suspicious activity detected ManagedClient.app

  • 26 May 2014
  • 7 replies
  • 673 views

Hello,
 
I recently had the operating system reinstalled on my mac after a file was downloaded with something attatched (genio/spiggot) and it would only boot to the grey screen.
 
After the Mac genious moved my files back to my computer, I immediately reinstalled WebRoot SecureAnywhere. The computer scanned clean but suspicious activity was detected "system folder modified: /System/Library/LaunchAgent.com/apple.ManagedClient.enrollagent.plist/System/Library/CoreServices/ManagedClient.app/Contents/MacOS/ManagedClient"
 
Can anyone verify whether this is something to be worried about or should be ignored. I need to feel secure doing online banking.
 
Thank you much!

7 replies

Userlevel 7
Badge +62
:DWelcome Welcome univ2001!! I also have a Mac runing Maverick OS 10.9.3 and have WSAC. I do at times get these suspicious activity detection once in awhile. But I am not familiar with this one.
 
 
: /System/Library/LaunchAgent.com/apple.ManagedClien
t.enrollagent.plist/System/Library/CoreServices/ManagedClient.app/Contents/MacOS/ManagedClient"
 
I would recommend opening up Launchpad and run the system Disk Utility and run Verify Disc Permissions and then Repair Disk Permission if needed. Try this and see if this helps.
 
Also @ is one of our top Forum members who deals alot with Mac computers..Hopefully he will advise you further.
I do let WSA handle thes suspicious activity detections. You could also go into WSA and click Utilities/ Manage Active Processes/ and check out the activity there which you can allow/monitor/block.
 
Please post back if you need further assistance and maybe I can reach @ for you.
 
Regards
Thank you! That was a great idea. There were a large number of incorrect permissions that were fixed...so that leads me to believe I still have a proble despite reinstalling the operating system.
 
After the disk permissions were repaired, I ran the scan again. Each time after fixing one error, the following remained:
 
Permissions differ on “Applications/Safari.app/Contents/Resources/Safari.help/Contents/Resources/index.html”; should be lrwxr-xr-x ; they are -rwxr-xr-x .
 
I tried doing the same in safe mode but nothing changed.
 
Any ideas on the next step?
 
Thanks again!
Userlevel 7
Hi univ2001 and Welcome to the Community!
 
According to Apple support, there are a few - well, actually more than a few - error messages which can be "safely" ignored. Mac OS X: Disk Utility's Repair Disk Permissions messages that you can safely ignore
 
Unfortunately, I don't see the error message that you're getting. There are no error messages listed for Safari on that web page. I'm sure that @ can shed some more light on this as @ our Community Leader said.
 
— Jeff
Userlevel 7
Hi univ2001
 
May I add my welcome to the Community Forums.
 
You are in good hands with SSherjj & jpasternak, and hopefully our resident Mac expert @ , as they have both suggested, will be around shortly to advise further.
 
Please keep us posted on progress especially if yo ueventually decide to Open a Support Ticket.  Feedback is very important to us, especially with respect to Macs, as it helps us firm up on how best to help users in the future, with similar issues.
 
Regards
 
 
Baldrick
Userlevel 7
Badge +62
😃 Hello univ2001, Great to hear that I could be of some assistance and thanks for reporting back and also @ information was helpful I hope.
 
Please don't worry because WSA will protect you.

One other idea that keeps coming up is do you have all your updates from Apple? Which I'm sure you do Right? Because there has been a few of them lately especially with SAFARI and the OS itself.

 
Wish I could help more but as @ saids you can always open a Support Ticket.

 
Have a good day!
@ wrote:
....
You are in good hands with SSherjj & jpasternak, and hopefully our resident Mac expert @ , as they have both suggested, will be around shortly to advise further......
Someone just tugged my electronic leash! 
 
Can't add much elaboration to those pointers already posted, except perhaps elaborating that the "l" (L) in first position of first permissions triad indicates l= a symbolic link   as opposed to "-" normal file.   and "d" for directory/folder......
 
FWIW I to get this (Safari 7.0.4) so in true BluePeter/Jackanory tradition(which will be a meanlingless reference to non UK readers), "here's one I prepared earlier":    
==========
Mon May 26 15:38:40 BST 2014
 
Started verify/repair permissions on disk0s6 Mac-Mavericks
Permissions differ on "Applications/Safari.app/Contents/Resources/Safari.help/Contents/Resources/index.html"; should be lrwxr-xr-x ; they are -rwxr-xr-x 
Repaired "Applications/Safari.app/Contents/Resources/Safari.help/Contents/Resources/index.html"
Finished verify/repair permissions on disk0s6 Mac-Mavericks
===========
 
As the main man already said I personally would not worry about this specifically either as it's appears to be a link to Safari help file.....
However  as OP stated there were initially a lot of "permission errors" then if these occur frequently or starts to increase then it's worth checking HDD integrity (typically via Smart status) with supportive HDD diagnostics to ensure it's not the early stages of bit sector errors etc.....  
 
FWIW I tend to run something like Cocktail (housekeeping) once a week to also repair permissions (along with clearing caches,rotating logs et etc) and if there's only a page or less of repairs listed on output page and HDD Smart status is OK then I don't  worry further....  
 
As  regards  the initial "ManagedClient.enrollagent" issue, I also suggest checking with WSA support if this is still re-occurring.
 
hth
Userlevel 7
Ah hah!  He actually does exist ;)  Just to throw in another two cents, could this have anything to do with the recent security updates pushed out for Safari?  [ http://support.apple.com/kb/HT6254 ]

Reply