725 iPhone_iPad_Mac_apple

Evidence of fruitfly malware? Unknown process i...

This is the installer log from my computer running in Recovery Mode. The suggestion reinstall the OS is not helpful, as I've done that countless times. Please don't recommend an etrecheck either. As I mentioned previously the program attempts to connect with a known malware host as confirmed by Google. Kindly prove, beyond a reasonable doubt, that what I've provided above is not evidence of malware. If

"unknown" is part of the standard operation, well then that's it for me.

And, yes, I know how to read a log. It's not that hard...really... Consult the developer documentation if you struggle with this. One should probably have something authoritative as a reference anyway...

Some items that seem problematic:

1. opendirectory is the first thinig to do anything. I don't use any active directory or ssh into anything, ever.

2. opendiretoryd is a mach service?

3. It resets stats, cache, and registers an endpoint?

4. Then registers 2 nodes as hidden?

5. hidd cares that a user is active? uh duh I just started recovery mode, there's a user active...

6. unknown notes when the kernel booted..

7. then opendirectoryd makes apsd root

8. tries to create a null uuid for a node, fails

9. starts up language chooser

10. computer is like uh you can't do that 10x

11. the rest is just ridiculous..

Once again in Recovery Mode...set nvram boot-args to -x (safe mode) and have a firmware password so I guess this is in force in recovery which is extra concerninig that all this nonsense happens in safe mode on my recovery partition.

Aug 21 14:02:43 localhost opendirectoryd[157]: opendirectoryd (build 417.41.1) launched - installer mode

Aug 21 14:02:43 localhost opendirectoryd[157]: Logging level limit changed to 'notice'

Aug 21 14:02:43 localhost opendirectoryd[157]: Safe Boot is enabled

Aug 21 14:02:43 localhost opendirectoryd[157]: Initialize trigger support

Aug 21 14:02:43 localhost opendirectoryd[157]: created endpoint for mach service 'com.apple.private.opendirectoryd.rpc'

Aug 21 14:02:43 localhost opendirectoryd[157]: set default handler for RPC 'reset_cache'

Aug 21 14:02:43 localhost opendirectoryd[157]: set default handler for RPC 'reset_statistics'

Aug 21 14:02:43 localhost opendirectoryd[157]: set default handler for RPC 'show'

Aug 21 14:02:43 localhost opendirectoryd[157]: starting endpoint for service 'com.apple.private.opendirectoryd.rpc'

Aug 21 14:02:44 localhost opendirectoryd[157]: no dynamic data found at '/System/Library/OpenDirectory/DynamicData/Configure.plist'

Aug 21 14:02:44 localhost opendirectoryd[157]: Registered node with name '/Configure' as hidden

Aug 21 14:02:44 localhost opendirectoryd[157]: no dynamic data found at '/System/Library/OpenDirectory/DynamicData/Local.plist'

Aug 21 14:02:44 localhost opendirectoryd[157]: Registered node with name '/Local' as hidden

Aug 21 14:02:45 localhost powerd[144]: powerd process is started

Aug 21 14:02:48 localhost powerd[144]: Assertion Created. Type:UserIsActive Name:'com.apple.iohideventsystem.queue.tickle.4294968244.11' Id:0x900008000 Process:hidd [System: DeclUser kDisp]

Aug 21 14:02:48 localhost Unknown[453]: kern.boottime: { sec = 1503349355, usec = 0 } Mon Aug 21 14:02:35 2017

Aug 21 14:02:49 MacBook-Pro opendirectoryd[157]: 158.1 - Client: apsd, UID: 0, EUID: 0, GID: 0, EGID: 0

Aug 21 14:02:49 MacBook-Pro opendirectoryd[157]: 158.1 - ODNodeCreateWithNameAndOptions request, SessionID: 00000000-0000-0000-0000-000000000000, Name: /Search, Options: 0x0

Aug 21 14:02:49 MacBook-Pro opendirectoryd[157]: 158.1 - ODNodeCreateWithNameAndOptions failed with error 'Unknown node name' (2000)

Aug 21 14:02:50 MacBook-Pro Unknown[465]: Launching the Language Chooser for an OS Install

Aug 21 14:02:50 MacBook-Pro launchprogresswindow[463]: ISAP: show progress UI called.

