HELP! Terminal keeps randomly opening with a file that doesn't exist

Discussion in 'macOS' started by adamwhalley92, Jul 26, 2016.

  1. adamwhalley92 macrumors newbie

    Joined:
    Jul 26, 2016
    #1
    Hi Guys,

    Just need a little bit of help - Terminal keeps opening every 5 mins or so with this file and this message. The file in question doesn't exist. What I do to stop this happening.

    I've attached the screenshot. Hope someone can help.

    Cheers

    Adam
     

    Attached Files:

  2. chabig, Jul 26, 2016
    Last edited: Jul 26, 2016

    chabig macrumors 68040

    Joined:
    Sep 6, 2002
    #2
    Can you delete the file GP6 from your Dowloads folder?
     
  3. adamwhalley92 thread starter macrumors newbie

    Joined:
    Jul 26, 2016
    #3
    It;s not there. I tried to install that maybe 4 or 5 years ago on an old machine, but it doesn't exist any longer!
     
  4. DeltaMac macrumors 604

    DeltaMac

    Joined:
    Jul 30, 2003
    Location:
    Delaware
    #4
    So, has your terminal has been launching every 5 minutes for 4 or 5 years?

    If it is always that same window, then it's not what I would call random.
    Your Console may offer some explanation why your terminal continues to open.
    The system.log would list actions by time and date.
    Note what time the terminal launches, and look for a corresponding action listed in your system.log.
     
  5. adamwhalley92 thread starter macrumors newbie

    Joined:
    Jul 26, 2016
    #5
    It has definitely only just started doing this. Obviously it isnt random but I'd be very intrigued to see why it's happening! I'll check up on that now and post! Cheers
     
  6. DeltaMac macrumors 604

    DeltaMac

    Joined:
    Jul 30, 2003
    Location:
    Delaware
    #6
    Have you just recently upgraded your software?
    What version of OS X (or macOS :D ) is installed?
     
  7. adamwhalley92 thread starter macrumors newbie

    Joined:
    Jul 26, 2016
    #7
    I'm on 10.11.15 I've been on El Capitan since it came out pretty much. it hasn't done it for the last few hours so i haven't been able to check on my system log - but it seemed to be hell bent on doing it all morning
     
  8. Weaselboy Moderator

    Weaselboy

    Staff Member

    Joined:
    Jan 23, 2005
    Location:
    California
    #8
    It looks like you installed a pirated version of Guitar Pro 6 and there is a bash Terminal script trying to run chmod to make the keygen_osx file executable. The script that is doing this is not in the ~/Downloads folder, but it is trying to run chmod against a files in that folder that is no longer there.

    When is does this again, go to Terminal and hit the up arrow one time. This should show the last run command/script. For example in this shot you can see the last script run was a hidden script called ./script.sh.

    Once you find the name of the bash script doing this we can find it and delete it.

    script_4-650-80.png
     
  9. adamwhalley92 thread starter macrumors newbie

    Joined:
    Jul 26, 2016
    #9
    Thanks for the help - So when I hit Up, the attachment below is what it said. I've also attached the system log file. It happened between 13:45.00 and 13:45.16
    --- Post Merged, Jul 27, 2016 ---
    Here's the system log. just happened at around 13:45.00
    --- Post Merged, Jul 27, 2016 ---
    I think it is something to do with at 13:45.09 where it mentions ttys001. That is what is written on terminal when the thing first appears

    Jul 27 13:45:09 Adams-MacBook-Pro login[3091]: USER_PROCESS: 3091 ttys001
    Jul 27 13:45:10 Adams-MacBook-Pro com.apple.AddressBook.InternetAccountsBridge[3114]: dnssd_clientstub ConnectToServer: connect()-> No of tries: 1
     

    Attached Files:

  10. Weaselboy Moderator

    Weaselboy

    Staff Member

    Joined:
    Jan 23, 2005
    Location:
    California
    #10
    Try this... run the command below in Terminal to show the Terminal history in TextEdit and see if anything looks like that chmod command.

    Code:
    open ~/.bash_history -a /Applications/TextEdit.app
    Also, try running the app EtreCheck. That will create an anonymized report showing all hidden startup and launch items. You can post the report here so we can take a look.

    ttys001 is the keyboard, so something is telling the keyboard to do something there.
     
