAttrTypeNative:smb_guestaccess,ds AttrTypeNative:smb_inherit_permissions,dsAttrTypeStandard:AppleMetaRecordName,ds AttrTypeNative:smb_shared,dsAttrTypeNative:directory_path,dsAttrTypeNative:smb_s trictlocking,dsAttrTypeNative:sharepoint_group_id,dsAttrTypeNative:ftp_name, Max Results: 2147483647

Sep 18 03:59:57 localhost opendirectoryd[101]: 310.9, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 03:59:57 localhost opendirectoryd[101]: 310.9, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 03:59:57 localhost opendirectoryd[101]: 310.9, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed

Sep 18 04:00:17 localhost opendirectoryd[101]: 310.10 - Client: coreservicesd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 18 04:00:17 localhost opendirectoryd[101]: 310.10 - ODQueryCreateWithNode request, NodeID: 566E251B-0D5D-4809-9B14-2AA29283473F, RecordType(s): dsRecTypeNative:config/SharePoints, Attribute: dsAttrTypeStandard:RecordName, MatchType: Any, Equality: CaseExact, Value(s): dsRecordsAll, Requested Attributes: dsAttrTypeNative:ftp_guestaccess,dsAttrTypeNative:smb_name,dsAttrTypeNative:sha repoint_account_uuid,dsAttrTypeNative:smb_createmask,dsAttrTypeNative:sharepoint _version,dsAttrTypeStandard:AppleMetaNodeLocation,dsAttrTypeNative:afp_guestacce ss,dsAttrTypeNative:afp_shared,dsAttrTypeStandard:RecordType,dsAttrTypeNative:ft p_shared,dsAttrTypeNative:afp_name,dsAttrTypeNative:smb_oplocks,dsAttrTypeNative :afp_use_parent_owner,dsAttrTypeNative:smb_directorymask,dsAttrTypeStandard:Reco rdName,dsAttrTypeNative:afp_use_parent_privs,dsAttrTypeNative:smb_guestaccess,ds AttrTypeNative:smb_inherit_permissions,dsAttrTypeStandard:AppleMetaRecordName,ds AttrTypeNative:smb_shared,dsAttrTypeNative:directory_path,dsAttrTypeNative:smb_s trictlocking,dsAttrTypeNative:sharepoint_group_id,dsAttrTypeNative:ftp_name, Max Results: 2147483647

Sep 18 04:00:17 localhost opendirectoryd[101]: 310.10, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:00:17 localhost opendirectoryd[101]: 310.10, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:00:17 localhost opendirectoryd[101]: 310.10, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed

Sep 18 04:00:20 localhost opendirectoryd[101]: 310.11 - Client: coreservicesd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 18 04:00:20 localhost opendirectoryd[101]: 310.11 - ODQueryCreateWithNode request, NodeID: 566E251B-0D5D-4809-9B14-2AA29283473F, RecordType(s): dsRecTypeNative:config/SharePoints, Attribute: dsAttrTypeStandard:RecordName, MatchType: Any, Equality: CaseExact, Value(s): dsRecordsAll, Requested Attributes: dsAttrTypeNative:ftp_guestaccess,dsAttrTypeNative:smb_name,dsAttrTypeNative:sha repoint_account_uuid,dsAttrTypeNative:smb_createmask,dsAttrTypeNative:sharepoint _version,dsAttrTypeStandard:AppleMetaNodeLocation,dsAttrTypeNative:afp_guestacce ss,dsAttrTypeNative:afp_shared,dsAttrTypeStandard:RecordType,dsAttrTypeNative:ft p_shared,dsAttrTypeNative:afp_name,dsAttrTypeNative:smb_oplocks,dsAttrTypeNative :afp_use_parent_owner,dsAttrTypeNative:smb_directorymask,dsAttrTypeStandard:Reco rdName,dsAttrTypeNative:afp_use_parent_privs,dsAttrTypeNative:smb_guestaccess,ds AttrTypeNative:smb_inherit_permissions,dsAttrTypeStandard:AppleMetaRecordName,ds AttrTypeNative:smb_shared,dsAttrTypeNative:directory_path,dsAttrTypeNative:smb_s trictlocking,dsAttrTypeNative:sharepoint_group_id,dsAttrTypeNative:ftp_name, Max Results: 2147483647

