SOLVED! Do I have malware?

[kimmer]

Problem solved (Original problem is below). In case anyone else bumps into something similar, here is what solved my problem:

Here's a quick recap of what I've done:

• Removed an old router that wasn't needed. Not sure why the person that set up my Apple AirPort Extreme left the old router in the chain, but it's now gone.
• Removed a wifi keyboard from the bluetooth menu for this iMac. (Thanks, tacit.)
• Turned off Amazon Music Helper running in the background. (Thanks, xABD.)
• Removed the Amazon Music app, plus any logs, etc that I could find. I'll buy all my digital music from Apple, but no longer from Amazon as I refuse to deal with their apps. It's not like I don't have enough to listen to - like a years worth at 10 hours a day, or so.
• Finally, I removed the Amazon Drive app, plus any log, etc that I could find. Amazon drive kept running in the background, and was annoying me with it's interruptions. I've told the family members that I was sharing photos with via the Amazon Drive that I'd no longer be doing so. They were fine with that.

In the long run, I believe that all of the problems were related to those Amazon apps.    Thanks for all the help!
=-=-=-=-=

Over the past 3 weeks I’ve had some odd little issues, and I’m stumped as to what is going on with my iMac. The concern over security has me considering erasing the HD and doing a fresh system install from Apple, and then bringing over my documents, pictures and such, and slowly reinstalling my apps. I’m leery of booting from my CCC backup in case I have malware or something.

I’m also going to research how to get in to the logs on my routers. Yes there are two and I don’t know how to go to just one - the apple airport; and yes I should know how to log into both the router and apple airport, but I don't. I had a reliable tech friend install the apple airport and he left the older router as well. It’s been a rough couple of years and I’m just really getting my feet on the ground with many things, so no lectures, please. If I can remove the older router, just tell me how and I'll work on this.

Two points worth noting:

• All of these incidents happened in the evening after my iMac had been sleeping for hours and I was in the other room using my iPad.
• All of this has happened since I got my smart TV that uses my wifi—which may or may not be contributing. TV is a Samsung UN65KS8000FXZA.

Here’s the 3 oddities:

1. The first time I heard a loud beeping and walked around the house until I discovered my iMac was stuck trying to raise the volume level. I could see the “image” that represents the speaker and volume, but I couldn’t stop the attempt to increase. I tried hitting the volume button on my keyboard and there wasn’t a response. My mouse was also uncontrollable. I couldn’t shut down the iMac with the button on the back, so finally I simply pulled the plug from the outlet. I left the iMac unplugged overnight and then restarted the next morning. All seemed fine.
2. The second time I walked into the computer room to plug in my iPad to recharge and discovered the iMac awake and a desktop file was highlighted and blinking. I was able to use the mouse and click on the finder desktop to stop the action. I launched console and saved the logs and shut the iMac down until morning.
3. The last time was last night. I came in before bed and discovered an alert window open (see below). If you look, you’ll see a file is highlighted. When I clicked cancel on the alert, a second window popped up and said I couldn’t rename the file to “/.” Again, I used console to grab the logs and then shut the iMac down until this morning.

[attachment=3310:alert109.jpg]


In glancing at the system logs from the last two incidents, the one thing I notice in both of them is:

QUOTE

XPC connection was invalidated

Otherwise the whole mish-mash is meaningless to me. I can copy/paste the logs if anyone understands this and wants to look at either of them.

Any and all suggestions would be appreciated.

[Xairbusdriver]

I'm betting you have a badly written app/extension/kext/etc. that you or some other app installed. Of course, you could be one of the first to experience a real OS X hack. My suspicions would be the WiFi connected TV. Who knows what it may have installed on your system? Possibly some 'deivers' and that's where the XPC comes in (see below).

QUOTE

I’m leery of booting from my CCC backup in case I have malware or something.

If you have malware, it is already installed and booting from CCC won't change that, assuming it backed up the malware. If it is not malware, which I seriously doubt, booting from CCC may improve things. Most likely, you'll simply take longer to boot into the OS from the backed up files and experience exactly the same symptoms.