  11. adamwhalley92 thread starter macrumors newbie

    Joined:
    Jul 26, 2016
    #11
    Thanks for the help. In the text edit it shows up that exact command,

    chmod +x
    chmod +x
    /Users/Adam/Downloads/GP6/keygen_osx
    chmod +X/Users/Adam/Downloads/GP6/keygen_osx
    .../keygen_osx
    run .../keygen_osx/Users/Adam/Downloads/GP6/keygen_osx
    /Users/Adam/Downloads/GP6/keygen_osx
    chmod +x/Users/Adam/Downloads/GP6/keygen_osx
    /Users/Adam/Downloads/GP6/keygen_osx ; exit;
    chmod +x/Users/Adam/Downloads/GP6/keygen_osx ; exit;
    /Volumes/NO\ NAME/New\ folder/hosts ; exit;

    So what do i do now? Do I simply delete that and the problem goes away?

    I'm really shocked as to why this has just started happening, as I really haven't had that file for years!
     
  12. Weaselboy Moderator

    Weaselboy

    Staff Member

    Joined:
    Jan 23, 2005
    Location:
    California
    #12
    Okay... that shows the commands, but not what is running them. Somewhere there is a bash (Terminal) .sh file running this and we need to find it.

    Try the Etrecheck report so we can look for something launching this script.

    Do you have Guitar Pro installed and is this happening when you run it?
     
  13. adamwhalley92 thread starter macrumors newbie

    Joined:
    Jul 26, 2016
    #13
    Etrecheck didn't turn anything up (other than a few seemingly unrelated bits of adware that were found that I deleted) - and I don't have guitar pro installed. I never installed it at all. I found a free piece of software called TuxGuitar which did the job better and for free, and deleted the file at least 4 years ago now, which is why i'm perplexed that it's still appearing.

    On a side note, in my terminal preferences the bash command was automatically set as the window title! and the default shells were opening with /bin/bash. May this have anything to do with it? It still doesn't tell me why it was happening automatically!
     
  14. Weaselboy Moderator

    Weaselboy

    Staff Member

    Joined:
    Jan 23, 2005
    Location:
    California
    #14
    I'd really like to see that report, as I think that may hold a clue.

    Normally timed scripts like this are run by the launchd process from one of these launch item folders.

    Code:
    ~/Library/LaunchAgents (~ is your users folder)
    /Library/LaunchAgents
    /Library/LaunchDaemons
    /Library/StartupItems
    /System/Library/Extensions/
    Try running this command in Terminal so show everything launchd is running. It will be a long list, but look for anything not from Apple.

    Code:
    sudo launchctl list
     
  15. adamwhalley92, Jul 27, 2016
    Last edited by a moderator: Jul 27, 2016

    adamwhalley92 thread starter macrumors newbie

    Joined:
    Jul 26, 2016
    #15
    Cheers for all your help!! i really appreciate it.

    So this is the launch list... I can't see anything particularly untoward. The peer guardian ones are worrying, but as far as I'm aware, that's quite safe software?

    Attached is the EtreCheck doc too....


