HELP! Terminal keeps randomly opening with a file that doesn't exist

[adamwhalley92]

Hi Guys,

Just need a little bit of help - Terminal keeps opening every 5 mins or so with this file and this message. The file in question doesn't exist. What I do to stop this happening.

I've attached the screenshot. Hope someone can help.

Cheers

Adam

 

[chabig]

Can you delete the file GP6 from your Dowloads folder?

 

[adamwhalley92]

Can you delete thee file GP6 from your Dowloads folder?

It;s not there. I tried to install that maybe 4 or 5 years ago on an old machine, but it doesn't exist any longer!

 

[DeltaMac]

So, has your terminal has been launching every 5 minutes for 4 or 5 years?

If it is always that same window, then it's not what I would call random.
Your Console may offer some explanation why your terminal continues to open.
The system.log would list actions by time and date.
Note what time the terminal launches, and look for a corresponding action listed in your system.log.

 

[adamwhalley92]

It has definitely only just started doing this. Obviously it isnt random but I'd be very intrigued to see why it's happening! I'll check up on that now and post! Cheers

 

[DeltaMac]

Have you just recently upgraded your software?
What version of OS X (or macOS ) is installed?

 

[adamwhalley92]

I'm on 10.11.15 I've been on El Capitan since it came out pretty much. it hasn't done it for the last few hours so i haven't been able to check on my system log - but it seemed to be hell bent on doing it all morning

 

[Weaselboy]

Hi Guys,

Just need a little bit of help - Terminal keeps opening every 5 mins or so with this file and this message. The file in question doesn't exist. What I do to stop this happening.

I've attached the screenshot. Hope someone can help.

Cheers

Adam

It looks like you installed a pirated version of Guitar Pro 6 and there is a bash Terminal script trying to run chmod to make the keygen_osx file executable. The script that is doing this is not in the ~/Downloads folder, but it is trying to run chmod against a files in that folder that is no longer there.

When is does this again, go to Terminal and hit the up arrow one time. This should show the last run command/script. For example in this shot you can see the last script run was a hidden script called ./script.sh.

Once you find the name of the bash script doing this we can find it and delete it.

 

[adamwhalley92]

It looks like you installed a pirated version of Guitar Pro 6 and there is a bash Terminal script trying to run chmod to make the keygen_osx file executable. The script that is doing this is not in the ~/Downloads folder, but it is trying to run chmod against a files in that folder that is no longer there.

When is does this again, go to Terminal and hit the up arrow one time. This should show the last run command/script. For example in this shot you can see the last script run was a hidden script called ./script.sh.

Once you find the name of the bash script doing this we can find it and delete it.

View attachment 641892

Thanks for the help - So when I hit Up, the attachment below is what it said. I've also attached the system log file. It happened between 13:45.00 and 13:45.16
[doublepost=1469620179][/doublepost]

So, has your terminal has been launching every 5 minutes for 4 or 5 years?

If it is always that same window, then it's not what I would call random.
Your Console may offer some explanation why your terminal continues to open.
The system.log would list actions by time and date.
Note what time the terminal launches, and look for a corresponding action listed in your system.log.

Here's the system log. just happened at around 13:45.00
[doublepost=1469620270][/doublepost]I think it is something to do with at 13:45.09 where it mentions ttys001. That is what is written on terminal when the thing first appears

Jul 27 13:45:09 Adams-MacBook-Pro login[3091]: USER_PROCESS: 3091 ttys001
Jul 27 13:45:10 Adams-MacBook-Pro com.apple.AddressBook.InternetAccountsBridge[3114]: dnssd_clientstub ConnectToServer: connect()-> No of tries: 1

 

[Weaselboy]

Try this... run the command below in Terminal to show the Terminal history in TextEdit and see if anything looks like that chmod command.

open ~/.bash_history -a /Applications/TextEdit.app

Also, try running the app EtreCheck. That will create an anonymized report showing all hidden startup and launch items. You can post the report here so we can take a look.

ttys001 is the keyboard, so something is telling the keyboard to do something there.

