Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

screen capture sound occuring every 30 seconds can't turn it off

S

salexsaaa

macrumors newbie
Original poster
Dec 14, 2010
1
0
Hi all I need help! Last week in the middle of my work day nothing special, the system started playing the camera shutter / screen capture. I started timing between the shutter, every 30 seconds, very annoying - the camera shutter sound - same as the shift-4 screen capture sound and same as the sound that occurs when you press the back button in terminal. I have a 15 inch mac book pro. 2009 model.

I wondered whether someone had installed a hidden shell script or apple script program and is capturing my screen and maybe sending it over the net. I don't know where to look or how to turn this off.

I have checked activity monitor and did not notice any programs running like "screencapture" or anything else like that. I have also turned hidden files visable on, but i can't find any screen capture directory or files: .jpg, .pdf, .png files I should be seeing lots of them for every 30 seconds per capture. Back to terminal here is my dump from ps ax command:

Code: 
PID TT STAT TIME COMMAND
1 ?? Ss 0:07.47 /sbin/launchd
10 ?? Ss 0:01.75 /usr/libexec/kextd
11 ?? Ss 0:01.15 /usr/sbin/DirectoryService
12 ?? Ss 0:01.16 /usr/sbin/notifyd
13 ?? Ss 0:00.19 /usr/sbin/syslogd
14 ?? Ss 0:00.15 /usr/sbin/diskarbitrationd
15 ?? Ss 0:02.08 /usr/libexec/configd
16 ?? Ss 0:01.65 /usr/sbin/distnoted
19 ?? Ss 0:00.54 /usr/sbin/mDNSResponder -launchd
26 ?? Ss 0:00.19 /usr/sbin/securityd -i
31 ?? Ss 0:00.41 /usr/sbin/ntpd -c /private/etc/ntp-restrict.conf -n 
32 ?? Ss 0:00.06 /usr/sbin/cron
34 ?? Ss 0:00.07 /System/Library/PrivateFrameworks/MobileDevice.frame
35 ?? Ss 0:00.04 /sbin/SystemStarter
39 ?? Ss 0:11.81 /System/Library/Frameworks/CoreServices.framework/Fr
40 ?? Ss 2:11.63 /System/Library/CoreServices/loginwindow.app/Content
41 ?? Ss 0:00.06 /usr/sbin/KernelEventAgent
43 ?? Ss 0:34.52 /usr/libexec/hidd
44 ?? Ss 0:01.19 /System/Library/Frameworks/CoreServices.framework/Ve
46 ?? Ss 0:00.00 /sbin/dynamic_pager -F /private/var/vm/swapfile
51 ?? Ss 0:00.16 /usr/sbin/blued
52 ?? Ss 0:00.03 autofsd
55 ?? Ss 0:00.10 BBDaemon
61 ?? Ss 0:01.88 /System/Library/CoreServices/coreservicesd
62 ?? Ss 1:37.87 /System/Library/Frameworks/ApplicationServices.frame
63 ?? Ss 0:01.65 /usr/libexec/ApplicationFirewall/socketfilterfw
67 ?? S 0:00.05 /Library/StartupItems/HWPortDetect_driver/HWPortCfg_
146 ?? Ss 0:00.01 /System/Library/Frameworks/OpenGL.framework/Versions
160 ?? Ss 0:06.90 /usr/sbin/coreaudiod
170 ?? Ss 0:10.15 /System/Library/PrivateFrameworks/DiskImages.framewo
174 ?? Ss 0:00.58 /System/Library/PrivateFrameworks/DiskImages.framewo
180 ?? Ss 0:00.71 /sbin/launchd
184 ?? S 0:02.16 /System/Library/CoreServices/Dock.app/Contents/MacOS
185 ?? S 0:06.26 /System/Library/CoreServices/SystemUIServer.app/Cont
188 ?? S 0:02.26 /System/Library/Frameworks/ApplicationServices.frame
191 ?? S 0:00.00 /usr/sbin/pboard
199 ?? S 0:00.04 /System/Library/Frameworks/InputMethodKit.framework/
201 ?? S 0:04.23 /System/Library/Input Methods/Kotoeri.app/Contents/M
206 ?? S 0:00.28 /usr/libexec/UserEventAgent -l Aqua
212 ?? S 0:00.04 /System/Library/CoreServices/AirPort Base Station Ag
213 ?? S 0:24.59 BBLaunchAgent
215 ?? S 0:00.15 /System/Library/CoreServices/Folder Actions Dispatch
218 ?? S 0:00.28 /System/Library/CoreServices/Menu Extras/TextInput.m
223 ?? S 0:00.23 /Library/PreferencePanes/Growl.prefPane/Contents/Res
225 ?? S 0:22.03 /Users/salexsaa/Library/Application Support/RealNetw
227 ?? S 0:00.03 /Users/salexsaa/Library/Application Support/RealNetw
463 ?? S 0:41.93 /System/Library/CoreServices/Finder.app/Contents/Mac
632 ?? S 2:48.51 /Applications/Google Chrome.app/Contents/MacOS/Googl
638 ?? S 0:03.06 /Applications/Google Chrome.app/Contents/Versions/8.
639 ?? S 0:22.09 /Applications/Google Chrome.app/Contents/Versions/8.
642 ?? S 0:01.15 /Applications/Utilities/Terminal.app/Contents/MacOS/
679 ?? S 3:27.94 /Applications/Google Chrome.app/Contents/Versions/8.
692 ?? S 1:15.15 /Applications/Google Chrome.app/Contents/Versions/8.
701 ?? S 0:01.71 /Applications/Preview.app/Contents/MacOS/Preview -ps
815 ?? S 0:04.11 /Applications/Microsoft Office 2011/Office/Open XML 
1278 ?? S 0:00.39 /System/Library/Services/AppleSpell.service/Contents
1287 ?? S 0:18.59 /Applications/Google Chrome.app/Contents/Versions/8.
1297 ?? S 0:22.32 /Applications/Microsoft Office 2011/Microsoft Excel.
1303 ?? S 0:00.05 /Library/Application Support/Microsoft/MAU2.0/Micros
1323 ?? S 0:13.76 /Applications/Skype.app/Contents/MacOS/Skype -psn_0_
1360 ?? S 0:08.29 /Applications/Google Chrome.app/Contents/Versions/8.
1375 ?? S 0:22.34 /Applications/Google Chrome.app/Contents/Versions/8.
1452 ?? S 0:02.12 /Applications/Google Chrome.app/Contents/Versions/8.
1497 ?? SNs 0:00.18 /System/Library/Frameworks/CoreServices.framework/Fr
1512 ?? Ss 0:00.01 /System/Library/CoreServices/backupd
644 s000 Ss 0:00.03 login -pf salexsaa
647 s000 S 0:00.01 -bash
1525 s000 R+ 0:00.00 ps ax