    Code:
    PID    Status    Label
    
    -    0    com.apple.storedownloadd.daemon
    
    153    0    com.apple.coreservicesd
    
    -    0    com.gobbler.bsd.HelperTool
    
    -    0    com.apple.avbdeviced
    
    -    0    com.apple.FontWorker
    
    269    0    com.apple.cvmsServ
    
    -    0    com.apple.applessdstatistics
    
    -    0    com.apple.DesktopServicesHelper.BA41020D-A93D-4707-8E1C-B76BACEFD322
    
    -    0    com.apple.storagekitd
    
    -    0    com.apple.hdiejectd
    
    243    0    com.apple.corestorage.corestoraged
    
    -    0    com.apple.wifid
    
    -    0    com.apple.storereceiptinstaller
    
    190    0    com.apple.networkd_privileged
    
    -    0    com.macpaw.CleanMyMac3.Agent
    
    75    0    com.apple.iconservices.iconservicesagent
    
    -    0    com.apple.emond
    
    45    0    com.apple.syslogd
    
    -    0    com.apple.logkextloadsd
    
    -    0    com.apple.bluetoothReporter
    
    236    0    com.apple.WindowServer
    
    -    0    com.apple.NetworkSharing
    
    -    0    com.apple.afpfs_checkafp
    
    -    0    com.avast.uninstall
    
    -    0    com.apple.AppleFileServer
    
    -    0    com.apple.var-db-dslocal-backup
    
    91    0    com.apple.securityd
    
    -    0    com.apple.nesessionmanager
    
    -    0    com.apple.auditd
    
    250    0    com.apple.symptomsd
    
    18711    0    com.apple.ocspd
    
    99    0    com.apple.autofsd
    
    -    0    com.avid.bsd.shoetoolv120
    
    44    0    com.apple.UserEventAgent-System
    
    -    0    com.apple.Kerberos.kadmind
    
    -    0    com.apple.preferences.timezone.auto
    
    181    0    com.apple.coresymbolicationd
    
    676    0    com.apple.suhelperd
    
    -    0    com.apple.RFBEventHelper
    
    -    0    com.paceap.pacesupport
    
    -    0    com.apple.racoon
    
    -    0    com.apple.IASUtilities.IASCloudConfigHelper
    
    -    0    com.apple.metadata.mds.scan
    
    115    0    com.apple.AirPlayXPCHelper
    
    51    0    com.apple.ODSAgent
    
    -    0    com.apple.RemoteDesktop.PrivilegeProxy
    
    -    0    com.apple.mtmd
    
    -    0    com.apple.mbusertrampoline
    
    -    0    com.apple.system_installd
    
    -    0    com.apple.sysdiagnose
    
    441    0    com.apple.installd
    
    -    0    org.postfix.master
    
    -    0    com.apple.dvdplayback.setregion
    
    241    0    com.apple.nehelper
    
    -    1    com.apple.logd
    
    -    0    com.apple.iBooksX-SecureUserDefaults
    
    319    0    com.apple.tccd.system
    
    -    0    com.apple.appleseed.fbahelperd
    
    -    0    com.apple.IFCStart
    
    -    0    com.apple.softwareupdate_download_service
    
    -    0    com.apple.mdmclient.daemon
    
    164    0    com.apple.ctkd
    
    234    0    com.avast.daemon
    
    240    0    com.apple.nsurlsessiond_privileged
    
    211    0    com.apple.awdd
    
    -    0    com.apple.mDNSResponderHelper.reloaded
    
    -    0    com.apple.screensharing
    
    -    0    com.apple.periodic-monthly
    
    -    0    com.apple.findmymacmessenger
    
    166    0    com.apple.secinitd
    
    440    0    com.apple.TMCacheDelete
    
    -    0    com.apple.scsid
    
    -    0    com.apple.kuncd
    
    -    0    com.apple.corecaptured
    
    -    0    com.oracle.java.JavaUpdateHelper
    
    -    0    com.gobbler.DownstreamProxy
    
    -    0    com.apple.IOAccelMemoryInfoCollector
    
    -    0    com.apple.msrpc.lsarpc
    
    111    0    com.apple.KernelEventAgent
    
    132    0    com.apple.aslmanager
    
    -    0    com.apple.taskgated-helper
    
    2873    0    com.apple.cmio.registerassistantservice
    
    -    0    com.apple.RemotePairTool
    
    114    0    com.apple.hidd
    
    47    0    com.apple.kextd
    
    50    0    com.memeo.Memeod
    
    -    71    xxx.qnation.PeerGuardian.kextload
    
    54    0    com.usbApogeeDaemon.plist
    
    -    0    com.apple.systemstats.analysis
    
    145    0    com.apple.diagnosticd
    
    56    0    com.apple.coreservices.appleevents
    
    59    0    com.apple.powerd
    
    150    0    com.apple.authd
    
    -    0    com.apple.DumpPanic
    
    65    0    com.mice.360Daemon
    
