iMac waking up..console says its hijacked!

Discussion in 'iMac' started by mattcooper, Jun 25, 2010.

  1. mattcooper macrumors member

    mattcooper

    Joined:
    Jul 31, 2008
    Location:
    Bargara
    #1
    Hey...

    My iMac has been waking up allot during the night for the past few months... Someone when I come to it I find it not sleeping at all. I was told a few weeks ago when I catch it go to the system log.. I did that today and am now really worried its some sort of Mac Virus or something.. I could be wrong its just the name freaks me out.


    26/06/10 2:07:44 AM com.apple.launchd.peruser.501[88] (com.apple.AddressBook.abd) The following job tried to hijack the service "com.apple.AddressBook.abd" from this job: [0x0-0xd9fd9f].com.apple.AddressBook.abd


    Edit:
    Looks like its every HOUR!
    [​IMG]
     
  2. Hellhammer Moderator

    Hellhammer

    Staff Member

    Joined:
    Dec 10, 2008
    Location:
    Finland
    #2
    Try resetting PRAM and SMC and repairing permissions with the Disk Utility
     
  3. Vylen macrumors 65816

    Joined:
    Jun 3, 2010
    Location:
    Sydney, Australia
    #3
    No virus.

    It looks like a service in Mac OS X (com.apple.AddressBook.abd) is being stupid and messing with itself.
     
  4. mattcooper thread starter macrumors member

    mattcooper

    Joined:
    Jul 31, 2008
    Location:
    Bargara
    #4
    Bugger didn't solve it. But thank you , any other ideas?
     
  5. Vylen macrumors 65816

    Joined:
    Jun 3, 2010
    Location:
    Sydney, Australia
    #5
    Yea, I figured it wouldn't work.

    Try deleting /System/Library/LaunchAgents/com.apple.AddressBook.abd.plist

    That's the preferences file for AddressBook. Maybe dodgy preferences are making it behave incorrectly.
     
  6. 666sheep macrumors 68040

    666sheep

    Joined:
    Dec 7, 2009
    Location:
    Poland
    #6
    Fixed it for you ;)
    And seriously - this should be only done when it's needed, not everytime when any problem occured. If you got problem with permissions (this is easy to see in log) - repair them, but do not recommend it to everybody for everything - it's misleading.

    OP, post that part of your log between:
    System Sleep and System Wake and about 10 lines after System Wake.
    BTW, you posted your problem on Apple Discussions forum, did you trashed Address Book.plist file, like one of members of this board said?
     
  7. mattcooper thread starter macrumors member

    mattcooper

    Joined:
    Jul 31, 2008
    Location:
    Bargara
    #7
    Hey Thank you for the reply

    I didn't do what the guy on the official forums said to do as I don't no what he ment..

    Is he talking about something similar as the post above? Should i delete that file like he is saying? you seem to be saying this is bad?

    In regards to the system log I hope this is the picture your after.. I'm not 100% sure what time the machine went to sleep... and I'm 98% sure where its highlighted is when it woke up.. well when i caught it.. I was half asleep though lol

    thankyou for any help..feeling lost atm :-(

    [​IMG]
     
  8. 666sheep macrumors 68040

    666sheep

    Joined:
    Dec 7, 2009
    Location:
    Poland
    #8
    This is not exactly what I meant.
    Click on "Show Log List" button and select "system.log". Search for "System Sleep" and "System Wake" strings. Select multiple lines (from "System SleeP" to the about 10th line after "System Wake" - or little more) and copy/paste to your post.

    About trashing .plist file: yes, do what Vylen has suggested. Just backup this file somewhere then trash from /System/Library/LaunchAgents/
     
  9. mattcooper thread starter macrumors member

    mattcooper

    Joined:
    Jul 31, 2008
    Location:
    Bargara
    #9
    Thanks for your help mate... Searching for these didnt gives me as many results as I was expecting ... But heres the entire results from searching Sleep,Wake..


