Apple Applications Opening In Sleep Mode

I did change my sleep setting to require a password immediately after going to sleep and I have had no problems since, so far. I interpret that as someone has access to my computer when in sleep mode but not when password is enabled. These things never occur while the computer is "active". I have no idea how this is possible and why the numerous apps are left open and not closed. It seems like random apps but maybe it's to cover up the open Terminal app. Bit Defender and Malwarebytes show no problems and I'm not an expert with Little Snitch or Console but nothing stands out for me. EtreCheck give a clean bill of health and excellent performance.This has been going on for well over a few months and I have not been able to figure out what is going on and there is little available about this problem using Google Search. One search result blamed the problem on a bad keyboard and trackpad randomly activating apps but that seems far fetched.

I don't allow power nap, don't use iCloud much as I'm a Google Guy and have an Android phone so none of the "enhanced" notifications are relevant for me except for Calendar, Contacts and Mail. My Chrome and Safari bowsers and Mac OS are not set up for remote management. I might also add, that many of the opened apps after sleep are ones that I rarely use. I do leave Chrome and Apple Mail open (dot underneath Dock Icon) but not in a window. At times these apps don't even show an open window while others I rarely use do. All network sharing is turned off as well. What works lately is to set preference to log out immediately when sleep is enabled.

Thanks for the suggestions and your listings provided a good check list to use. I think that I had them all "covered" except I did find a few items connected to iCloud Drive under options but deleted anything checked except for Mail. Calendar and Mail have their own iCloud settings checked below the iCloud Drive options. Not sure why there is a redundancy for Mail in the iCloud settings but I left it checked in the iCloud options as well. I have an @me email address as well as an @outlook.com and my @gmail.com, the last being the one I mainly use.

I might not have ended up as much of a Google Guy if the iPhone wasn't exclusive to AT&T way back when. As things are, iCloud is very secure but I rarely use it in any case.

I'll probably delete Bit Defender and only recently installed it along with Little Snitch to see if it would help diagnose my sleeping app activations. The problem preceded both. There was nothing wrong that I could see with EtreCheck other than I have some useless Samsung Phone entries, no doubt from long ago and not needed for my phone anymore. The EtreCheck log is below.

EtreCheck version: 3.4.6 (460)

Report generated 2017-11-07 14:36:14

Download EtreCheck from https://etrecheck.com

Runtime: 1:49

Performance: Excellent

Click the [Lookup] links for more information from Apple Support Communities.

Click the [Details] links for more information about that line.

Problem: No problem - just checking

Hardware Information:ⓘ

MacBook Pro (Retina, 15-inch, Late 2013)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Pro - model: MacBookPro11,3

1 2.3 GHz Intel Core i7 (i7-4850HQ) CPU: 4-core

16 GB RAM Not upgradeable

BANK 0/DIMM0

8 GB DDR3 1600 MHz ok

BANK 1/DIMM0

8 GB DDR3 1600 MHz ok

Handoff/Airdrop2: supported

Wireless:
en0: 802.11 a/b/g/n/ac

Battery: Health = Normal - Cycle count = 51

iCloud Quota: 4.99 GB available

Video Information:ⓘ

Intel Iris Pro - VRAM: 1536 MB

Color LCD 2880 x 1800

NVIDIA GeForce GT 750M - VRAM: 2 GB

Disk Information:ⓘ

APPLE SSD SM0512F disk0: (500.28 GB) (Solid State - TRIM: Yes)

[Show SMART report]

NO NAME (disk0s1 - MS-DOS FAT32) <not mounted> : 210 MB

(disk0s2) <not mounted>
[APFS Container]: 301.02 GB

BOOTCAMP (disk0s3 - NTFS) /Volumes/BOOTCAMP : 197.69 GB (155.71 GB free)

(disk0s4) <not mounted> : 483 MB

(disk0s5) <not mounted> : 868 MB

USB Information:ⓘ

USB30Bus

Western Digital My Passport 0748

My Passport 0748 disk2: (1 TB)

EFI (disk2s1 - MS-DOS FAT32) <not mounted>
[EFI]: 210 MB

Backup (disk2s2 - Journaled HFS+) /Volumes/Backup : 750.12 GB (128.76 GB free)

Misc (disk2s3 - Journaled HFS+) /Volumes/Misc : 249.57 GB (206.79 GB free)

Apple Inc. Apple Internal Keyboard / Trackpad

Apple Inc. BRCM20702 Hub

Apple Inc. Bluetooth USB Host Controller

Thunderbolt Information:ⓘ

Apple Inc. thunderbolt_bus

Virtual disks:ⓘ

Macintosh HD (disk1s1 - APFS) /
[Startup]: 301.02 GB (143.86 GB free)

Physical disk: disk0s2 301.02 GB (143.86 GB free)