    -    0    com.apple.vsdbutil
    
    -    0    com.apple.nfsd
    
    208    0    com.apple.audio.coreaudiod
    
    -    0    com.apple.akd
    
    67    0    com.apple.airportd
    
    486    -43    com.apple.watchdogd
    
    -    0    com.apple.pfd
    
    -    0    com.avast.update
    
    -    0    com.apple.NetworkDiagnostics
    
    76    0    com.apple.iconservices.iconservicesd
    
    -    0    com.apple.systemkeychain
    
    -    0    com.apple.nlcd
    
    -    0    com.apple.SCHelper
    
    -    0    com.apple.periodic-weekly
    
    14730    0    com.apple.netbiosd
    
    -    0    org.cups.cupsd
    
    -    0    com.apple.statd.notify
    
    -    0    com.apple.rootless.init
    
    -    0    com.apple.preferences.timezone.admintool
    
    468    0    com.apple.nsurlstoraged
    
    4629    0    com.apple.noticeboard.state
    
    239    0    com.apple.metadata.mds.index
    
    238    0    com.apple.lsd
    
    90    0    com.apple.usbmuxd
    
    -    0    com.apple.IOBluetoothUSBDFU
    
    592    0    com.apple.CrashReporterSupportHelper
    
    554    0    com.avast.proxy
    
    -    0    com.apple.security.authhost.00000000-0000-0000-0000-0000000186A7
    
    96    0    com.symphonyDaemon.plist
    
    -    0    com.apple.DumpGPURestart
    
    97    0    com.apple.displaypolicyd
    
    98    0    com.apple.blued
    
    -    0    org.postfix.newaliases
    
    297    0    com.apple.securityd_service
    
    4574    0    com.apple.periodic-daily
    
    251    0    com.apple.alf
    
    -    0    com.apple.DesktopServicesHelper.011EF96B-A9A2-42A3-9D0C-083DBC280736
    
    110    0    com.apple.logind
    
    -    0    com.apple.dspluginhelperd
    
    -    0    com.apple.msrpc.netlogon
    
    -    0    com.apple.CoreRAID
    
    -    0    com.apple.DesktopServicesHelper.243E56FB-9357-4DBE-AFD2-36441FF79538
    
    -    0    com.apple.TrustEvaluationAgent.system
    
    -    0    com.apple.newsyslog
    
    439    0    com.apple.cache_delete
    
    141    0    com.apple.taskgated
    
    -    0    com.apple.MRTd
    
    -    0    com.apple.GSSCred
    
    314    0    com.apple.audio.systemsoundserverd
    
    -    0    com.microsoft.office.licensing.helper
    
    57    0    com.apple.configd
    
    -    0    com.rogueamoeba.instanton-agent
    
    288    0    com.apple.AccountPolicyHelper
    
    -    0    com.apple.fontmover
    
    -    0    com.apple.UserNotificationCenter
    
    -    0    com.google.keystone.daemon
    
    188    0    com.apple.icloud.findmydeviced
    
    -    0    com.apple.speech.speechsynthesisd
    
    -    0    com.apple.rpcbind
    
    187    0    com.apple.networkd
    
    79    0    com.apple.coreduetd
    
    -    0    com.apple.airplaydiagnostics.server.mac
    
    80    0    com.apple.wdhelper
    
    -    0    com.apple.ucupdate.plist
    
    -    0    com.apple.ManagedClient.enroll
    
    -    0    com.apple.DesktopServicesHelper
    
    -    0    com.apple.DesktopServicesHelper.7C4506F3-C7DF-47A0-9AF7-AEBC3B9C964C
    
    93    0    com.apple.locationd
    
    -    0    com.oracle.java.Helper-Tool
    
    -    0    com.apple.Kerberos.kcm
    
    336    0    com.apple.coreservices.sharedfilelistd
    
    525    0    com.avast.service
    
    109    0    com.apple.loginwindow
    
    -    0    com.apple.efilogin-helper
    
    -    0    com.apple.cmio.iOSScreenCaptureAssistant
    
    116    0    com.apple.notifyd
    
    601    0    com.avast.fileshield
    
    -    0    com.avid.bsd.DigiShoeTool
    
    -    0    com.apple.ReportPanicService
    
    -    0    com.avast.account
    
    -    0    com.apple.aelwriter
    
    -    0    com.apple.Kerberos.digest-service
    
    48    0    com.apple.fseventsd
    
    -    0    com.apple.automountd
    
    -    0    com.vix.cron
    
    245    0    com.apple.thermald
    
    415    0    com.apple.FileCoordination
    
    -    0    com.apple.eapolcfg_auth
    
    -    0    com.apple.coreservices.appleid.passwordcheck
    
    -    0    com.apple.AssetCacheLocatorService
    
    675    0    com.apple.softwareupdated
    
    -    0    com.apple.InstallerDiagnostics.installerdiagd
    
    3620    0    com.apple.systemadministration.writeconfig
    