Sep 18 04:00:20 localhost opendirectoryd[101]: 310.11, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:00:20 localhost opendirectoryd[101]: 310.11, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:00:20 localhost opendirectoryd[101]: 310.11, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed

Sep 18 04:01:00 localhost opendirectoryd[101]: 310.12 - Client: coreservicesd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 18 04:01:00 localhost opendirectoryd[101]: 310.12 - ODQueryCreateWithNode request, NodeID: 566E251B-0D5D-4809-9B14-2AA29283473F, RecordType(s): dsRecTypeNative:config/SharePoints, Attribute: dsAttrTypeStandard:RecordName, MatchType: Any, Equality: CaseExact, Value(s): dsRecordsAll, Requested Attributes: dsAttrTypeNative:ftp_guestaccess,dsAttrTypeNative:smb_name,dsAttrTypeNative:sha repoint_account_uuid,dsAttrTypeNative:smb_createmask,dsAttrTypeNative:sharepoint _version,dsAttrTypeStandard:AppleMetaNodeLocation,dsAttrTypeNative:afp_guestacce ss,dsAttrTypeNative:afp_shared,dsAttrTypeStandard:RecordType,dsAttrTypeNative:ft p_shared,dsAttrTypeNative:afp_name,dsAttrTypeNative:smb_oplocks,dsAttrTypeNative :afp_use_parent_owner,dsAttrTypeNative:smb_directorymask,dsAttrTypeStandard:Reco rdName,dsAttrTypeNative:afp_use_parent_privs,dsAttrTypeNative:smb_guestaccess,ds AttrTypeNative:smb_inherit_permissions,dsAttrTypeStandard:AppleMetaRecordName,ds AttrTypeNative:smb_shared,dsAttrTypeNative:directory_path,dsAttrTypeNative:smb_s trictlocking,dsAttrTypeNative:sharepoint_group_id,dsAttrTypeNative:ftp_name, Max Results: 2147483647

Sep 18 04:01:00 localhost opendirectoryd[101]: 310.12, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:01:00 localhost opendirectoryd[101]: 310.12, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:01:00 localhost opendirectoryd[101]: 310.12, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed

Sep 18 04:01:09 localhost Unknown[309]: 2004-09-18 04:01:09.161 Disk Utility[1435:a003] NSSoftLinking - The iLifeMediaBrowser framework's library couldn't be loaded from (null).

Sep 18 04:04:50 localhost opendirectoryd[101]: 310.13 - Client: coreservicesd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 18 04:04:50 localhost opendirectoryd[101]: 310.13 - ODQueryCreateWithNode request, NodeID: 566E251B-0D5D-4809-9B14-2AA29283473F, RecordType(s): dsRecTypeNative:config/SharePoints, Attribute: dsAttrTypeStandard:RecordName, MatchType: Any, Equality: CaseExact, Value(s): dsRecordsAll, Requested Attributes: dsAttrTypeNative:ftp_guestaccess,dsAttrTypeNative:smb_name,dsAttrTypeNative:sha repoint_account_uuid,dsAttrTypeNative:smb_createmask,dsAttrTypeNative:sharepoint _version,dsAttrTypeStandard:AppleMetaNodeLocation,dsAttrTypeNative:afp_guestacce ss,dsAttrTypeNative:afp_shared,dsAttrTypeStandard:RecordType,dsAttrTypeNative:ft p_shared,dsAttrTypeNative:afp_name,dsAttrTypeNative:smb_oplocks,dsAttrTypeNative :afp_use_parent_owner,dsAttrTypeNative:smb_directorymask,dsAttrTypeStandard:Reco rdName,dsAttrTypeNative:afp_use_parent_privs,dsAttrTypeNative:smb_guestaccess,ds AttrTypeNative:smb_inherit_permissions,dsAttrTypeStandard:AppleMetaRecordName,ds AttrTypeNative:smb_shared,dsAttrTypeNative:directory_path,dsAttrTypeNative:smb_s trictlocking,dsAttrTypeNative:sharepoint_group_id,dsAttrTypeNative:ftp_name, Max Results: 2147483647

Sep 18 04:04:50 localhost opendirectoryd[101]: 310.13, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:04:50 localhost opendirectoryd[101]: 310.13, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:04:50 localhost opendirectoryd[101]: 310.13, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed

Sep 18 04:05:09 localhost diskmanagementd[1436]: DM ->T-[DMToolBootPreference buildBootCachesForDisk:forcing:]: inDiskUDS=0x7febd344f4a8=disk0s2=Computer inForce=1

Sep 18 04:05:10 localhost opendirectoryd[101]: 310.14 - Client: coreservicesd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 18 04:05:10 localhost opendirectoryd[101]: 310.14 - ODQueryCreateWithNode request, NodeID: 566E251B-0D5D-4809-9B14-2AA29283473F, RecordType(s): dsRecTypeNative:config/SharePoints, Attribute: dsAttrTypeStandard:RecordName, MatchType: Any, Equality: CaseExact, Value(s): dsRecordsAll, Requested Attributes: dsAttrTypeNative:ftp_guestaccess,dsAttrTypeNative:smb_name,dsAttrTypeNative:sha repoint_account_uuid,dsAttrTypeNative:smb_createmask,dsAttrTypeNative:sharepoint _version,dsAttrTypeStandard:AppleMetaNodeLocation,dsAttrTypeNative:afp_guestacce ss,dsAttrTypeNative:afp_shared,dsAttrTypeStandard:RecordType,dsAttrTypeNative:ft p_shared,dsAttrTypeNative:afp_name,dsAttrTypeNative:smb_oplocks,dsAttrTypeNative :afp_use_parent_owner,dsAttrTypeNative:smb_directorymask,dsAttrTypeStandard:Reco rdName,dsAttrTypeNative:afp_use_parent_privs,dsAttrTypeNative:smb_guestaccess,ds AttrTypeNative:smb_inherit_permissions,dsAttrTypeStandard:AppleMetaRecordName,ds AttrTypeNative:smb_shared,dsAttrTypeNative:directory_path,dsAttrTypeNative:smb_s trictlocking,dsAttrTypeNative:sharepoint_group_id,dsAttrTypeNative:ftp_name, Max Results: 2147483647

Sep 18 04:05:10 localhost opendirectoryd[101]: 310.14, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:05:10 localhost opendirectoryd[101]: 310.14, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:05:10 localhost opendirectoryd[101]: 310.14, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed

Sep 18 04:05:10 localhost diskmanagementd[1436]: DM ..T-[DMToolBootPreference buildBootCachesForDisk:forcing:]: launching and blocking /usr/sbin/kextcache (

"-f",

"-u",

"/Volumes/Computer"

)

Sep 18 04:05:10 localhost diskmanagementd[1436]: DM ..T-[DMToolBootPreference buildBootCachesForDisk:forcing:]: kextcache exit status=0

Sep 18 04:05:10 localhost opendirectoryd[101]: 310.15 - Client: coreservicesd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 18 04:05:10 localhost opendirectoryd[101]: 310.15 - ODQueryCreateWithNode request, NodeID: 566E251B-0D5D-4809-9B14-2AA29283473F, RecordType(s): dsRecTypeNative:config/SharePoints, Attribute: dsAttrTypeStandard:RecordName, MatchType: Any, Equality: CaseExact, Value(s): dsRecordsAll, Requested Attributes: dsAttrTypeNative:ftp_guestaccess,dsAttrTypeNative:smb_name,dsAttrTypeNative:sha repoint_account_uuid,dsAttrTypeNative:smb_createmask,dsAttrTypeNative:sharepoint _version,dsAttrTypeStandard:AppleMetaNodeLocation,dsAttrTypeNative:afp_guestacce ss,dsAttrTypeNative:afp_shared,dsAttrTypeStandard:RecordType,dsAttrTypeNative:ft p_shared,dsAttrTypeNative:afp_name,dsAttrTypeNative:smb_oplocks,dsAttrTypeNative :afp_use_parent_owner,dsAttrTypeNative:smb_directorymask,dsAttrTypeStandard:Reco rdName,dsAttrTypeNative:afp_use_parent_privs,dsAttrTypeNative:smb_guestaccess,ds AttrTypeNative:smb_inherit_permissions,dsAttrTypeStandard:AppleMetaRecordName,ds AttrTypeNative:smb_shared,dsAttrTypeNative:directory_path,dsAttrTypeNative:smb_s trictlocking,dsAttrTypeNative:sharepoint_group_id,dsAttrTypeNative:ftp_name, Max Results: 2147483647

