Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

iMac waking up..console says its hijacked!

mattcooper

mattcooper

macrumors member
Original poster
Jul 31, 2008
39
5
Bargara
Hey...

My iMac has been waking up allot during the night for the past few months... Someone when I come to it I find it not sleeping at all. I was told a few weeks ago when I catch it go to the system log.. I did that today and am now really worried its some sort of Mac Virus or something.. I could be wrong its just the name freaks me out.


26/06/10 2:07:44 AM com.apple.launchd.peruser.501[88] (com.apple.AddressBook.abd) The following job tried to hijack the service "com.apple.AddressBook.abd" from this job: [0x0-0xd9fd9f].com.apple.AddressBook.abd


Edit:
Looks like its every HOUR!
Screenshot2010-06-26at83519AM.png
 
Hellhammer said:
Forget about repairing permissions with the Disk Utility - it's mostly placebo - search for real reason of issue
Click to expand...

Fixed it for you ;)
And seriously - this should be only done when it's needed, not everytime when any problem occured. If you got problem with permissions (this is easy to see in log) - repair them, but do not recommend it to everybody for everything - it's misleading.

OP, post that part of your log between:
System Sleep and System Wake and about 10 lines after System Wake.
BTW, you posted your problem on Apple Discussions forum, did you trashed Address Book.plist file, like one of members of this board said?
 
666sheep said:
Fixed it for you ;)
And seriously - this should be only done when it's needed, not everytime when any problem occured. If you got problem with permissions (this is easy to see in log) - repair them, but do not recommend it to everybody for everything - it's misleading.

OP, post that part of your log between:
System Sleep and System Wake and about 10 lines after System Wake.
BTW, you posted your problem on Apple Discussions forum, did you trashed Address Book.plist file, like one of members of this board said?
Click to expand...

Hey Thank you for the reply

I didn't do what the guy on the official forums said to do as I don't no what he ment..

Is he talking about something similar as the post above? Should i delete that file like he is saying? you seem to be saying this is bad?

In regards to the system log I hope this is the picture your after.. I'm not 100% sure what time the machine went to sleep... and I'm 98% sure where its highlighted is when it woke up.. well when i caught it.. I was half asleep though lol

thankyou for any help..feeling lost atm :-(

Screenshot2010-06-27at72935PM.png
 
This is not exactly what I meant.
Click on "Show Log List" button and select "system.log". Search for "System Sleep" and "System Wake" strings. Select multiple lines (from "System SleeP" to the about 10th line after "System Wake" - or little more) and copy/paste to your post.

About trashing .plist file: yes, do what Vylen has suggested. Just backup this file somewhere then trash from /System/Library/LaunchAgents/
 
666sheep said:
This is not exactly what I meant.
Click on "Show Log List" button and select "system.log". Search for "System Sleep" and "System Wake" strings. Select multiple lines (from "System SleeP" to the about 10th line after "System Wake" - or little more) and copy/paste to your post.

About trashing .plist file: yes, do what Vylen has suggested. Just backup this file somewhere then trash from /System/Library/LaunchAgents/
Click to expand...

Thanks for your help mate... Searching for these didnt gives me as many results as I was expecting ... But heres the entire results from searching Sleep,Wake..


Jun 26 04:21:56 matthew-coopers-imac loginwindow[32]: loginwindow SleepWakeCallback WILL sleep
Jun 26 04:21:56 matthew-coopers-imac kernel[0]: AFPSleepWakeHandler: going to sleep
Jun 26 05:57:04 matthew-coopers-imac loginwindow[32]: loginwindow SleepWakeCallback will power on, Currenttime:6/26/2010 5:57:04.538 AM - Waketime:6/26/2010 5:56:55.850 AM = Deltatime:8.688231945
Jun 26 05:57:05 matthew-coopers-imac configd[13]: Sleep: Success - AC - Idle Sleep
Jun 26 05:57:05 matthew-coopers-imac kernel[0]: AFPSleepWakeHandler: waking up
Jun 26 06:01:21 matthew-coopers-imac loginwindow[32]: loginwindow SleepWakeCallback WILL sleep
Jun 26 06:01:22 matthew-coopers-imac kernel[0]: AFPSleepWakeHandler: going to sleep
Jun 26 07:45:37 matthew-coopers-imac loginwindow[32]: loginwindow SleepWakeCallback will power on, Currenttime:6/26/2010 7:45:37.604 AM - Waketime:6/26/2010 7:45:28.850 AM = Deltatime:8.753814936
Jun 26 07:45:37 matthew-coopers-imac configd[13]: Sleep: Success - AC - Software Sleep
Jun 26 07:45:38 matthew-coopers-imac configd[13]: Sleep: Success - AC - Software Sleep
Jun 26 07:45:39 matthew-coopers-imac kernel[0]: AFPSleepWakeHandler: waking up
 