As for Airport logs, you should see most of them in Console. "Diagnostic and Usage Messages" with "airport" typed into the 'search' box. I'm not sure the other router would write any messages with an easily identifiable label. They may just be limited to 'network' messages without any direct link to the router. Not sure any router saves error info in its own memory.

Here are a couple of links explaining what XPC is for, but I have never knowingly used it.

<Kernel and Device Drivers Layer>
<Creating XPC Services>
<A much less than helpful reply to a similar problem?>

QUOTE

If I can remove the older router, just tell me how and I'll work on this.

Are these things connected in series, that is, is one connected to the cable(?) modem and the second one plugged into the first one?

I'd not suggest pasting any log files. They usually don't have much human readable info, anyway. Wait until we come up with some specific words that you can search for.

In the meantime, look for any apps you don't remember installing or plists that don't identify a known app or use. Also anything that has a label/title similar to the TV or the non-Apple router. Might be great to ask that 'tech friend' to remove the router. BTW, what color is it?

[kimmer]

QUOTE(Xairbusdriver @ Oct 10 2016, 12:17 PM) <{POST_SNAPBACK}>

As for Airport logs, you should see most of them in Console. "Diagnostic and Usage Messages" with "airport" typed into the 'search' box.

I just tried that and nothing showed up. What I did see were a lot of computer crashes associated with Amazon Music Helper.

QUOTE

Here are a couple of links explaining what XPC is for, but I have never knowingly used it.

Well, I know less now then before.  Seriously, I have no clue what I just read.

QUOTE

QUOTE

If I can remove the older router, just tell me how and I'll work on this.

Are these things connected in series, that is, is one connected to the cable(?) modem and the second one plugged into the first one?

Yes, Apple Airport is plugged into the older router, and that's plugged into the Internet line. My routers are in the garage. I do know how to disconnect the older router from the household Internet, and I think I could then just plug that line directly into the Apple Airport. I could remove the panel cover and take pictures if need be.

QUOTE

In the meantime, look for any apps you don't remember installing or plists that don't identify a known app or use. Also anything that has a label/title similar to the TV or the non-Apple router. Might be great to ask that 'tech friend' to remove the router. BTW, what color is it?

I know every app in my app folder, although I don't use them all.  I'll start digging through the plists, and look for Samsung and router things. I've avoided asking the tech guy to come up here, but will if my back is pushed to the wall.

Router color? Old one is black, Apple Airport is white. Am I missing a joke here?

[Xairbusdriver]

QUOTE

Amazon Music Helper

Well, there's one culprit!

Here's another place to look in Console: Files->/var/Logs->com.apple.xpc.launchd If nothing there, you can probably rule out an XPC problem. OTOH, you did get at least one erer warning...

QUOTE

Apple Airport is plugged into the older router, and that's plugged into the Internet line.

Great! Is the "Black" 'router' actually the box from the cable or the telephone company? In other words, who provides your Internet connection?

[kimmer]

QUOTE(Xairbusdriver @ Oct 10 2016, 03:07 PM) <{POST_SNAPBACK}>

QUOTE

Amazon Music Helper

Well, there's one culprit!

Yup, and I searched for a bit and found out it's an issue with running in the background for PC's and Mac's. After reading 5 pages in the Amazon help forum, I found out how to disable having it run in the background. Hopefully that will help. I hate the Amazon Music app, but it is the only way to download music from them when you purchase MP3's.

QUOTE

Here's another place to look in Console: Files->/var/Logs->com.apple.xpc.launchd If nothing there, you can probably rule out an XPC problem. OTOH, you did get at least one erer warning...

Loads of stuff listed under Files->/var/Logs->com.apple.xpc.launchd/commerce dot log, and as far as I can tell it's all Apple related stuff.

QUOTE

QUOTE

Apple Airport is plugged into the older router, and that's plugged into the Internet line.