Sep 18 04:05:10 localhost opendirectoryd[101]: 310.15, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:05:10 localhost opendirectoryd[101]: 310.15, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:05:10 localhost diskmanagementd[1436]: DM <-T-[DMToolBootPreference buildBootCachesForDisk:forcing:]: 1

Sep 18 04:05:10 localhost opendirectoryd[101]: 310.15, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed

Sep 18 04:05:11 localhost opendirectoryd[101]: 310.16 - Client: coreservicesd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 18 04:05:11 localhost opendirectoryd[101]: 310.16 - ODQueryCreateWithNode request, NodeID: 566E251B-0D5D-4809-9B14-2AA29283473F, RecordType(s): dsRecTypeNative:config/SharePoints, Attribute: dsAttrTypeStandard:RecordName, MatchType: Any, Equality: CaseExact, Value(s): dsRecordsAll, Requested Attributes: dsAttrTypeNative:ftp_guestaccess,dsAttrTypeNative:smb_name,dsAttrTypeNative:sha repoint_account_uuid,dsAttrTypeNative:smb_createmask,dsAttrTypeNative:sharepoint _version,dsAttrTypeStandard:AppleMetaNodeLocation,dsAttrTypeNative:afp_guestacce ss,dsAttrTypeNative:afp_shared,dsAttrTypeStandard:RecordType,dsAttrTypeNative:ft p_shared,dsAttrTypeNative:afp_name,dsAttrTypeNative:smb_oplocks,dsAttrTypeNative :afp_use_parent_owner,dsAttrTypeNative:smb_directorymask,dsAttrTypeStandard:Reco rdName,dsAttrTypeNative:afp_use_parent_privs,dsAttrTypeNative:smb_guestaccess,ds AttrTypeNative:smb_inherit_permissions,dsAttrTypeStandard:AppleMetaRecordName,ds AttrTypeNative:smb_shared,dsAttrTypeNative:directory_path,dsAttrTypeNative:smb_s trictlocking,dsAttrTypeNative:sharepoint_group_id,dsAttrTypeNative:ftp_name, Max Results: 2147483647

Sep 18 04:05:11 localhost opendirectoryd[101]: 310.16, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:05:11 localhost opendirectoryd[101]: 310.16, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:05:11 localhost opendirectoryd[101]: 310.16, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed

Sep 18 04:06:00 localhost opendirectoryd[101]: 310.17 - Client: coreservicesd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 18 04:06:00 localhost opendirectoryd[101]: 310.17 - ODQueryCreateWithNode request, NodeID: 566E251B-0D5D-4809-9B14-2AA29283473F, RecordType(s): dsRecTypeNative:config/SharePoints, Attribute: dsAttrTypeStandard:RecordName, MatchType: Any, Equality: CaseExact, Value(s): dsRecordsAll, Requested Attributes: dsAttrTypeNative:ftp_guestaccess,dsAttrTypeNative:smb_name,dsAttrTypeNative:sha repoint_account_uuid,dsAttrTypeNative:smb_createmask,dsAttrTypeNative:sharepoint _version,dsAttrTypeStandard:AppleMetaNodeLocation,dsAttrTypeNative:afp_guestacce ss,dsAttrTypeNative:afp_shared,dsAttrTypeStandard:RecordType,dsAttrTypeNative:ft p_shared,dsAttrTypeNative:afp_name,dsAttrTypeNative:smb_oplocks,dsAttrTypeNative :afp_use_parent_owner,dsAttrTypeNative:smb_directorymask,dsAttrTypeStandard:Reco rdName,dsAttrTypeNative:afp_use_parent_privs,dsAttrTypeNative:smb_guestaccess,ds AttrTypeNative:smb_inherit_permissions,dsAttrTypeStandard:AppleMetaRecordName,ds AttrTypeNative:smb_shared,dsAttrTypeNative:directory_path,dsAttrTypeNative:smb_s trictlocking,dsAttrTypeNative:sharepoint_group_id,dsAttrTypeNative:ftp_name, Max Results: 2147483647

Sep 18 04:06:00 localhost opendirectoryd[101]: 310.17, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:06:00 localhost opendirectoryd[101]: 310.17, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:06:00 localhost opendirectoryd[101]: 310.17, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed

Sep 18 04:06:10 localhost opendirectoryd[101]: 310.18 - Client: coreservicesd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 18 04:06:10 localhost opendirectoryd[101]: 310.18 - ODQueryCreateWithNode request, NodeID: 566E251B-0D5D-4809-9B14-2AA29283473F, RecordType(s): dsRecTypeNative:config/SharePoints, Attribute: dsAttrTypeStandard:RecordName, MatchType: Any, Equality: CaseExact, Value(s): dsRecordsAll, Requested Attributes: dsAttrTypeNative:ftp_guestaccess,dsAttrTypeNative:smb_name,dsAttrTypeNative:sha repoint_account_uuid,dsAttrTypeNative:smb_createmask,dsAttrTypeNative:sharepoint _version,dsAttrTypeStandard:AppleMetaNodeLocation,dsAttrTypeNative:afp_guestacce ss,dsAttrTypeNative:afp_shared,dsAttrTypeStandard:RecordType,dsAttrTypeNative:ft p_shared,dsAttrTypeNative:afp_name,dsAttrTypeNative:smb_oplocks,dsAttrTypeNative :afp_use_parent_owner,dsAttrTypeNative:smb_directorymask,dsAttrTypeStandard:Reco rdName,dsAttrTypeNative:afp_use_parent_privs,dsAttrTypeNative:smb_guestaccess,ds AttrTypeNative:smb_inherit_permissions,dsAttrTypeStandard:AppleMetaRecordName,ds AttrTypeNative:smb_shared,dsAttrTypeNative:directory_path,dsAttrTypeNative:smb_s trictlocking,dsAttrTypeNative:sharepoint_group_id,dsAttrTypeNative:ftp_name, Max Results: 2147483647

Sep 18 04:06:10 localhost opendirectoryd[101]: 310.18, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:06:10 localhost opendirectoryd[101]: 310.18, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 04:06:10 localhost opendirectoryd[101]: 310.18, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed

Sep 18 04:06:12 localhost Unknown[309]:

Sep 18 04:19:51 localhost opendirectoryd[101]: Received power notification - disabling network activity

Sep 18 08:13:17 localhost opendirectoryd[101]: Received power notification - enabling network activity

Sep 18 08:13:17 localhost opendirectoryd[101]: Received power notification (system has powered on)

Sep 18 08:13:23 localhost configd[112]: subnet_route_if_index: can't get interface name

Sep 18 08:13:27 localhost opendirectoryd[101]: Processing a network change notification

Sep 18 08:23:36 localhost opendirectoryd[101]: Received power notification - disabling network activity

Sep 18 08:43:21 localhost opendirectoryd[101]: Received power notification - enabling network activity

Sep 18 08:43:21 localhost opendirectoryd[101]: Received power notification (system has powered on)

Sep 18 08:43:21 localhost configd[112]: subnet_route_if_index: can't get interface name

Sep 18 08:43:27 localhost opendirectoryd[101]: Processing a network change notification

Sep 18 08:43:34 localhost opendirectoryd[101]: Processing a network change notification

Sep 18 08:43:35 localhost configd[112]: subnet_route_if_index: can't get interface name

Sep 18 08:43:39 localhost opendirectoryd[101]: Processing a network change notification

Sep 18 08:45:03 localhost Unknown[309]: 2004-09-18 08:45 Mac OS X Utilities[534] (CarbonCore.framework) FSEventStreamStart: ERROR: FSEvents_connect() => Unknown service name (1102)

Sep 18 08:45:03 localhost opendirectoryd[101]: 310.19 - Client: coreservicesd, UID: 0, EUID: 0, GID: 0, EGID: 0