(disk1s2) <not mounted>
[Preboot]: 301.02 GB

Physical disk: disk0s2 301.02 GB

(disk1s3) <not mounted>
[Recovery]: 301.02 GB

Physical disk: disk0s2 301.02 GB

(disk1s4) /private/var/vm
[VM]: 301.02 GB

Physical disk: disk0s2 301.02 GB

System Software:ⓘ

macOS High Sierra
10.13.1 (17B48) - Time since boot: less than an hour

Gatekeeper:ⓘ

Mac App Store and identified developers

Kernel Extensions:ⓘ

/Library/Extensions

[loaded] at.obdev.nke.LittleSnitch (4.0.3 - SDK 10.11) [Lookup]

[loaded] com.bitdefender.FileProtect (1.1 - SDK 10.11) [Lookup]

[loaded] com.bitdefender.SelfProtect (1.2.9 - SDK 10.8) [Lookup]

[loaded] com.bitdefender.TMProtection (5.0.0 - SDK 10.11) [Lookup]

[loaded] com.malwarebytes.mbam.rtprotection (3.1 - SDK 10.12) [Lookup]

/System/Library/Extensions

[not loaded] com.devguru.driver.SamsungComposite (1.4.32 - SDK 10.6) [Lookup]

[not loaded] com.dvdfab.kext.fabio (1.0) [Lookup]

/System/Library/Extensions/ssuddrv.kext/Contents/PlugIns

[not loaded] com.devguru.driver.SamsungACMControl (1.4.32 - SDK 10.6) [Lookup]

[not loaded] com.devguru.driver.SamsungACMData (1.4.32 - SDK 10.6) [Lookup]

[not loaded] com.devguru.driver.SamsungMTP (1.4.32 - SDK 10.5) [Lookup]

[not loaded] com.devguru.driver.SamsungSerial (1.4.32 - SDK 10.6) [Lookup]

System Launch Agents:ⓘ

[not loaded] 7 Apple tasks

[loaded] 184 Apple tasks

[running] 97 Apple tasks

System Launch Daemons:ⓘ

[not loaded] 37 Apple tasks

[loaded] 185 Apple tasks

[running] 108 Apple tasks

Launch Agents:ⓘ

[running] at.obdev.LittleSnitchHelper.plist (Objective Development Software GmbH - installed 2017-09-24) [Lookup]

[running] at.obdev.LittleSnitchUIAgent.plist (Objective Development Software GmbH - installed 2017-09-24) [Lookup]

[running] com.bitdefender.antivirusformac.plist (Bitdefender SRL - installed 2017-10-26) [Lookup]

[loaded] com.google.keystone.agent.plist (Google, Inc. - installed 2017-09-27) [Lookup]

[running] com.malwarebytes.mbam.frontend.agent.plist (Malwarebytes Corporation - installed 2017-11-05) [Lookup]

[loaded] com.privateinternetaccess.osx.PIA-VPN.plist (? 87063a21 53eb995e - installed 2017-09-23) [Lookup]

Launch Daemons:ⓘ

[running] at.obdev.littlesnitchd.plist (Objective Development Software GmbH - installed 2017-09-24) [Lookup]

[loaded] com.adobe.fpsaud.plist (? 2afb3af7 275a427a - installed 2017-10-20) [Lookup]

[not loaded] com.apple.installer.cleanupinstaller.plist (? 1963bf56 0 - installed 2017-09-26)

[running] com.bitdefender.AuthHelperTool.plist (Bitdefender SRL - installed 2017-09-20) [Lookup]

[running] com.bitdefender.agent.plist (Bitdefender SRL - installed 2017-10-26) [Lookup]

[loaded] com.bitdefender.upgrade.plist (Bitdefender SRL - installed 2017-09-20) [Lookup]

[loaded] com.google.keystone.daemon.plist (Google, Inc. - installed 2017-10-12) [Lookup]

[loaded] com.malwarebytes.HelperTool.plist (Malwarebytes Corporation - installed 2017-05-02) [Lookup]

[running] com.malwarebytes.mbam.rtprotection.daemon.plist (Malwarebytes Corporation - installed 2017-11-05) [Lookup]

[running] com.malwarebytes.mbam.settings.daemon.plist (Malwarebytes Corporation - installed 2017-11-05) [Lookup]

[loaded] com.twocanoes.WincloneHelper.plist (Twocanoes Software, Inc. - installed 2017-10-19) [Lookup]

User Launch Agents:ⓘ

[running] com.google.Chrome.framework.plist (Google Inc. - installed 2017-11-07) [Lookup]

User Login Items:ⓘ

Backup and Sync Application

(/Applications/Backup and Sync.app)

MusicManagerHelper Application

(~/Library/PreferencePanes/MusicManager.prefPane/Contents/Helpers/MusicManagerHe lper.app)

Internet Plug-ins:ⓘ

FlashPlayer-10.6: 27.0.0.183 (installed 2017-10-25) [Lookup]

QuickTime Plugin: 7.7.3 (installed 2017-09-20)

Flash Player: 27.0.0.183 (installed 2017-10-25) [Lookup]

PepperFlashPlayer: 27.0.0.183 (installed 2017-10-25) [Lookup]

Safari Extensions:ⓘ

[disabled] AdBlock - Michael Gundlach - https://getadblock.com (installed 2015-09-11)