Great! Is the "Black" 'router' actually the box from the cable or the telephone company? In other words, who provides your Internet connection?

I'll explain about this when I get home later as I have a meeting to attend. I'll take pics to help explain.

[gunug]

I'm using Malwarebytes on my Macbook Pro as an experiment; but the only thing it ever called Malware was something that I purposely installed and didn't seem to be doing anything.
I clean the thing up pretty frequently with Onyx and clean out Firefox browser with the "Reset Browser" website so I've cleaned out whatever is making it slow today.

[Xairbusdriver]

I need to do some search on "MalwareBytes". I have serious concerns about a company that uses vast amounts of advertising. Words are so cheap these days (even if advertising isn't).

[gunug]

Malwarebytes is my go to program on PC's at work; it finds a lot that our paid for Antivirus/Antimalware package doesn't find.  The only draw back is
that you have to install it and then uninstall it because we're not buying licensing for every computer in the schools.  The Mac version doesn't seem to be
looking for enough when it runs (less Mac Malware) but it does update almost every time I run it!

[kimmer]

Okay, here's the current set up:

1. The entire house was pre-wired for several things, one of which is Ethernet connections in every room (except bathrooms).
2. At the junction box I found the modem (supplied by my ISP which is peak.org). It's hard to see in the one photo, but there is a beige wire that was installed by Peak when house was built, and that runs to the modem.
3. From the modem there was a line (Ethernet ?) running from the modem to the old router; then a connection from the old router to the Apple AirPort Extreme.
4. I took a good long look at all the connections and determined that the old router wasn't necessary, so I removed it and then ran the line from the modem directly into the Apple AirPort Extreme.
5. Even though I have wi-fi, I also ran the 2 Ethernet lines directly into the Apple AirPort Extreme so that 2 rooms have direct Ethernet connection if needed. (My old printer required it, and I've used it in the past for company). You can see these 3 connections in the second photo. The two upper lines (darker blue) are Ethernet lines and run to two rooms. The lower bright blue line is the one that runs from the modem to the Apple AirPort Extreme.

[attachment=3311:modem.jpg]
[attachment=3312:AirPort.jpg]


I don't remember why we needed this information, but here it is. I'm still seeing a lot of alerts in Console, but so far no more oddities so I'm wondering if all of those were from the Amazon Music Helper. This is what showed in console while I was typing this:

CODE

Tue, 10/11/16 2:28:54.618 PM garcon[8723]: Connecting to Dropbox on 'com.getdropbox.dropbox.garcon.cafe_502'
Tue, 10/11/16 2:28:54.620 PM garcon[8723]: Connected to Dropbox on 'com.getdropbox.dropbox.garcon.cafe_502'.
Tue, 10/11/16 2:28:54.620 PM garcon[8723]: Garcon is ready (1 alive).
Tue, 10/11/16 2:28:54.620 PM garcon[8723]: Invalidating watch set.
Tue, 10/11/16 2:28:54.628 PM garcon[8723]: Watch set is now: {(
    file:///Users/me/Dropbox/,
    file:///Users/me/Team%20Dropbox%20(new)
)}.
Tue, 10/11/16 2:28:54.793 PM pkd[390]: client 8734 plug-in com.getdropbox.dropbox.garcon election := 1
Tue, 10/11/16 2:28:58.116 PM garcon[8723]: Garcon destroyed (0 alive).
Tue, 10/11/16 2:28:58.127 PM garcon[8723]: host connection <NSXPCConnection: 0x7f8b61402160> connection from pid 3075 invalidated
Tue, 10/11/16 2:29:03.175 PM pkd[390]: client 8739 plug-in com.getdropbox.dropbox.garcon election := 1
Tue, 10/11/16 2:32:17.398 PM CalendarAgent[370]: [com.apple.calendar.store.log.caldav.coredav] [Refusing to parse response to PROPPATCH because of content-type: [text/html; charset=UTF-8].]
Tue, 10/11/16 2:32:17.444 PM CalendarAgent[370]: [com.apple.calendar.store.log.caldav.coredav] [Refusing to parse response to PROPPATCH because of content-type: [text/html; charset=UTF-8].]
Tue, 10/11/16 2:34:13.835 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:13.885 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:13.889 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:13.889 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:13.976 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:14.059 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:14.151 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:15.127 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:15.181 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:15.221 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:15.392 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:15.603 PM Spotlight[419]: XPC connection was invalidated
Tue, 10/11/16 2:34:16.384 PM Console[8757]: Failed to connect (_consoleX) outlet from (NSApplication) to (ConsoleX): missing setter or instance variable