    1043    0    com.apple.SubmitDiagInfo
    
    -    0    com.apple.emond.aslmanager
    
    -    0    com.apple.mbsystemadministration
    
    -    0    com.apple.hidfud
    
    -    0    com.jdi.vpn.VPNHelper
    
    -    0    com.apple.msrpc.mdssvc
    
    -    0    com.apple.dpd
    
    14837    0    com.apple.cmio.AppleCameraAssistant
    
    -    0    com.apple.corestorage.corestoragehelperd
    
    -    0    com.apple.trustd
    
    -    0    com.apple.ReportCrash.Root
    
    -    0    com.apple.systempreferences.install
    
    -    0    com.apple.cmio.IIDCVideoAssistant
    
    4572    0    com.apple.security.syspolicy
    
    244    0    com.apple.usbd
    
    106    0    com.apple.mDNSResponder.reloaded
    
    120    0    com.apple.distnoted.xpc.daemon
    
    -    0    com.apple.bsd.dirhelper
    
    108    0    com.apple.revisiond
    
    -    0    com.apple.smb.preferences
    
    -    0    com.apple.findmymacd
    
    148    0    com.apple.cfprefsd.xpc.daemon
    
    -    0    com.apple.cloudfamilyrestrictionsd
    
    -    0    com.apple.Localization.SetDefaultsService
    
    -    0    com.apple.unmountassistant.sysagent
    
    -    0    com.adobe.SwitchBoard
    
    -    0    com.apple.uninstalld
    
    3622    0    com.apple.xpc.smd
    
    -    0    com.apple.gkreport
    
    -    0    com.apple.updateEFIDesktopPicture
    
    -    0    com.apple.colorsyncd
    
    -    0    com.apple.backupd
    
    -    0    com.apple.airport.wps
    
    1040    0    com.apple.systemstatsd
    
    -    0    com.apple.nfsconf
    
    -    0    com.apple.netauth.sys.auth
    
    155    0    com.apple.MobileFileIntegrity
    
    -    0    com.ea.origin.ESHelper
    
    -    0    com.apple.configureLocalKDC
    
    991    0    com.apple.spindump
    
    70    0    com.apple.metadata.mds
    
    -    0    com.apple.lockd
    
    -    0    com.apple.wwand
    
    -    0    com.apple.printtool.daemon
    
    -    0    com.apple.fontd
    
    247    0    com.apple.cmio.VDCAssistant
    
    -    0    com.apple.security.agent.login
    
    -    0    com.apple.security.authhost
    
    -    0    com.apple.pfctl
    
    -    0    com.apple.CommCenterRootHelper
    
    -    0    com.apple.gssd
    
    930    0    com.apple.PerformanceAnalysis.animationperfd
    
    -    0    com.raynersw.netshade-ctl-2
    
    83    0    com.apple.wirelessproxd
    
    -    0    com.apple.security.agent.login.00000000-0000-0000-0000-0000000186A7
    
    -    -43    com.adobe.fpsaud
    
    -    0    com.apple.loginwindow.LFVTracer
    
    87    0    com.apple.coreservices.launchservicesd
    
    -    0    com.apple.afpfs_afpLoad
    
    -    0    com.apple.platform.ptmd
    
    -    0    com.apple.dynamic_pager
    
    95    0    com.xrite.device.xrdd.plist
    
    -    0    com.apple.csrutil.report
    
    -    0    com.apple.iokit.ioserviceauthorized
    
    242    0    org.ntp.ntpd
    
    103    0    com.apple.Kerberos.kdc
    
    -    0    com.apple.softwareupdatecheck.initial
    
    -    0    com.apple.msrpc.srvsvc
    
    -    0    com.apple.bnepd
    
    -    0    com.apple.familycontrols
    
    -    0    com.apple.dpaudiothru
    
    -    0    com.apple.diagnostic.uuidpathd
    
    -    0    com.apple.nis.ypbind
    
    -    0    com.apple.kcproxy
    
    -    0    com.macpaw.CleanMyMac2.Agent
    
    258    0    com.apple.AmbientDisplayAgent
    
    -    0    com.apple.storeagent.daemon
    
    -    0    com.apple.installandsetup.systemmigrationd
    
    58    0    com.line6.l6ksettingmgr
    
    -    0    com.apple.metadata.mds.spindump
    
    -    0    com.apple.Kerberos.kpasswdd
    
    61    0    com.waves.daemon.SoundGridProtocolService
    
    -    0    com.apple.msrpc.wkssvc
    
    -    0    com.apple.awacsd
    
    -    0    xxx.qnation.PeerGuardian.locum
    
    69    0    com.apple.warmd
    
    -    0    tc.tctechnologies.daemon.Saffire
    
    -    0    com.teamviewer.Helper
    
    -    0    com.apple.xpc.uscwoap
    
    316    0    com.apple.WirelessRadioManagerd-osx
    
    -    0    com.apple.powerd.swd
    
    -    0    com.apple.ManagedClient
    
    77    0    com.apple.diskarbitrationd
    