[enabled] Wipr - Giorgio Calderolla - http://giorgiocalderolla.com/ (installed 2017-06-06)

3rd Party Preference Panes:ⓘ

Flash Player (installed 2017-10-20) [Lookup]

MusicManager (installed 2015-11-17) [Lookup]

Time Machine:ⓘ

Skip System Files: NO

Mobile backups: ON

Auto backup: YES

Volumes being backed up:

Macintosh HD: Disk size: 301.02 GB Disk used: 157.17 GB

Destinations:

Backup [Local]

Total size: 750.12 GB

Total number of backups: 170

Oldest backup: 11/21/13, 6:32 PM

Last backup: 11/7/17, 2:14 PM

Size of backup disk: Adequate

Backup size 750.12 GB > (Disk used 157.17 GB X 3)

Top Processes by CPU:ⓘ

6%
WindowServer

2%
kernel_task

1%
Backup and Sync

1%
ps

1%
opendirectoryd

Top Processes by Memory:ⓘ

1.33 GB
kernel_task

379 MB BDLDaemon

269 MB mds_stores

226 MB Backup and Sync

174 MB Backup and Sync

Top Processes by Network Use:ⓘ

Input Output Process name

20 KB 7 KB bdagentd

20 KB 7 KB BDCoreIssues

9 KB 4 KB cloudd

7 KB 6 KB apsd

7 KB 6 KB mDNSResponder

Top Processes by Energy Use:ⓘ

8.70 WindowServer

1.32 Backup and Sync

1.08 opendirectoryd

1.06 launchd

Virtual Memory Information:ⓘ

10.88 GB
Available RAM

7.47 GB
Free RAM

5.12 GB
Used RAM

3.40 GB
Cached files

0 B Swap Used

Software installs (last 30 days):ⓘ

Adobe Pepper Flash Player:
(installed 2017-10-12)

Adobe Flash Player:
(installed 2017-10-12)

App Cleaner & Uninstaller: 4.5 (installed 2017-10-14)

Adobe Flash Player:
(installed 2017-10-16)

Adobe Pepper Flash Player:
(installed 2017-10-16)

Winclone:
(installed 2017-10-19)

Adobe Flash Player:
(installed 2017-10-25)

Adobe Pepper Flash Player:
(installed 2017-10-25)

Bitdefender:
(installed 2017-10-26)

Bitdefender Antivirus for Mac:
(installed 2017-10-26)

Malwarebytes for Mac:
(installed 2017-11-05)

Install information may not be complete.

Thanks very much for the shell script. I will have to disable my logout "immediately" in sleep mode and revert back to leaving myself logged in as that's the only time the strange app loading phenomena happens. The "/Applications/Backup and Sync.app" relates to my Google Drive and Google Photos. I'm basically a Google Guy when it comes to cloud drives and free photo storage. I tried looking at some logs in the Console but there are so many lines even after a few minutes that it should be huge. Could I reduce the time factor in the script as lately the app phenomena starts fairly quickly? I would imagine that 2 or 4 hours would work in the script as well and still provide the needed info. I could run one script with login turned off and another with login turned on and if the apps start running I could compare the two.

Thank you and all for the suggestions. I will keep the "log" link as it may show other useful "tricks" in the future. I and one other person are the only sources on Google for this problem that I have found. I also find Bit Defender just excess baggage and I just use Malwarebytes sometimes to scan a file or easily correct hijacking in Windows if I or someone else does something stupid. BTW, all sharing is off and my Mac Mini that is hooked to my TV and audiophile system is off much of the time but has sharing enabled as a "one way street" MacBook Pro. I am going to look at the Samsung entries in EtreCheck and get rid of them as I never link my Samsung phone directly to my Mac but only via Google.

Thanks for the reply. I am concerned as well and have found out that if I am logged out when sleeping the apps do not load, only when I am logged in during sleep. I have never found the need to "automate" anything. My home is residential so I'm not too worried about Wi Fi security but use WPA2. I have been using Apple's two factor security for my Apple ID for longer than I have had this problem. The same goes for Google as well which I rely on quite a bit. I rarely travel with my MacBook Pro but have used a VPN for public Wi Fi for quite some time. I would like to shut down my Wi Fi before I put the Mac to sleep with password enabled and see if that stops the apps from loading. Glad I don't have a smart home yet although it will be a problem for my phone but not so much over night.

I guess there's always the "nuclear option" of a clean install and reloading all my apps and data. Not looking forward to that scenario. I could change my password before doing that but I also use Last Pass and Google's Chrome browser password storage. I used Keychain for a while but never connected it to iCloud. I probably should get rid of Google's password storage and just rely on Last Pass. Why double your risk.

Lastly, I live alone and no one can lift the lid on my Mac and play with it.

Forgot to mention that my Bootcamp partition seems to be completely "walled off" after High Sierra. Apple's Bootcamp utility in Windows 10 can't even redirect to the Mac anymore and I must reboot using the option key every time. In any case it isn't a virtual setup and Mac OS can't run at the same time as Win 10. I rarely use Win 10 anymore except for a Navigation upgrade program, XBOX stuff, etc. I don't even use MS Office.