Apple Applications Opening In Sleep Mode

Question

Level 1

43 points

Apple Applications Opening In Sleep Mode

I have a MacBook Pro (late 2013) running Sierra. I have noticed that after I leave it in sleep mode overnight sometimes when I lift the lid the next day some apps are running that I had not opened or used. Some examples would be Pages, Finder, Calendar, and Safari. I leave Mail and Chrome active on the dock but have never seen those apps open on screen the next day. Yesterday there were about seven apps running. I looked through a few log files but wasn't sure where to look or what to look for. I am wondering if my Mac is compromised. It has been going on for a while now but is not consistent in any way as it doesn't happen all the time nor are the apps the same. I restart my Mac from time to time as I am running Bootcamp as well with Windows 10.

I also notice that when I reboot or shutdown, sometimes I have to wait a while for my external USB drive with Time Machine to quit flashing before it will restart or shut off. Time Machine is not backing up or doing anything that I know of at those times.

MacBook Pro (Retina, 15-inch, Late 2013), OS X El Capitan (10.11.5), 500GB SSD

Posted on Sep 12, 2017 6:08 PM

Reply

Answer 1

georosejr Author

Level 1

43 points

Nov 8, 2017 8:53 AM in response to John Galt

If someone is up to mischief it is hard to understand why they wouldn't close the apps instead of leaving all the apps open. Other than Terminal which also shows no actual use unless it was quit and restarted, it is hard to understand what the point or goal of this phenomena is. It is disturbing that Finder and Terminal are usually open. I got rid of Bit Defender but still do scans with Malwarebytes and find nothing wrong. Mawarebytes doesn't run in the background so it is benign as far as taking up any resources.

Another clarification, the apps are running only when I stay logged in and put the Mac to sleep. If I log out of the Mac manually before sleep mode or automatically the minute I go into sleep mode by closing the lid with no apps running it remains that way upon wake up.

I use the MacBook Pro on a regular basis and have never seen this happen while I'm at the screen. BTW, sometimes Photo Booth is opened while in sleep mode as well - crazy!

Reply

Answer 2

georosejr Author

Level 1

43 points

Nov 5, 2017 1:46 PM in response to georosejr

Anyone have a suggestion on who to contact for a diagnosis of this weird behavior?

Reply

Answer 3

georosejr Author

Level 1

43 points

Nov 6, 2017 10:29 AM in response to Eric Root

Wake on network isn't checked. Any other "remote access setting" I could have missed?

Reply

Answer 4

Eric Root

Level 10

685,257 points

Nov 6, 2017 10:37 AM in response to georosejr

None that I can think of.

Reply

Answer 5

John Galt

Level 10

155,810 points

Nov 7, 2017 3:14 PM in response to georosejr

You can determine the wake event reasons using the following shell script:

clear; printf '\e[3J' && log show --style syslog --last 24h | egrep -i 'wake\ reas' | egrep -v securityd | awk -F']' '{print substr($0,1,19), $NF}'

Rule 1 of Macs is don't install junk. Get rid of "Bitdefender".

User Login Items: ⓘ

Backup and Sync Application

(/Applications/Backup and Sync.app)

Perhaps that's the reason. I don't know what it is.

Reply

Answer 6

John Galt

Level 10

155,810 points

Nov 7, 2017 7:09 PM in response to georosejr

If previously closed apps are found to be open and running when you wake your Mac, then someone or some thing is opening them. That would concern me. Other than something like an AppleScript or Workflow you intentionally developed, I know of no program that would do that. Of course I don't use any Google products or non-Apple "antivirus" junk but even the worst examples of them shouldn't cause those events to occur.

My suspicions would turn to the possibility of someone else in possession of your login or Apple ID credentials. Might that be a possibility? Even then, remote login should be impossible as long as Sharing services are disabled. Is your wireless network secure? Including its physical security, are you quite certain that it is inaccessible from unauthorized trespassers? What about that Mac's Windows partition? How certain are you that it is secure?

EtreCheck is just a starting point. Nothing cannot provide absolute assurance that something nefarious is not installed on a Mac.

Reply