Except for Dropbox, this is all related to Apple software. I'm still stumped, and still concerned that I need to do a clean reinstall. I also need to research how to look at the logs for the Apple AirPort Extreme, and how to change the password if I want to do so—although that's a HUGE pain as everything has to be logged back in.    Talk about wasting hours typing a few letters/symbols.

Anyhow, I'm still watching and if anyone has any ideas/suggestions/thinks I've solved this with the removal of the Amazon thing, let me know.

[Xairbusdriver]

Congrats on removing the old router, that's one less thing to go rong and it might even have been slower than the Apple one (not that you would probably have seen it). The modem might not be as fast as either router cold handle, anyway.

Is "Peak" a telecom or just a cable company? (I'm too lazy to search for that. )

I have no idea what "garcon.cafe_502" is. The 502 could be the owner ID, I'm listed as "501" and "502" is basically my lowercase name and "imac". Most of "my" owner numbers are in the 500-510 range. Wouldn't hurt to make sure you have the latest Dropbox software.

I don't think you will ever get a log inside of the Apple router. It is basically a bunch of chips. When something in it fails, the OS just writes to one of the many log files.

I agree, however, that the XPC messages are from Apple. But I don't think they have anything to do with the router or even your network. From what I can understand, this is simply a method Apple provides for developers to access things in the OS or send messages to the OS that should then notify the user. In other wurdz, I still think you have an app (kernel, launch daemon or extension) that needs updating/replacing.

[tacit]

QUOTE(kimmer @ Oct 10 2016, 07:25 PM) <{POST_SNAPBACK}>

Here’s the 3 oddities:

1. The first time I heard a loud beeping and walked around the house until I discovered my iMac was stuck trying to raise the volume level. I could see the “image” that represents the speaker and volume, but I couldn’t stop the attempt to increase. I tried hitting the volume button on my keyboard and there wasn’t a response. My mouse was also uncontrollable. I couldn’t shut down the iMac with the button on the back, so finally I simply pulled the plug from the outlet. I left the iMac unplugged overnight and then restarted the next morning. All seemed fine.
2. The second time I walked into the computer room to plug in my iPad to recharge and discovered the iMac awake and a desktop file was highlighted and blinking. I was able to use the mouse and click on the finder desktop to stop the action. I launched console and saved the logs and shut the iMac down until morning.
3. The last time was last night. I came in before bed and discovered an alert window open (see below). If you look, you’ll see a file is highlighted. When I clicked cancel on the alert, a second window popped up and said I couldn’t rename the file to “/.” Again, I used console to grab the logs and then shut the iMac down until this morning.

I have seen all of those things happen with a dying battery in a cordless keyboard.

The beeping was because the iMac "saw" the Volume Up key being pressed. Both the other two things can happen if the iMac "sees" the Return key being pressed.

[kimmer]

QUOTE(Xairbusdriver @ Oct 11 2016, 05:21 PM) <{POST_SNAPBACK}>

Is "Peak" a telecom or just a cable company? (I'm too lazy to search for that. )

Neither. It's simply a good old fashioned ISP.

QUOTE

PEAK Internet is a full-service Internet provider....
PEAK is a wholly owned subsidiary of three local utility cooperatives ... lists names of phone companies.