Aug 21 14:03:05 MacBook-Pro opendirectoryd[157]: 158 - Client: 'apsd', exited with 0 session(s), 0 node(s) and 0 active request(s)

Aug 21 14:03:20 MacBook-Pro Installer Progress[151]: IASGetCurrentInstallPhaseList: no install phase array set

Aug 21 14:03:20 MacBook-Pro Installer Progress[151]: IASGetCurrentInstallPhase: no install phase set

Aug 21 14:03:20 MacBook-Pro Installer Progress[151]: Progress App loading...

Aug 21 14:03:20 MacBook-Pro Installer Progress[151]: Progress App is running with no progress set.

Aug 21 14:03:20 MacBook-Pro Installer Progress[151]: Progress App running...

Aug 21 14:03:20 MacBook-Pro Installer Progress[151]: Sending show progress UI to delegate.

Aug 21 14:03:20 MacBook-Pro Installer Progress[151]: IOProgressColorTheme is set to 1

Aug 21 14:03:20 MacBook-Pro Unknown[467]: Aug 21 14:03:20 Language Chooser[466] <Error>: CGColorSpaceCreateWithName failed for kCGColorSpaceITUR_709

Aug 21 14:03:20 MacBook-Pro Unknown[467]: Aug 21 14:03:20 Language Chooser[466] <Error>: CGColorSpaceCreateWithName failed for kCGColorSpaceITUR_2020

Aug 21 14:03:20 MacBook-Pro Unknown[467]: Aug 21 14:03:20 Language Chooser[466] <Error>: CGColorSpaceCreateWithName failed for kCGColorSpaceROMMRGB

Aug 21 14:03:20 MacBook-Pro Installer Progress[151]: Shield windows created.

Aug 21 14:03:20 MacBook-Pro Installer Progress[151]: Shield windows ordered front.

Aug 21 14:03:21 MacBook-Pro Unknown[467]: Setting boot completed.

Aug 21 14:03:21 MacBook-Pro Language Chooser[466]: Could not read prev-lang:kbd to set keyboard.

Aug 21 14:03:21 MacBook-Pro Installer Progress[151]: Started phase named: Language Chooser

Aug 21 14:03:21 MacBook-Pro Language Chooser[466]: No primary language hint found

Aug 21 14:03:22 MacBook-Pro Language Chooser[466]: ISAP: hide progress UI called.

Aug 21 14:03:22 MacBook-Pro Installer Progress[151]: Sending hide progress UI to delegate.

Aug 21 14:03:22 MacBook-Pro Installer Progress[151]: End progress UI called...

Aug 21 14:03:22 MacBook-Pro Unknown[467]: 2017-08-21 14:03:22.898 Language Chooser[466:6894] NSColorList could not parse color list file /System/Library/Colors/System.clr

Aug 21 14:03:24 MacBook-Pro Language Chooser[466]: Launching the Springboard using language code "en"

Aug 21 14:03:25 MacBook-Pro Unknown[467]: 2017-08-21 14:03:25.456 macOS Utilities[488:18417] NSColorList could not parse color list file /System/Library/Colors/System.clr

Aug 21 14:03:25 MacBook-Pro OSIESpringboard[488]: Registering the connection

Aug 21 14:03:25 MacBook-Pro OSIESpringboard[488]: client 0x7fb6efc5d770: phaseName = Install Springboard

Aug 21 14:03:25 MacBook-Pro OSIESpringboard[488]: client 0x7fb6efc5d770: phaseName = "Install Springboard"

Aug 21 14:03:25 MacBook-Pro OSIESpringboard[488]: ISAP: hide progress UI called.

Aug 21 14:03:25 MacBook-Pro OSIESpringboard[488]: client 0x7fb6efc5d770: phaseName = Install Springboard

Aug 21 14:03:25 MacBook-Pro Installer Progress[151]: Sending hide progress UI to delegate.

Aug 21 14:03:25 MacBook-Pro OSIESpringboard[488]: Can not connect to /var/run/systemkeychaincheck.socket: No such file or directory

Aug 21 14:03:25 MacBook-Pro OSIESpringboard[488]: Failed to unlock login keychain.