 

[adamwhalley92]

Try this... run the command below in Terminal to show the Terminal history in TextEdit and see if anything looks like that chmod command.

open ~/.bash_history -a /Applications/TextEdit.app

Also, try running the app EtreCheck. That will create an anonymized report showing all hidden startup and launch items. You can post the report here so we can take a look.

ttys001 is the keyboard, so something is telling the keyboard to do something there.

Thanks for the help. In the text edit it shows up that exact command,

chmod +x
chmod +x
/Users/Adam/Downloads/GP6/keygen_osx
chmod +X/Users/Adam/Downloads/GP6/keygen_osx
.../keygen_osx
run .../keygen_osx/Users/Adam/Downloads/GP6/keygen_osx
/Users/Adam/Downloads/GP6/keygen_osx
chmod +x/Users/Adam/Downloads/GP6/keygen_osx
/Users/Adam/Downloads/GP6/keygen_osx ; exit;
chmod +x/Users/Adam/Downloads/GP6/keygen_osx ; exit;
/Volumes/NO\ NAME/New\ folder/hosts ; exit;

So what do i do now? Do I simply delete that and the problem goes away?

I'm really shocked as to why this has just started happening, as I really haven't had that file for years!

 

[Weaselboy]

Thanks for the help. In the text edit it shows up that exact command,

Okay... that shows the commands, but not what is running them. Somewhere there is a bash (Terminal) .sh file running this and we need to find it.

Try the Etrecheck report so we can look for something launching this script.

Do you have Guitar Pro installed and is this happening when you run it?

 

[adamwhalley92]

Etrecheck didn't turn anything up (other than a few seemingly unrelated bits of adware that were found that I deleted) - and I don't have guitar pro installed. I never installed it at all. I found a free piece of software called TuxGuitar which did the job better and for free, and deleted the file at least 4 years ago now, which is why i'm perplexed that it's still appearing.

On a side note, in my terminal preferences the bash command was automatically set as the window title! and the default shells were opening with /bin/bash. May this have anything to do with it? It still doesn't tell me why it was happening automatically!

 

[Weaselboy]

Etrecheck didn't turn anything up

I'd really like to see that report, as I think that may hold a clue.

Normally timed scripts like this are run by the launchd process from one of these launch item folders.

~/Library/LaunchAgents (~ is your users folder)
/Library/LaunchAgents
/Library/LaunchDaemons
/Library/StartupItems
/System/Library/Extensions/

Try running this command in Terminal so show everything launchd is running. It will be a long list, but look for anything not from Apple.

sudo launchctl list

 

[adamwhalley92]

I'd really like to see that report, as I think that may hold a clue.

Normally timed scripts like this are run by the launchd process from one of these launch item folders.

~/Library/LaunchAgents (~ is your users folder)
/Library/LaunchAgents
/Library/LaunchDaemons
/Library/StartupItems
/System/Library/Extensions/

Try running this command in Terminal so show everything launchd is running. It will be a long list, but look for anything not from Apple.

sudo launchctl list

Cheers for all your help!! i really appreciate it.

So this is the launch list... I can't see anything particularly untoward. The peer guardian ones are worrying, but as far as I'm aware, that's quite safe software?

Attached is the EtreCheck doc too....