One more time ;)
Do not use Search keywords, just copy few strings after Sleep exactly as written in system.log. For example, part of my log (10.5.8):

Jun 27 14:18:55 73-dzi-16 kernel[0]: System Sleep
Jun 27 14:19:53 73-dzi-16 kernel[0]: pci restore waited for pci8086,1a38 (14972) fail
Jun 27 14:19:53 73-dzi-16 kernel[0]: Wake reason = EHCI
Jun 27 14:19:53 73-dzi-16 kernel[0]: System Wake
Jun 27 14:19:53 73-dzi-16 kernel[0]: /drv/ MacModule.cpp:261 powerStateWillChangeTo: flags=82 stateNumber=4
Jun 27 14:19:53 73-dzi-16 kernel[0]: /drv/ MacModule.cpp:262 powerStateWillChangeTo: found flag=kIOPMPowerOn (2)
Jun 27 14:19:53 73-dzi-16 kernel[0]: /drv/ MacModule.cpp:267 powerStateWillChangeTo: found flag=kIOPMRestartCapability (80)
Jun 27 14:19:53 73-dzi-16 kernel[0]: /drv/ MacModule.cpp:261 powerStateDidChangeTo: flags=82 stateNumber=4
Jun 27 14:19:53 73-dzi-16 natd[11347]: failed to write packet back (Network is down)
Jun 27 14:19:53 73-dzi-16 kernel[0]: /drv/ MacModule.cpp:262 powerStateDidChangeTo: found flag=kIOPMPowerOn (2)
Jun 27 14:19:53 73-dzi-16 kernel[0]: /drv/ MacModule.cpp:267 powerStateDidChangeTo: found flag=kIOPMRestartCapability (80)
Jun 27 14:19:53 73-dzi-16 kernel[0]: USB (EHCI):port 4 on bus 0xfd has remote wakeup from some device
Jun 27 14:19:53 73-dzi-16 natd[11347]: failed to write packet back (Network is down)
Click to expand...

I've bolded my Wake reason (tapping space key on keyboard).
 
Okies
* Since i've deleted the file looks like it hasn't been hijacked since Ive done it YAY :).. But Im not sure if the sleep thing is resolved (maybe separate issue.. looking at last nights log .. heres some snippets..

28/06/10 3:23:46 AM kernel System Sleep
28/06/10 5:11:38 AM airportd[547] _fastFinderContextInit: Starting auto-join with ssid 'Matts Network'
28/06/10 5:11:38 AM kernel Wake reason = RTC
28/06/10 5:11:38 AM kernel RTC: maintenance alarm 2010/6/27 19:11:37, sleep 2010/6/27 17:23:46
28/06/10 5:11:38 AM kernel System Wake
28/06/10 5:11:38 AM kernel Previous Sleep Cause: 5
28/06/10 5:11:38 AM kernel AirPort: Link Down on en1. Reason 4 (Disassociated due to inactivity).
28/06/10 5:11:38 AM configd[13] network configuration changed.