Please any suggestions??? as you can imagine im pulling my hair out. Please any ideas before i have to reinstall everything again i just finished a re-install. My last system had the Isight camera turning and flashing randomly now this...am i a victim of mac hacking???

I have also installed little snitch, nothing strange seems to be going out by way of connections. Only dropbox, i have deleted that but the noise still keeps going. I will have to reinstall again....any ideas pls.

Help!!! Pls.
 
Last edited by a moderator:
Sounds like logic board problem

When I last had issues like this it was with my Core2 early 2006 iMac and I was told it was down to a faulty logic board. By then I had already had 4 major repairs on it (power supply, video processor, hard drive and SMC controller), Apple folded and gave me a new Core2Duo 2007 iMac. I hope you bought Applecare. Even though it is expensive, it is worth it. I have had the keyboard and optical drive replaced in my mid 2009 13" MBP already this year, which would have cost far more than the Applecare cost.

Wilson
 
If somebody installed a script to capture your screen every 30 seconds, it would not show up in ps. It would be installed as a cron job.

Check your cron.
 
LPZ said:
Would that make the OP's process 32 a zombie? :rolleyes:
Click to expand...

Clarification.. cron is deprecated. There's likely no more /etc/crontab or /usr/lib/cron/tabs/ in use on the user's system. There is however it's replacement.. launchd and it's babes LaunchAgents and LauchDaemons.

:eek: :rolleyes:
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back