PID    Status    Label

-    0    com.apple.storedownloadd.daemon

153    0    com.apple.coreservicesd

-    0    com.gobbler.bsd.HelperTool

-    0    com.apple.avbdeviced

-    0    com.apple.FontWorker

269    0    com.apple.cvmsServ

-    0    com.apple.applessdstatistics

-    0    com.apple.DesktopServicesHelper.BA41020D-A93D-4707-8E1C-B76BACEFD322

-    0    com.apple.storagekitd

-    0    com.apple.hdiejectd

243    0    com.apple.corestorage.corestoraged

-    0    com.apple.wifid

-    0    com.apple.storereceiptinstaller

190    0    com.apple.networkd_privileged

-    0    com.macpaw.CleanMyMac3.Agent

75    0    com.apple.iconservices.iconservicesagent

-    0    com.apple.emond

45    0    com.apple.syslogd

-    0    com.apple.logkextloadsd

-    0    com.apple.bluetoothReporter

236    0    com.apple.WindowServer

-    0    com.apple.NetworkSharing

-    0    com.apple.afpfs_checkafp

-    0    com.avast.uninstall

-    0    com.apple.AppleFileServer

-    0    com.apple.var-db-dslocal-backup

91    0    com.apple.securityd

-    0    com.apple.nesessionmanager

-    0    com.apple.auditd

250    0    com.apple.symptomsd

18711    0    com.apple.ocspd

99    0    com.apple.autofsd

-    0    com.avid.bsd.shoetoolv120

44    0    com.apple.UserEventAgent-System

-    0    com.apple.Kerberos.kadmind

-    0    com.apple.preferences.timezone.auto

181    0    com.apple.coresymbolicationd

676    0    com.apple.suhelperd

-    0    com.apple.RFBEventHelper

-    0    com.paceap.pacesupport

-    0    com.apple.racoon

-    0    com.apple.IASUtilities.IASCloudConfigHelper

-    0    com.apple.metadata.mds.scan

115    0    com.apple.AirPlayXPCHelper

51    0    com.apple.ODSAgent

-    0    com.apple.RemoteDesktop.PrivilegeProxy

-    0    com.apple.mtmd

-    0    com.apple.mbusertrampoline

-    0    com.apple.system_installd

-    0    com.apple.sysdiagnose

441    0    com.apple.installd

-    0    org.postfix.master

-    0    com.apple.dvdplayback.setregion

241    0    com.apple.nehelper

-    1    com.apple.logd

-    0    com.apple.iBooksX-SecureUserDefaults

319    0    com.apple.tccd.system

-    0    com.apple.appleseed.fbahelperd

-    0    com.apple.IFCStart

-    0    com.apple.softwareupdate_download_service

-    0    com.apple.mdmclient.daemon

164    0    com.apple.ctkd

234    0    com.avast.daemon

240    0    com.apple.nsurlsessiond_privileged

211    0    com.apple.awdd

-    0    com.apple.mDNSResponderHelper.reloaded

-    0    com.apple.screensharing

-    0    com.apple.periodic-monthly

-    0    com.apple.findmymacmessenger

166    0    com.apple.secinitd

440    0    com.apple.TMCacheDelete

-    0    com.apple.scsid

-    0    com.apple.kuncd

-    0    com.apple.corecaptured

-    0    com.oracle.java.JavaUpdateHelper

-    0    com.gobbler.DownstreamProxy

-    0    com.apple.IOAccelMemoryInfoCollector

-    0    com.apple.msrpc.lsarpc

111    0    com.apple.KernelEventAgent

132    0    com.apple.aslmanager

-    0    com.apple.taskgated-helper

2873    0    com.apple.cmio.registerassistantservice

-    0    com.apple.RemotePairTool

114    0    com.apple.hidd

47    0    com.apple.kextd

50    0    com.memeo.Memeod

-    71    xxx.qnation.PeerGuardian.kextload

54    0    com.usbApogeeDaemon.plist

-    0    com.apple.systemstats.analysis

145    0    com.apple.diagnosticd

56    0    com.apple.coreservices.appleevents

59    0    com.apple.powerd

150    0    com.apple.authd

-    0    com.apple.DumpPanic

65    0    com.mice.360Daemon

-    0    com.apple.vsdbutil

-    0    com.apple.nfsd

208    0    com.apple.audio.coreaudiod

-    0    com.apple.akd

67    0    com.apple.airportd

486    -43    com.apple.watchdogd