--------------

28/06/10 3:23:46 AM kernel System Sleep
28/06/10 5:11:38 AM airportd[547] _fastFinderContextInit: Starting auto-join with ssid 'Matts Network'
28/06/10 5:11:38 AM kernel Wake reason = RTC
28/06/10 5:11:38 AM kernel RTC: maintenance alarm 2010/6/27 19:11:37, sleep 2010/6/27 17:23:46
28/06/10 5:11:38 AM kernel System Wake
28/06/10 5:11:38 AM kernel Previous Sleep Cause: 5
28/06/10 5:11:38 AM kernel AirPort: Link Down on en1. Reason 4 (Disassociated due to inactivity).
28/06/10 5:11:38 AM configd[13] network configuration changed.
28/06/10 5:11:38 AM ntpd[24] sendto(XXXXXMatt) (fd=26): Can't assign requested address
28/06/10 5:11:40 AM mDNSResponder[33] SSLHandshake failed: -9806

28/06/10 5:11:54 AM kernel System Sleep
28/06/10 6:59:46 AM kernel Wake reason = RTC
28/06/10 6:59:46 AM kernel RTC: maintenance alarm 2010/6/27 20:59:45, sleep 2010/6/27 19:11:54
28/06/10 6:59:46 AM kernel System Wake
28/06/10 6:59:46 AM kernel Previous Sleep Cause: 5
28/06/10 6:59:46 AM kernel AirPort: Link Down on en1. Reason 4 (Disassociated due to inactivity).
28/06/10 6:59:46 AM configd[13] network configuration changed.
28/06/10 6:59:46 AM airportd[547] _fastFinderContextInit: Starting auto-join with ssid 'Matts Network'
28/06/10 6:59:53 AM kernel EIR is supported.
28/06/10 6:59:53 AM kernel SSP is supported.
28/06/10 6:59:53 AM kernel NVEthernet::setLinkStatus - Valid but not Active

-------

And this one is ME waking my computer this morning.. YES it was asleep for the first time lol.. I did have a deep sleep last night so I am not sure if the monitor lit up like it normally does during the night..

28/06/10 7:54:13 AM kernel Wake reason = OHC2
28/06/10 7:54:13 AM kernel System Wake
28/06/10 7:54:13 AM kernel Previous Sleep Cause: 5
28/06/10 7:54:13 AM kernel AirPort: Link Down on en1. Reason 4 (Disassociated due to inactivity).
28/06/10 7:54:13 AM kernel The USB device BRCM2046 Hub (Port 1 of Hub at 0x6000000) may have caused a wake by issuing a remote wakeup
28/06/10 7:54:13 AM kernel The USB device Bluetooth USB Host Controller (Port 1 of Hub at 0x6100000) may have caused a wake by issuing a remote wakeup
28/06/10 7:54:13 AM configd[13] network configuration changed.
28/06/10 7:54:17 AM ntpd[24] time reset +0.552384 s
28/06/10 7:54:21 AM kernel EIR is supported.
28/06/10 7:54:21 AM kernel SSP is supported.
28/06/10 7:54:21 AM kernel NVEthernet::setLinkStatus - Valid but not Active
 
666sheep said:
Fixed it for you ;)
And seriously - this should be only done when it's needed, not everytime when any problem occured. If you got problem with permissions (this is easy to see in log) - repair them, but do not recommend it to everybody for everything - it's misleading.
Click to expand...

It's better than nothing. Takes 5 minutes, that shouldn't ruin your day shouldn't it? If it doesn't fix it, so what? It doesn't hurt anything. Not everyone want to or even understands anything about Console so it's easier to just repair them than start posting screenshots and asking should I repair them.

If it could actually screw up something, I would understand your point of view but because it doesn't, I don't get it. Those three things fixes a lot issues. I know I spread it a lot but permission repair is recommended to do by time to time anyway.
 
OP, your problem is Wake on demand function, precisely Bonjour Sleep Proxy. See here for explanation: http://support.apple.com/kb/HT3774 and how to disable it. Your Mac is checking its network connection with Airport or Time Capsule (i presume that you have one). Read this document and try to disable this feature.
"Hijack" was not the source of your sleep problem.

@Hellhammer: PRAM and SMC reset are useful, i agree. But since 10.4, repairing permissions is useless, unless you got problem with them. It does nothing and won't help in 99,9% of cases. It gives identical effect as jumping on left leg and holding your nose with right hand to solve your problem ;) Not harms, not helps, just waste of time.
Could you please link where Apple recommmends permissions repairing from time to time?
 
666sheep said:
@Hellhammer: PRAM and SMC reset are useful, i agree. But since 10.4, repairing permissions is useless, unless you got problem with them. It does nothing and won't help in 99,9% of cases. It gives identical effect as jumping on left leg and holding your nose with right hand to solve your problem ;) Not harms, not helps, just waste of time.
Could you please link where Apple recommmends permissions repairing from time to time?
Click to expand...