Aug 21 14:03:25 MacBook-Pro Language Chooser[466]: Not hiding Language Chooser in window counter

Aug 21 14:03:25 MacBook-Pro Unknown[467]: Aug 21 14:03:25 macOS Utilities[488] <Error>: CGColorSpaceCreateWithName failed for kCGColorSpaceITUR_709

Aug 21 14:03:25 MacBook-Pro Unknown[467]: Aug 21 14:03:25 macOS Utilities[488] <Error>: CGColorSpaceCreateWithName failed for kCGColorSpaceITUR_2020

Aug 21 14:03:25 MacBook-Pro Unknown[467]: Aug 21 14:03:25 macOS Utilities[488] <Error>: CGColorSpaceCreateWithName failed for kCGColorSpaceROMMRGB

Aug 21 14:03:26 MacBook-Pro Unknown[467]: objc[488]: Class TIMLog is implemented in both /System/Library/CoreServices/Menu Extras/TextInput.menu/Contents/SharedFrameworks/TextInputUI.framework/Versions/ A/TextInputUI (0x1241566e8) and /System/Library/CoreServices/Menu Extras/TextInput.menu/Contents/SharedSupport/TIMCore.bundle/Contents/MacOS/TIMC ore (0x124134b10). One of the two will be used. Which one is undefined.

Aug 21 14:03:44 MacBook-Pro Unknown[467]: 2017-08-21 14:03:44.817 Safari[492:19162] NSNotificationCenter connection invalid

Aug 21 14:03:44 MacBook-Pro Unknown[467]: 2017-08-21 14:03:44.825 Safari[492:19163] NSSoftLinking - The ShareKit framework's library couldn't be loaded from (null).

Aug 21 14:03:44 MacBook-Pro Unknown[467]: 2017-08-21 14:03:44.826 Safari[492:19163] NSSoftLinking - The ShareKit framework's library couldn't be loaded from (null).

Aug 21 14:03:45 MacBook-Pro Unknown[467]: 2017-08-21 14:03:45.927 Safari[492:18789] NSColorList could not parse color list file /System/Library/Colors/System.clr

Aug 21 14:03:46 MacBook-Pro Unknown[467]: 2017-08-21 14:03:46.028 Safari[492:19274] NSUbiquitousKeyValueStore is unavailable.

Aug 21 14:03:46 MacBook-Pro Unknown[467]: 2017-08-21 14:03:46.051 Safari[492:18789] NSToolbarItem (<BrowserToolbarItem: 0x7f86c4e33b70>) had to adjust the size of <FlatAccessibilityHierarchySegmentedControl: 0x7f86c4df4c10> from {53, 24} to the expected size of {55, 25}. Make sure that this toolbar item view has a valid frame/min/max size. This is an app bug, please do not file a bug against AppKit or NSToolbar! Break on _NSToolbarAdjustedBorderedControlSizeBreakpoint

Aug 21 14:03:46 MacBook-Pro Unknown[467]: 2017-08-21 14:03:46.052 Safari[492:18789] NSToolbarItem (<BrowserToolbarItem: 0x7f86c4e34ea0>) had to adjust the size of <ButtonPlus: 0x7f86ca011370> from {37, 25} to the expected size of {39, 27}. Make sure that this toolbar item view has a valid frame/min/max size. This is an app bug, please do not file a bug against AppKit or NSToolbar! Break on _NSToolbarAdjustedBorderedControlSizeBreakpoint

Aug 21 14:03:46 MacBook-Pro Unknown[467]: 2017-08-21 14:03:46.054 Safari[492:18789] NSToolbarItem (<BrowserToolbarItem: 0x7f86c4c5d5a0>) had to adjust the size of <ButtonPlus: 0x7f86ca01b670> from {37, 25} to the expected size of {39, 27}. Make sure that this toolbar item view has a valid frame/min/max size. This is an app bug, please do not file a bug against AppKit or NSToolbar! Break on _NSToolbarAdjustedBorderedControlSizeBreakpoint

Aug 21 14:03:46 MacBook-Pro Unknown[467]: 2017-08-21 14:03:46.055 Safari[492:18789] NSToolbarItem (<BrowserToolbarItem: 0x7f86c4c5da30>) had to adjust the size of <VisualTabPickerToolbarButton: 0x7f86ca022900> from {37, 25} to the expected size of {39, 27}. Make sure that this toolbar item view has a valid frame/min/max size. This is an app bug, please do not file a bug against AppKit or NSToolbar! Break on _NSToolbarAdjustedBorderedControlSizeBreakpoint

Aug 21 14:03:46 MacBook-Pro Unknown[467]: 2017-08-21 14:03 Safari[492] (FSEvents.framework) FSEventStreamStart: ERROR: FSEvents_connect() => Unknown service name (1102)

Aug 21 14:03:46 MacBook-Pro Unknown[467]: Aug 21 14:03:46 Safari[492] <Error>: CGColorSpaceCreateWithName failed for kCGColorSpaceITUR_709