-    0    com.apple.pfd

-    0    com.avast.update

-    0    com.apple.NetworkDiagnostics

76    0    com.apple.iconservices.iconservicesd

-    0    com.apple.systemkeychain

-    0    com.apple.nlcd

-    0    com.apple.SCHelper

-    0    com.apple.periodic-weekly

14730    0    com.apple.netbiosd

-    0    org.cups.cupsd

-    0    com.apple.statd.notify

-    0    com.apple.rootless.init

-    0    com.apple.preferences.timezone.admintool

468    0    com.apple.nsurlstoraged

4629    0    com.apple.noticeboard.state

239    0    com.apple.metadata.mds.index

238    0    com.apple.lsd

90    0    com.apple.usbmuxd

-    0    com.apple.IOBluetoothUSBDFU

592    0    com.apple.CrashReporterSupportHelper

554    0    com.avast.proxy

-    0    com.apple.security.authhost.00000000-0000-0000-0000-0000000186A7

96    0    com.symphonyDaemon.plist

-    0    com.apple.DumpGPURestart

97    0    com.apple.displaypolicyd

98    0    com.apple.blued

-    0    org.postfix.newaliases

297    0    com.apple.securityd_service

4574    0    com.apple.periodic-daily

251    0    com.apple.alf

-    0    com.apple.DesktopServicesHelper.011EF96B-A9A2-42A3-9D0C-083DBC280736

110    0    com.apple.logind

-    0    com.apple.dspluginhelperd

-    0    com.apple.msrpc.netlogon

-    0    com.apple.CoreRAID

-    0    com.apple.DesktopServicesHelper.243E56FB-9357-4DBE-AFD2-36441FF79538

-    0    com.apple.TrustEvaluationAgent.system

-    0    com.apple.newsyslog

439    0    com.apple.cache_delete

141    0    com.apple.taskgated

-    0    com.apple.MRTd

-    0    com.apple.GSSCred

314    0    com.apple.audio.systemsoundserverd

-    0    com.microsoft.office.licensing.helper

57    0    com.apple.configd

-    0    com.rogueamoeba.instanton-agent

288    0    com.apple.AccountPolicyHelper

-    0    com.apple.fontmover

-    0    com.apple.UserNotificationCenter

-    0    com.google.keystone.daemon

188    0    com.apple.icloud.findmydeviced

-    0    com.apple.speech.speechsynthesisd

-    0    com.apple.rpcbind

187    0    com.apple.networkd

79    0    com.apple.coreduetd

-    0    com.apple.airplaydiagnostics.server.mac

80    0    com.apple.wdhelper

-    0    com.apple.ucupdate.plist

-    0    com.apple.ManagedClient.enroll

-    0    com.apple.DesktopServicesHelper

-    0    com.apple.DesktopServicesHelper.7C4506F3-C7DF-47A0-9AF7-AEBC3B9C964C

93    0    com.apple.locationd

-    0    com.oracle.java.Helper-Tool

-    0    com.apple.Kerberos.kcm

336    0    com.apple.coreservices.sharedfilelistd

525    0    com.avast.service

109    0    com.apple.loginwindow

-    0    com.apple.efilogin-helper

-    0    com.apple.cmio.iOSScreenCaptureAssistant

116    0    com.apple.notifyd

601    0    com.avast.fileshield

-    0    com.avid.bsd.DigiShoeTool

-    0    com.apple.ReportPanicService

-    0    com.avast.account

-    0    com.apple.aelwriter

-    0    com.apple.Kerberos.digest-service

48    0    com.apple.fseventsd

-    0    com.apple.automountd

-    0    com.vix.cron

245    0    com.apple.thermald

415    0    com.apple.FileCoordination

-    0    com.apple.eapolcfg_auth

-    0    com.apple.coreservices.appleid.passwordcheck

-    0    com.apple.AssetCacheLocatorService

675    0    com.apple.softwareupdated

-    0    com.apple.InstallerDiagnostics.installerdiagd

3620    0    com.apple.systemadministration.writeconfig

1043    0    com.apple.SubmitDiagInfo

-    0    com.apple.emond.aslmanager

-    0    com.apple.mbsystemadministration

-    0    com.apple.hidfud

-    0    com.jdi.vpn.VPNHelper

-    0    com.apple.msrpc.mdssvc

-    0    com.apple.dpd

14837    0    com.apple.cmio.AppleCameraAssistant