    Jun 26 04:21:56 matthew-coopers-imac loginwindow[32]: loginwindow SleepWakeCallback WILL sleep
    Jun 26 04:21:56 matthew-coopers-imac kernel[0]: AFPSleepWakeHandler: going to sleep
    Jun 26 05:57:04 matthew-coopers-imac loginwindow[32]: loginwindow SleepWakeCallback will power on, Currenttime:6/26/2010 5:57:04.538 AM - Waketime:6/26/2010 5:56:55.850 AM = Deltatime:8.688231945
    Jun 26 05:57:05 matthew-coopers-imac configd[13]: Sleep: Success - AC - Idle Sleep
    Jun 26 05:57:05 matthew-coopers-imac kernel[0]: AFPSleepWakeHandler: waking up
    Jun 26 06:01:21 matthew-coopers-imac loginwindow[32]: loginwindow SleepWakeCallback WILL sleep
    Jun 26 06:01:22 matthew-coopers-imac kernel[0]: AFPSleepWakeHandler: going to sleep
    Jun 26 07:45:37 matthew-coopers-imac loginwindow[32]: loginwindow SleepWakeCallback will power on, Currenttime:6/26/2010 7:45:37.604 AM - Waketime:6/26/2010 7:45:28.850 AM = Deltatime:8.753814936
    Jun 26 07:45:37 matthew-coopers-imac configd[13]: Sleep: Success - AC - Software Sleep
    Jun 26 07:45:38 matthew-coopers-imac configd[13]: Sleep: Success - AC - Software Sleep
    Jun 26 07:45:39 matthew-coopers-imac kernel[0]: AFPSleepWakeHandler: waking up
     
  10. 666sheep macrumors 68040

    666sheep

    Joined:
    Dec 7, 2009
    Location:
    Poland
    #10
    One more time ;)
    Do not use Search keywords, just copy few strings after Sleep exactly as written in system.log. For example, part of my log (10.5.8):

    I've bolded my Wake reason (tapping space key on keyboard).
     
  11. mattcooper thread starter macrumors member

    mattcooper

    Joined:
    Jul 31, 2008
    Location:
    Bargara
    #11
    Okies
    * Since i've deleted the file looks like it hasn't been hijacked since Ive done it YAY :).. But Im not sure if the sleep thing is resolved (maybe separate issue.. looking at last nights log .. heres some snippets..

    28/06/10 3:23:46 AM kernel System Sleep
    28/06/10 5:11:38 AM airportd[547] _fastFinderContextInit: Starting auto-join with ssid 'Matts Network'
    28/06/10 5:11:38 AM kernel Wake reason = RTC
    28/06/10 5:11:38 AM kernel RTC: maintenance alarm 2010/6/27 19:11:37, sleep 2010/6/27 17:23:46
    28/06/10 5:11:38 AM kernel System Wake
    28/06/10 5:11:38 AM kernel Previous Sleep Cause: 5
    28/06/10 5:11:38 AM kernel AirPort: Link Down on en1. Reason 4 (Disassociated due to inactivity).
    28/06/10 5:11:38 AM configd[13] network configuration changed.

    --------------

    28/06/10 3:23:46 AM kernel System Sleep
    28/06/10 5:11:38 AM airportd[547] _fastFinderContextInit: Starting auto-join with ssid 'Matts Network'
    28/06/10 5:11:38 AM kernel Wake reason = RTC
    28/06/10 5:11:38 AM kernel RTC: maintenance alarm 2010/6/27 19:11:37, sleep 2010/6/27 17:23:46
    28/06/10 5:11:38 AM kernel System Wake
    28/06/10 5:11:38 AM kernel Previous Sleep Cause: 5
    28/06/10 5:11:38 AM kernel AirPort: Link Down on en1. Reason 4 (Disassociated due to inactivity).
    28/06/10 5:11:38 AM configd[13] network configuration changed.
    28/06/10 5:11:38 AM ntpd[24] sendto(XXXXXMatt) (fd=26): Can't assign requested address
    28/06/10 5:11:40 AM mDNSResponder[33] SSLHandshake failed: -9806

