1062      iPhone_iPad_Mac_apple

strange entries in keychain, under an account c...

I noticed the following entries in the keychain of my MacBook Air

com.apple.NetworkServiceProxy.Configuration

com.apple.NetworkServiceProxy.WaldoInfo.com.apple.parsed

com.apple.NetworkServiceProxy.WaldoInfo.com.apple.nspcurl

com.apple.NetworkServiceProxy.WaldoInfo.com.apple.pie2.hosts

all under an account called: “waldo”

But there isn’t an account called Waldo on the machine.

and the machine was recently reformatted and MacOS reinstalled. (no other apps were installed, and I didn't connect an iCloud account either..)

I took the Mac to the Genius Bar at my closest Apple Store

The person I spoke was very helpful, but he didn’t recognise the entries either and so suggested rebooting the machine from their network, formatting and then reinstalling MacOS again.

After doing that we assumed that those entries would have been removed

so I turned Wifi Off (while in the store), and went home

However when I got home I checked the machine’s again, and noticed these entries were still there in the keychain…

I took the machine to the Apple Store again the next day but couldn’t get an appointment at the Genius Bar

Hence why I’m posting the message here..

Does anyone know what these entries are…?

And how could they still be on the machine, after it’s had MacOS reinstalled.

Background Info:

A couple weeks before I noticed these entries, I had already restarted the machine into recovery partition, formatted the hard drive and re-installed MacOS from my home Wifi..

Since then the Wifi has been switched off..

However I did connect to the internet once via Bluetooth on my iPhone 6 plus, but it was only for a few minutes, in order to download a printer Driver

apart from that time the machine wasn’t connected to the internet.

Hence I think the entries may have 'jumped' over from my iphone…

(I’ve had many other issues recently.. e.g. my playstation, and Uber accounts were hacked… and even one of my iCloud accounts..)

Hope someone can help!

Thanks in advance

S.

All my Sierra Macs have that Keychain entry.

There is no "jumping" from anything, unless you include that to mean information shared among devices using the Apple ID they share, which encompasses an enormous amount of information.

After speaking to the nice gentleman at the Genius Bar, I bought a brand new MacBook Pro

I've been using it for more than a week now, and it doesn't have those entries...

Did he say what the entries where?

Hi Fedinvs

He said he'd never seen that before and agreed it looked strange especially the account name..

He also said it could be something do to with some apple servers called Waldo.apple.com

But he didn't know what they were for, nor certain if the two things were related..

Hence he suggested rebooting off their network and doing a clean reinstall.. as that should completely remove it..

And confident of that we didn't check if it had come back.. so we just packed it up..

It wasn't untill I got home that I realised the entries were still there ..

Hi

So i have the EXACT same issue... it looks like my iphone and macbook air has been hacked?

Did you resole/find out what it was?

Also, could you tell me what a clean system reinstall is? Thanks in advance!

I'm having the same issue, and there seems to be little detailed information to be found via a Google search. Adding further to the strangeness, I tried putting waldoinfo.com into browser address field and it keeps auto redirecting to various sites. This has the look and feel of something nefarious. Here's my info also:

com.apple.NetworkServiceProxy.WaldoInfo.com.apple.nspcurl

com.apple.NetworkServiceProxy.WaldoInfo.com.apple.parsecd

com.apple.NetworkServiceProxy.WaldoInfo.pie2.hosts

最後更新：2017-08-18 09:23:44

  上一篇： MacBook Air Ransomware

  下一篇： My phone got locked n showing disabled