-    0    com.apple.corestorage.corestoragehelperd

-    0    com.apple.trustd

-    0    com.apple.ReportCrash.Root

-    0    com.apple.systempreferences.install

-    0    com.apple.cmio.IIDCVideoAssistant

4572    0    com.apple.security.syspolicy

244    0    com.apple.usbd

106    0    com.apple.mDNSResponder.reloaded

120    0    com.apple.distnoted.xpc.daemon

-    0    com.apple.bsd.dirhelper

108    0    com.apple.revisiond

-    0    com.apple.smb.preferences

-    0    com.apple.findmymacd

148    0    com.apple.cfprefsd.xpc.daemon

-    0    com.apple.cloudfamilyrestrictionsd

-    0    com.apple.Localization.SetDefaultsService

-    0    com.apple.unmountassistant.sysagent

-    0    com.adobe.SwitchBoard

-    0    com.apple.uninstalld

3622    0    com.apple.xpc.smd

-    0    com.apple.gkreport

-    0    com.apple.updateEFIDesktopPicture

-    0    com.apple.colorsyncd

-    0    com.apple.backupd

-    0    com.apple.airport.wps

1040    0    com.apple.systemstatsd

-    0    com.apple.nfsconf

-    0    com.apple.netauth.sys.auth

155    0    com.apple.MobileFileIntegrity

-    0    com.ea.origin.ESHelper

-    0    com.apple.configureLocalKDC

991    0    com.apple.spindump

70    0    com.apple.metadata.mds

-    0    com.apple.lockd

-    0    com.apple.wwand

-    0    com.apple.printtool.daemon

-    0    com.apple.fontd

247    0    com.apple.cmio.VDCAssistant

-    0    com.apple.security.agent.login

-    0    com.apple.security.authhost

-    0    com.apple.pfctl

-    0    com.apple.CommCenterRootHelper

-    0    com.apple.gssd

930    0    com.apple.PerformanceAnalysis.animationperfd

-    0    com.raynersw.netshade-ctl-2

83    0    com.apple.wirelessproxd

-    0    com.apple.security.agent.login.00000000-0000-0000-0000-0000000186A7

-    -43    com.adobe.fpsaud

-    0    com.apple.loginwindow.LFVTracer

87    0    com.apple.coreservices.launchservicesd

-    0    com.apple.afpfs_afpLoad

-    0    com.apple.platform.ptmd

-    0    com.apple.dynamic_pager

95    0    com.xrite.device.xrdd.plist

-    0    com.apple.csrutil.report

-    0    com.apple.iokit.ioserviceauthorized

242    0    org.ntp.ntpd

103    0    com.apple.Kerberos.kdc

-    0    com.apple.softwareupdatecheck.initial

-    0    com.apple.msrpc.srvsvc

-    0    com.apple.bnepd

-    0    com.apple.familycontrols

-    0    com.apple.dpaudiothru

-    0    com.apple.diagnostic.uuidpathd

-    0    com.apple.nis.ypbind

-    0    com.apple.kcproxy

-    0    com.macpaw.CleanMyMac2.Agent

258    0    com.apple.AmbientDisplayAgent

-    0    com.apple.storeagent.daemon

-    0    com.apple.installandsetup.systemmigrationd

58    0    com.line6.l6ksettingmgr

-    0    com.apple.metadata.mds.spindump

-    0    com.apple.Kerberos.kpasswdd

61    0    com.waves.daemon.SoundGridProtocolService

-    0    com.apple.msrpc.wkssvc

-    0    com.apple.awacsd

-    0    xxx.qnation.PeerGuardian.locum

69    0    com.apple.warmd

-    0    tc.tctechnologies.daemon.Saffire

-    0    com.teamviewer.Helper

-    0    com.apple.xpc.uscwoap

316    0    com.apple.WirelessRadioManagerd-osx

-    0    com.apple.powerd.swd

-    0    com.apple.ManagedClient

77    0    com.apple.diskarbitrationd

-    0    com.id-design.whatsizehelper

-    0    com.apple.systemstats.daily

-    0    com.apple.netauth.sys.gui

-    0    com.apple.startupdiskhelper

82    0    com.apple.opendirectoryd

246    0    com.apple.ifdreader

-    0    com.apple.bluetoothaudiod

709    0    com.apple.storeinstalld

85    0    com.apple.apsd

86    0    com.SymphonyIOUSBDaemon.plist

88    0    com.paceap.eden.licensed

-    0    com.anchorfree.ajaxserver

-    0    com.avast.init

-    0    com.apple.ManagedClient.cloudconfigurationd