    -    0    com.id-design.whatsizehelper
    
    -    0    com.apple.systemstats.daily
    
    -    0    com.apple.netauth.sys.gui
    
    -    0    com.apple.startupdiskhelper
    
    82    0    com.apple.opendirectoryd
    
    246    0    com.apple.ifdreader
    
    -    0    com.apple.bluetoothaudiod
    
    709    0    com.apple.storeinstalld
    
    85    0    com.apple.apsd
    
    86    0    com.SymphonyIOUSBDaemon.plist
    
    88    0    com.paceap.eden.licensed
    
    -    0    com.anchorfree.ajaxserver
    
    -    0    com.avast.init
    
    -    0    com.apple.ManagedClient.cloudconfigurationd
    
    -    0    com.apple.PCIELaneConfigTool
    
    -    0    com.apple.GameController.gamecontrollerd
    
    -    0    com.apple.sessionlogoutd
    
    -    0    com.apple.storeaccountd.daemon
    
    -    0    com.apple.cmio.AVCAssistant
    
    209    0    com.apple.diskmanagementd
    
    219    0    com.apple.CodeSigningHelper
    
    1224    0    com.apple.sysmond
    
    -    0    com.apple.storeassetd.daemon
    
    147    0    com.apple.sandboxd
    [/code[
    Adams-MacBook-Pro:~ Adam$
     

    Attached Files:

  16. Weaselboy Moderator

    Weaselboy

    Staff Member

    Joined:
    Jan 23, 2005
    Location:
    California
    #16
    You have a LOT of third party items running there, but I don't see anything that would run this script.

    There is a deprecated system for automating scripts like this called "cron"... and it is still present in El Capitan, and I'm wondering if that is what is going on. To see if there are any cron jobs running, run the command below.

    Code:
    crontab -l
    On El Capitan it should say no crontab for username. If there is a crontab, this may be where the script is launching.
     
  17. chrfr macrumors 603

    Joined:
    Jul 11, 2009
    #17
    Did you look at the "General" part of Terminal preferences, and if so, what's there?
     
  18. adamwhalley92 thread starter macrumors newbie

    Joined:
    Jul 26, 2016
    #18
    That's what came up with the crontab ...
    --- Post Merged, Jul 28, 2016 ---
    Here's the general part...
     

    Attached Files:

  19. DeltaMac macrumors 604

    DeltaMac

    Joined:
    Jul 30, 2003
    Location:
    Delaware
    #19
    You used an un-recognized option with the crontab command, a number one (1), when the crontab option would be a lower-case el (l), so
    Code:
    crontab -l
     
  20. Weaselboy Moderator

    Weaselboy

    Staff Member

    Joined:
    Jan 23, 2005
    Location:
    California
    #20
    Exactly... good catch!

    Adam... if you can it is easier to just copy paste these commands so you don't get sideways. :)
     
  21. adamwhalley92 thread starter macrumors newbie

    Joined:
    Jul 26, 2016
    #21
    sadly still nothing has worked - which is worrying me a lot. would a time machine backup and restart from loading the OS work?
     
  22. Weaselboy Moderator

    Weaselboy

    Staff Member

    Joined:
    Jan 23, 2005
    Location:
    California
    #22
    What comes up when you run the command "crontab -l"?
     
  23. adamwhalley92 thread starter macrumors newbie

    Joined:
    Jul 26, 2016
  24. Weaselboy Moderator

    Weaselboy

    Staff Member

    Joined:
    Jan 23, 2005
    Location:
    California
    #24
    This is really baffling then. cron and launchd are the ways one would launch a script like this.

    Just as a test, go into Users & Groups and make a new, test admin account and login from there and see if it happens in that account. At least that will tell us if it is something limited to the one account.

    A Time Machine restore would copy the issue right back.

    You could do a clean OS install then manually just move your data back and manually reinstall everything, but that will be a real hassle.

    I was hoping somebody else would jump in here with an idea where to look for this script.
     
  25. adamwhalley92 thread starter macrumors newbie

    Joined:
    Jul 26, 2016
    #25
    Thanks for all your help.

    The only thing i can remember changing before it started happening was that I changed the permissions and tried to get rid of guest user accounts. That's just sprung to mind, but i have no idea why that would have any effect
     

Share This Page