Aug 21 14:03:46 MacBook-Pro Unknown[467]: Aug 21 14:03:46 Safari[492] <Error>: CGColorSpaceCreateWithName failed for kCGColorSpaceITUR_2020

Aug 21 14:03:46 MacBook-Pro Unknown[467]: Aug 21 14:03:46 Safari[492] <Error>: CGColorSpaceCreateWithName failed for kCGColorSpaceROMMRGB

Aug 21 14:03:47 MacBook-Pro OSIESpringboard[488]: WARNING: SecPolicyGetOID failed to return an OID. This function was deprecated in 10.7. Please use SecPolicyCopyProperties instead.

Aug 21 14:03:47 MacBook-Pro Unknown[467]: 1.2.840.113635.100.1.61

Aug 21 14:03:48 MacBook-Pro storeassetd[498]: Commerce:--------------------------------------------------------- Begin --

System Version 10.12.3 (Build 16D30)

"storeassetd" Version ? (?)

-------------------------------------------------------------------

Aug 21 14:03:48 MacBook-Pro storeassetd[498]: Commerce:SoftwareMap: Running in recovery mode (1) - Disabling all software map sources

Aug 21 14:03:48 MacBook-Pro Unknown[467]: 2017-08-21 14:03:48.877 Safari[492:19506] NSSoftLinking - The ShareKit framework's library couldn't be loaded from (null).

Aug 21 14:03:49 MacBook-Pro storeaccountd[499]: Commerce:--------------------------------------------------------- Begin --

System Version 10.12.3 (Build 16D30)

"storeaccountd" Version ? (?)

-------------------------------------------------------------------

Aug 21 14:03:49 MacBook-Pro storeaccountd[499]: Commerce:BagLoadOperation: Attempting to load bag (type=1) from https://init.itunes.apple.com/bag.xml?ix=5

Aug 21 14:03:49 MacBook-Pro storeaccountd[499]: Commerce:AccountStore: failed to create primaryAccount appleIDString:(null) dsidValue:(null) storefrontString:(null)

Aug 21 14:03:49 MacBook-Pro storeaccountd[499]: Commerce:ISStoreURLOperation: Starting URL operation with url=https://init.itunes.apple.com/bag.xml?ix=5 / bagKey=(null)

Aug 21 14:03:49 MacBook-Pro storeaccountd[499]: Commerce:-[ISStoreURLOperation _runURLOperation]: _addStandardQueryParametersForURL: https://init.itunes.apple.com/bag.xml?ix=5

Aug 21 14:03:49 MacBook-Pro storeassetd[498]: Commerce:DAAPClient: Will not perform DAAP request for action login because no primary account is present

Aug 21 14:03:49 MacBook-Pro storeassetd[498]: Commerce:BookLibraryJaliscoSource: Primary account changed, waiting for semaphore before deleting library cache

Aug 21 14:03:49 MacBook-Pro storeassetd[498]: Commerce:BookLibraryJaliscoSource: Primary account changed, deleting cache and loading books

Aug 21 14:03:49 MacBook-Pro storeassetd[498]: Commerce:BookLibraryJaliscoSource: DAAP Event Login success=0 error=Error Domain=DAAPClient Code=0 "No primary account is present" UserInfo={NSLocalizedDescription=No primary account is present}

Aug 21 14:03:49 MacBook-Pro storeassetd[498]: Commerce:DAAPClient: DAAP Login failed with error Error Domain=DAAPClient Code=0 "No primary account is present" UserInfo={NSLocalizedDescription=No primary account is present}

Aug 21 14:03:49 MacBook-Pro storeassetd[498]: Commerce:BookLibraryJaliscoSource: Failed to write to file:///var/root/Library/Caches/com.apple.commerce/PurchasedMedia - Error Domain=NSCocoaErrorDomain Code=4 "The folder “PurchasedMedia” doesn’t exist." UserInfo={NSURL=file:///var/root/Library/Caches/com.apple.commerce/PurchasedMed ia, NSUserStringVariant=Folder, NSUnderlyingError=0x7fe2b1009bf0 {Error Domain=NSPOSIXErrorDomain Code=2 "No such file or directory"}}

Aug 21 14:03:49 MacBook-Pro storeassetd[498]: Commerce:BookLibrary: Library rebuild took 0.0251 seconds for 0 local, 0 purchased records