-    0    com.apple.PCIELaneConfigTool

-    0    com.apple.GameController.gamecontrollerd

-    0    com.apple.sessionlogoutd

-    0    com.apple.storeaccountd.daemon

-    0    com.apple.cmio.AVCAssistant

209    0    com.apple.diskmanagementd

219    0    com.apple.CodeSigningHelper

1224    0    com.apple.sysmond

-    0    com.apple.storeassetd.daemon

147    0    com.apple.sandboxd
[/code[
Adams-MacBook-Pro:~ Adam$

 

[Weaselboy]

You have a LOT of third party items running there, but I don't see anything that would run this script.

There is a deprecated system for automating scripts like this called "cron"... and it is still present in El Capitan, and I'm wondering if that is what is going on. To see if there are any cron jobs running, run the command below.

crontab -l

On El Capitan it should say no crontab for username. If there is a crontab, this may be where the script is launching.

 

[chrfr]

On a side note, in my terminal preferences the bash command was automatically set as the window title! and the default shells were opening with /bin/bash. May this have anything to do with it? It still doesn't tell me why it was happening automatically!

Did you look at the "General" part of Terminal preferences, and if so, what's there?

 

[adamwhalley92]

You have a LOT of third party items running there, but I don't see anything that would run this script.

There is a deprecated system for automating scripts like this called "cron"... and it is still present in El Capitan, and I'm wondering if that is what is going on. To see if there are any cron jobs running, run the command below.

crontab -l

On El Capitan it should say no crontab for username. If there is a crontab, this may be where the script is launching.

That's what came up with the crontab ...
[doublepost=1469741955][/doublepost]

Did you look at the "General" part of Terminal preferences, and if so, what's there?

Here's the general part...

 

[DeltaMac]

You used an un-recognized option with the crontab command, a number one (1), when the crontab option would be a lower-case el (l), so

crontab -l

 

[Weaselboy]

You used an un-recognized option with the crontab command, a number one (1), when the crontab option would be a lower-case el (l), so

crontab -l

Exactly... good catch!

Adam... if you can it is easier to just copy paste these commands so you don't get sideways.

 

[adamwhalley92]

sadly still nothing has worked - which is worrying me a lot. would a time machine backup and restart from loading the OS work?

 

[Weaselboy]

sadly still nothing has worked - which is worrying me a lot. would a time machine backup and restart from loading the OS work?

What comes up when you run the command "crontab -l"?

 

[adamwhalley92]

Just says 'no crontab for adam'

 

[Weaselboy]

Just says 'no crontab for adam'

This is really baffling then. cron and launchd are the ways one would launch a script like this.

Just as a test, go into Users & Groups and make a new, test admin account and login from there and see if it happens in that account. At least that will tell us if it is something limited to the one account.

A Time Machine restore would copy the issue right back.

You could do a clean OS install then manually just move your data back and manually reinstall everything, but that will be a real hassle.

I was hoping somebody else would jump in here with an idea where to look for this script.

 

[adamwhalley92]

Thanks for all your help.

The only thing i can remember changing before it started happening was that I changed the permissions and tried to get rid of guest user accounts. That's just sprung to mind, but i have no idea why that would have any effect