Sep 18 08:45:03 localhost opendirectoryd[101]: 310.19 - ODQueryCreateWithNode request, NodeID: 566E251B-0D5D-4809-9B14-2AA29283473F, RecordType(s): dsRecTypeNative:config/SharePoints, Attribute: dsAttrTypeStandard:RecordName, MatchType: Any, Equality: CaseExact, Value(s): dsRecordsAll, Requested Attributes: dsAttrTypeNative:ftp_guestaccess,dsAttrTypeNative:smb_name,dsAttrTypeNative:sha repoint_account_uuid,dsAttrTypeNative:smb_createmask,dsAttrTypeNative:sharepoint _version,dsAttrTypeStandard:AppleMetaNodeLocation,dsAttrTypeNative:afp_guestacce ss,dsAttrTypeNative:afp_shared,dsAttrTypeStandard:RecordType,dsAttrTypeNative:ft p_shared,dsAttrTypeNative:afp_name,dsAttrTypeNative:smb_oplocks,dsAttrTypeNative :afp_use_parent_owner,dsAttrTypeNative:smb_directorymask,dsAttrTypeStandard:Reco rdName,dsAttrTypeNative:afp_use_parent_privs,dsAttrTypeNative:smb_guestaccess,ds AttrTypeNative:smb_inherit_permissions,dsAttrTypeStandard:AppleMetaRecordName,ds AttrTypeNative:smb_shared,dsAttrTypeNative:directory_path,dsAttrTypeNative:smb_s trictlocking,dsAttrTypeNative:sharepoint_group_id,dsAttrTypeNative:ftp_name, Max Results: 2147483647

Sep 18 08:45:03 localhost opendirectoryd[101]: 310.19, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 08:45:03 localhost opendirectoryd[101]: 310.19, Node: /Local/Default, Module: PlistFile - client is using an old record type 'dsRecTypeNative:config/SharePoints' should be using kODRecordTypeSharePoints

Sep 18 08:45:03 localhost opendirectoryd[101]: 310.19, Node: /Local/Default, Module: PlistFile - ODQueryCreateWithNode completed

When you verify the cert please select 'generic' & do not select 'Code signing' it should be the first option screen.

I don't believe that message is a problem - the cert is valid (that means all the way back to the root). It looks to me that the cert is not intended for code signing, so that will always produce incorrect results.

Hopefully someone else will be able to verify my hypothesis either for or against.

As for the report - the missing 'AppleInternal' items trouble me. Did you install those items? They may be Apple test tools? Did you clean install this OS? e.g. erase the disk first.

There seems to be more system jobs listed than I'd normally expect, disabling the filtering option sure creates a lot of info :)

If you are not sure what the store did you should backup, erase & reinstall. It is the best & only way I know to be sure that the Mac is not compromised. I reread your post but I can't see if you explicitly erased the disk or just took whatever the store gave you. I suspect the 'AppleInternal' items are left over from their tests - e.g. not a clean OS.

You can restore your user data if you like but obviously that can bring over compromised data.

I don't see signs of a compromise, however you seem convinced something is wrong, so best practice is to start over IMO.

Drew Reece wrote:

I'll see if any developers can help clarify.

I asked for help in the 'water cooler' (a forum for level 6 users & above), 2 experienced users replied with mocking, no one else appeared.

You'll need to look elsewhere for help, clearly this site is full of users who are unwilling to explain or offer help on your topic. Good luck, D.

I recommend that you get a littlesnitch. littlesnitch will track your Web traffic and tell you which applications are sending data from your computer. Be sure to run it awhile because it will trigger a number of alerts. In trail mode, it will run for three hours per boot for a about a month.

http://www.obdev.at/products/littlesnitch/index.html

I've read it's not perfect, but what is.

R

ChaseDaniel wrote:

This is going over my head right now. Mr. Etresoft guy are you saying that the PacketLogger is a normal term for the PF that's on every Mac (which imho is sadly neglected and relegated to the Terminal)?

Hello ChaseDaniel,

No. The PacketLogger mentioned above has nothing to do with the PF (Packet Filter). It is only shown to begin with because the original poster enabled EtreCheck's "show everything" mode. One of the reasons behind the existence of that "show everything" mode is to try to discourage people from digging into log files and jumping to conclusions. Everything mentioned in this thread is 100% normal.

Can you tell us what we are supposed to see in that 200 lines of log output?

I have no idea if it normal or not but if you are convinced you have a modified OS you should redownload it, erase the Mac & reinstall. That is probably an over reaction but that is normally what happens when people read log files & assume the worst.

You need to compare your OS to a 'known good' one & tell us specifically what is different or wrong, you can't just poke & prod at it looking for clues. That is a rabbit hole.

ChaseDaniel wrote:

I know that a computer of mine was configured to send something to an IP address in Japan, found a Japanese migration assistant, and I'm afraid to say more.

You know that Japanese people use OS X/ macOS? There is a Japanese localisation of very piece of Apple UI, Apple sell Macs to almost every country on the planet!

The Japanese IP address is evidence of what exactly?

Fgf