    28/06/10 5:11:54 AM kernel System Sleep
    28/06/10 6:59:46 AM kernel Wake reason = RTC
    28/06/10 6:59:46 AM kernel RTC: maintenance alarm 2010/6/27 20:59:45, sleep 2010/6/27 19:11:54
    28/06/10 6:59:46 AM kernel System Wake
    28/06/10 6:59:46 AM kernel Previous Sleep Cause: 5
    28/06/10 6:59:46 AM kernel AirPort: Link Down on en1. Reason 4 (Disassociated due to inactivity).
    28/06/10 6:59:46 AM configd[13] network configuration changed.
    28/06/10 6:59:46 AM airportd[547] _fastFinderContextInit: Starting auto-join with ssid 'Matts Network'
    28/06/10 6:59:53 AM kernel EIR is supported.
    28/06/10 6:59:53 AM kernel SSP is supported.
    28/06/10 6:59:53 AM kernel NVEthernet::setLinkStatus - Valid but not Active

    -------

    And this one is ME waking my computer this morning.. YES it was asleep for the first time lol.. I did have a deep sleep last night so I am not sure if the monitor lit up like it normally does during the night..

    28/06/10 7:54:13 AM kernel Wake reason = OHC2
    28/06/10 7:54:13 AM kernel System Wake
    28/06/10 7:54:13 AM kernel Previous Sleep Cause: 5
    28/06/10 7:54:13 AM kernel AirPort: Link Down on en1. Reason 4 (Disassociated due to inactivity).
    28/06/10 7:54:13 AM kernel The USB device BRCM2046 Hub (Port 1 of Hub at 0x6000000) may have caused a wake by issuing a remote wakeup
    28/06/10 7:54:13 AM kernel The USB device Bluetooth USB Host Controller (Port 1 of Hub at 0x6100000) may have caused a wake by issuing a remote wakeup
    28/06/10 7:54:13 AM configd[13] network configuration changed.
    28/06/10 7:54:17 AM ntpd[24] time reset +0.552384 s
    28/06/10 7:54:21 AM kernel EIR is supported.
    28/06/10 7:54:21 AM kernel SSP is supported.
    28/06/10 7:54:21 AM kernel NVEthernet::setLinkStatus - Valid but not Active
     
  12. Hellhammer Moderator

    Hellhammer

    Staff Member

    Joined:
    Dec 10, 2008
    Location:
    Finland
    #12
    It's better than nothing. Takes 5 minutes, that shouldn't ruin your day shouldn't it? If it doesn't fix it, so what? It doesn't hurt anything. Not everyone want to or even understands anything about Console so it's easier to just repair them than start posting screenshots and asking should I repair them.

    If it could actually screw up something, I would understand your point of view but because it doesn't, I don't get it. Those three things fixes a lot issues. I know I spread it a lot but permission repair is recommended to do by time to time anyway.
     
  13. 666sheep macrumors 68040

    666sheep

    Joined:
    Dec 7, 2009
    Location:
    Poland
    #13
    OP, your problem is Wake on demand function, precisely Bonjour Sleep Proxy. See here for explanation: http://support.apple.com/kb/HT3774 and how to disable it. Your Mac is checking its network connection with Airport or Time Capsule (i presume that you have one). Read this document and try to disable this feature.
    "Hijack" was not the source of your sleep problem.

    @Hellhammer: PRAM and SMC reset are useful, i agree. But since 10.4, repairing permissions is useless, unless you got problem with them. It does nothing and won't help in 99,9% of cases. It gives identical effect as jumping on left leg and holding your nose with right hand to solve your problem ;) Not harms, not helps, just waste of time.
    Could you please link where Apple recommmends permissions repairing from time to time?
     