Last time it fixed something for OP was yesterday, actually, it fixed things twice yesterday... Both were slowness issues though. If you can look at the console to see is it a permission issue, then fine, good for you, most people cannot. I'm not going to abandon it as it obviously does fix something even though you think it doesn't. If you don't find it useful, fine, don't, but I do. It takes so little time anyway.
 
666sheep said:
OP, your problem is Wake on demand function, precisely Bonjour Sleep Proxy. See here for explanation: http://support.apple.com/kb/HT3774 and how to disable it. Your Mac is checking its network connection with Airport or Time Capsule (i presume that you have one). Read this document and try to disable this feature.
"Hijack" was not the source of your sleep problem.

@Hellhammer: PRAM and SMC reset are useful, i agree. But since 10.4, repairing permissions is useless, unless you got problem with them. It does nothing and won't help in 99,9% of cases. It gives identical effect as jumping on left leg and holding your nose with right hand to solve your problem ;) Not harms, not helps, just waste of time.
Could you please link where Apple recommmends permissions repairing from time to time?
Click to expand...

thanks for your help!!! could this also be the issue to my screen saver randomly stopping?

this is what happened today when the screen saver stoped..

also i think hijack it resolved now that i deleted that file! great forums :)

28/06/10 3:57:01 PM fseventsd[38] log dir: /Volumes/Backup of Matthew Cooper’s iMac/.fseventsd getting new uuid: XXXprivate
28/06/10 3:57:31 PM mobilemesyncclient[1659] POST /marketeer (FAILED), httpStatusCode:503, errorType:100, transactionState:5, txnId:XXXXXXXXprivate matt, auto-retries=0, manual-retries=0
28/06/10 3:57:31 PM com.apple.syncservices.SyncServer[1622] 2010-06-28 15:57:31.838 mobilemesyncclient[1659:36d7] POST /marketeer (FAILED), httpStatusCode:503, errorType:100, transactionState:5, txnId:XXXXXXXXprivate matt, auto-retries=0, manual-retries=0
28/06/10 3:57:44 PM com.apple.backupd[1631] No pre-backup thinning needed: 593.0 MB requested (including padding), 303.97 GB available
28/06/10 3:57:53 PM com.apple.launchd[1] (com.apple.netauth.sysagent[1632]) Exited with exit code: 255
28/06/10 3:58:11 PM mdworker32[1662] socket(PF_ROUTE) failed: Operation not permitted
28/06/10 3:58:11 PM sandboxd[1663] mdworker32(1662) deny system-socket
 
And the prize goes to me! :p At least, regarding the hijack issue (look on the Apple discussion forums, people there still haven't figured it out lol)
 
Vylen said:
And the prize goes to me! :p At least, regarding the hijack issue (look on the Apple discussion forums, people there still haven't figured it out lol)
Click to expand...

:eek: There was prize available? Stupid me... ;) :D

OP, in last part of your log i see only MobileMe syncing error (if it works, don't bother with it) and mdworker32 error (this is process common for Spotlight and TimeMachine, sometimes one of them prevents another from acces this process - it's OS bug AFAIK. Again - if Spotlight and TM are working OK - don't worry).
 
When I first got my 27, I had the problem of my screensaver never lasting as well. Disabling growl's "wake on demand" fixed it though.
 
Vylen said:
Try deleting /System/Library/LaunchAgents/com.apple.AddressBook.abd.plist

That's the preferences file for AddressBook. Maybe dodgy preferences are making it behave incorrectly.
Click to expand...
[In case someone reads the quoted answer again, like I did]
Sorry, but you're wrong: the path you're referring to is not a preferences file (plist extension is not reserved for them). Rather, this is the file that tells launchd to launch (and how to do it) the service named “AddressBook.abd” (whatever the purpose it actually serves). If you delete this file, or otherwise move it, the only reason you'll think the problem is gone will be because, the next time you restart your Mac, that AddressBook component won't be launched (won't run) at all.
So, hopefully people having such a problem will think twice before trying this and only stopping a service…
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back