You must have a landline with one of the phone companies in order to use PEAK Internet. It's the only game in town unless I want to go with DirecTV (and then I'd have to switch to AT&T from Verizon). Remember, I live in a fairly rural area; still I have no complaints with this company, the speeds are decent and there's no caps.

There has to be a way to talk to the Apple AirPort Extreme as "the kid" did it when he set it up. I'm going to make an appt and talk with him to learn how to do this. I was trying to avoid that, for reasons I won't share, but it's the only way I'm going to solve the last of this – I think.

[kimmer]

QUOTE(tacit @ Oct 11 2016, 06:13 PM) <{POST_SNAPBACK}>

I have seen all of those things happen with a dying battery in a cordless keyboard.

The beeping was because the iMac "saw" the Volume Up key being pressed. Both the other two things can happen if the iMac "sees" the Return key being pressed.

This is interesting. I use a wired keyboard with my iMac, but there is an Apple bluetooth keyboard that I use with my mini iPad (tried it with this iMac, but prefer my full keyboard that requires being USB connected). The bluetooth keyboard is in the other room, and I keep it off unless I'm using it. I also thought it was out of range, but perhaps not. I’ve now removed it from the bluetooth gadget listing for this iMac.

Now I’m also wondering if this could be related to my Apple magic mouse. It’s the original one and it does have odd issues (reported all over the web), although I’ve never seen any of these oddities associated with it. Still, it’s something to research. Since the mouse itself keeps falling apart (the back refuses to stay on any more), I’ve been considering a new one, so maybe it’s time to make that purchase.

Interesting points, tacit.

[Xairbusdriver]

Have you tried tacit's KISS solution? Even easier than switching cables!

OK, so Peak is an ISP, and, apparently, the telephone company is providing the connection. I assume that is DSL, which can be as fast as some cable providers (assuming you are close it the 'switch', that is, <1.8 miles).

Airport Utility seems to be the only way to 'talk' to the box. Version 5.6 no longer runs in 10.11, I guess I can delete it now. The "new and improved" version is next to useless, IMHO. You now make all the settings in the Network Pref Panel. You do have a 'shortcut' access to that via the Airport Utility; click on the Airport image and then the 'greyed-out-but-active' Edit button.

[kimmer]

QUOTE(Xairbusdriver @ Oct 12 2016, 10:33 AM) <{POST_SNAPBACK}>

Have you tried tacit's KISS solution? Even easier than switching cables!

I replied to him.

QUOTE

OK, so Peak is an ISP, and, apparently, the telephone company is providing the connection. I assume that is DSL, which can be as fast as some cable providers (assuming you are close it the 'switch', that is, <1.8 miles).

Correct on all counts, and the "switch" is in the corner of my front yard.

QUOTE

Airport Utility seems to be the only way to 'talk' to the box. Version 5.6 no longer runs in 10.11, I guess I can delete it now. The "new and improved" version is next to useless, IMHO. You now make all the settings in the Network Pref Panel. You do have a 'shortcut' access to that via the Airport Utility; click on the Airport image and then the 'greyed-out-but-active' Edit button.

I have version 6.36, and it's a waste of HD space.  A fancy globe sits there and underneath it states "No configured AirPort base stations have been found" – but it promises to keep looking.  

I check my console logs daily and I’m not seeing anymore of the issues I originally saw. I've made several changes and if nothing odd happens again, I'll be happy. I won't know what exactly caused these oddities, but I'll still be happy.

Here's a quick recap of what I've done:

• Removed an old router that wasn't needed.
• Braved a couple of big spiders to take photos of the modem/router in the garage. UGH.
• Turned off Amazon Music Helper running in the background. (Thanks, xABD.)
• Removed a wifi keyboard from the bluetooth menu for this iMac. (Thanks, tacit.)

I'll keep watching and I'll update this thread in a few weeks if nothing else weird occurs. If something did happen, I'll holler asap. Thanks for all the help. I wouldn't have thought about checking some of these things on my own.