  14. Hellhammer Moderator

    Hellhammer

    Staff Member

    Joined:
    Dec 10, 2008
    Location:
    Finland
    #14
    Last time it fixed something for OP was yesterday, actually, it fixed things twice yesterday... Both were slowness issues though. If you can look at the console to see is it a permission issue, then fine, good for you, most people cannot. I'm not going to abandon it as it obviously does fix something even though you think it doesn't. If you don't find it useful, fine, don't, but I do. It takes so little time anyway.
     
  15. mattcooper thread starter macrumors member

    mattcooper

    Joined:
    Jul 31, 2008
    Location:
    Bargara
    #15
    thanks for your help!!! could this also be the issue to my screen saver randomly stopping?

    this is what happened today when the screen saver stoped..

    also i think hijack it resolved now that i deleted that file! great forums :)

    28/06/10 3:57:01 PM fseventsd[38] log dir: /Volumes/Backup of Matthew Cooper’s iMac/.fseventsd getting new uuid: XXXprivate
    28/06/10 3:57:31 PM mobilemesyncclient[1659] POST /marketeer (FAILED), httpStatusCode:503, errorType:100, transactionState:5, txnId:XXXXXXXXprivate matt, auto-retries=0, manual-retries=0
    28/06/10 3:57:31 PM com.apple.syncservices.SyncServer[1622] 2010-06-28 15:57:31.838 mobilemesyncclient[1659:36d7] POST /marketeer (FAILED), httpStatusCode:503, errorType:100, transactionState:5, txnId:XXXXXXXXprivate matt, auto-retries=0, manual-retries=0
    28/06/10 3:57:44 PM com.apple.backupd[1631] No pre-backup thinning needed: 593.0 MB requested (including padding), 303.97 GB available
    28/06/10 3:57:53 PM com.apple.launchd[1] (com.apple.netauth.sysagent[1632]) Exited with exit code: 255
    28/06/10 3:58:11 PM mdworker32[1662] socket(PF_ROUTE) failed: Operation not permitted
    28/06/10 3:58:11 PM sandboxd[1663] mdworker32(1662) deny system-socket
     
  16. Vylen macrumors 65816

    Joined:
    Jun 3, 2010
    Location:
    Sydney, Australia
    #16
    And the prize goes to me! :p At least, regarding the hijack issue (look on the Apple discussion forums, people there still haven't figured it out lol)
     
  17. 666sheep macrumors 68040

    666sheep

    Joined:
    Dec 7, 2009
    Location:
    Poland
    #17
    :eek: There was prize available? Stupid me... ;) :D

    OP, in last part of your log i see only MobileMe syncing error (if it works, don't bother with it) and mdworker32 error (this is process common for Spotlight and TimeMachine, sometimes one of them prevents another from acces this process - it's OS bug AFAIK. Again - if Spotlight and TM are working OK - don't worry).
     
  18. TMRaven macrumors 68020

    TMRaven

    Joined:
    Nov 5, 2009
    #18
    When I first got my 27, I had the problem of my screensaver never lasting as well. Disabling growl's "wake on demand" fixed it though.
     
  19. Anic297 macrumors newbie

    Joined:
    Sep 14, 2010
    Location:
    Switzerland
    #19
    [In case someone reads the quoted answer again, like I did]
    Sorry, but you're wrong: the path you're referring to is not a preferences file (plist extension is not reserved for them). Rather, this is the file that tells launchd to launch (and how to do it) the service named “AddressBook.abd” (whatever the purpose it actually serves). If you delete this file, or otherwise move it, the only reason you'll think the problem is gone will be because, the next time you restart your Mac, that AddressBook component won't be launched (won't run) at all.
    So, hopefully people having such a problem will think twice before trying this and only stopping a service…
     

Share This Page