Random opening of programs

[rachalmers]

Would resetting the SMC be a possible solution? I don't know much about this other than I did it once on my Macbook when the charging ports were not working.
I guess I could try it...nothing to lose.

Yes, no harm in trying



Sent from my iPad using Mac-Forums

 

[sdynak]

Sorry to bring this thread back to life but I'm wondering if the OP had ever found a solution for this. I have the same issue opening random sites.. seems to click on ads mostly when I'm on a web page and close the lid. I open it back up and a ad is likely to be open on even a new page. It is like someone came in my late 2013 Macbook Pro and just randomly clicked on things in web pages.

I replaced my trackpad, tried several free scanners, created a new user and still had issues. I do suspect some kind of malware but it is not being detected. I have seen many posts like this without a solution. When putting in safe mode the Macbook is so slow it becomes unusable. Not sure if that is normal or has something to do with it. So I have not been able to confirm if it happens in Safe mode. It might not happen every time but it is often enough to be annoying.

My last step will be to format & reinstall which I would rather avoid if possible.

Any thoughts would be greatly appreciated. I'm willing to track this down. Been living with it for a while now. I would love to actually figure out what it is.

If I turn mouse keys on before I close the lid it will not happen. Something controls the trackpad & clicking. That has been my workaround. As soon as I forget to do that it is likely I will experience the issue when I open it back up.

 

[MacInWin]

Try getting DetectX Swift ( https://sqwarq.com/detectx/ ) and run it. If it finds anything, run it again until it is clean. If the problem persists get VirusBarrier Scanner from the Mac App Store and run it. It is slower to finish than DetectX, but it does a deeper scan. And let us know if you've taken all the other steps recommended in this thread. I'm not convinced you need Onyx or Etrecheck, but the other stuff still makes sense to try. We had presumed when the original poster, rgdallo, didn't come back the problem has been resolved.

EDIT: I forgot to welcome you to the forum! Good to have you here.

 

[sdynak]

Try getting DetectX Swift ( https://sqwarq.com/detectx/ ) and run it. If it finds anything, run it again until it is clean. If the problem persists get VirusBarrier Scanner from the Mac App Store and run it. It is slower to finish than DetectX, but it does a deeper scan. And let us know if you've taken all the other steps recommended in this thread. I'm not convinced you need Onyx or Etrecheck, but the other stuff still makes sense to try. We had presumed when the original poster, rgdallo, didn't come back the problem has been resolved.

EDIT: I forgot to welcome you to the forum! Good to have you here.

Thank you for the warm welcome Jake!! It is nice to be here and have genuine folks.

So out of frustration dealing with this so long and the fact my storage was being consumed and as I tried to clean things up it was not making enough progress I just took the dive and went in for the format & reinstall. I had everything backed up to my NAS individually along with a full time machine backup I figured I didn't have much to loose.

I'll see if I still have issues. I read someone else had done a reinstall but maybe they didn't format. If things continue I'll take the actions and keep grooming through.

I will report back so all know if the reformat/install resolved it or not regardless and be a part of the community. Wish I found this a few years ago when this started.

Thanks again.. Stan

 

[MacInWin]

Normally the "nuke and pave" approach like you took will fix just about anything. Restoring can, however, bring back issues but for now we'll call it done. If it returns, let us know and we can try something else.

 

[sdynak]

Normally the "nuke and pave" approach like you took will fix just about anything. Restoring can, however, bring back issues but for now we'll call it done. If it returns, let us know and we can try something else.

We'll see.. still working on reloading everything from scratch.. do not want to do a Time Machine Restore and end up with the same issues. My drive space is much better. I used this Macbook for several years running a business with multiple websites so it was subject to many programs from various authors. Anything could have easily sneaked its way in.

Will report back for sure..

Thanks again

 

[sdynak]

Well, unbelievably even with the nuke and pave approach there are signs of issues still. I tried to just close the lid normally and came back to not only clicked web pages but other open items that are in dock such as a new window opened for "recent items".. This thing has a mind of its own. It is crazy.

I ran DetectX with no results.. I then ran VirusBarrier and it found malware in a old e-mail from 2017 (see screenshot below) I got in my business inbox which was a random message about using someones business name with legal actions blah.. blah.. I am not sure I ever opened the Word attachment. It was labeled agreement.doc and I did a repair on it. For sure I did not open this message after my format & reinstall so I am thinking it is unlikely this was it. I ran the scanner afterward on the entire disk and nothing was found. So that is where I am at.

Will see if it continues.. I really want to figure this one out. It has been seriously annoying more than anything.

At one time it actually succeeded and placed an order through Amazon. I'm not joking. That was probably the worst occurrence with my experience on this.

One other thing is the Macbook will stay warm when the lid is closed which is a good sign that it is active. This is not 100% of the time but near anymore if I don't lock the trackpad. I did also replace my battery just to make sure that was not causing anything as it was slightly swollen. So trackpad & battery are not it and format & reinstall did not resolve. It is a ghost I guess.

I never notice anything strange when the lid is opened. No mouse movements etc. I do notice if I position my cursor in one place then close the lid for a few seconds and reopen it is not in the same position. It seems to happen very quickly after the lid closes.

 

[MacInWin]

That is probably a Windows virus that won't affect the Mac at all. I find those in emails every once in a while, usually from either a spammer or someone who isn't careful at all about where they go or what they click on and are using Windows.

Recent items is a new Dock function that is controllable in System Preferences/Dock & Menu bar. Just remove the tick from the box labelled "Show Recent applications in Dock."

What happens if you don't close the lid? Just leave the lid open and either click on the  in the upper left corner and then "Sleep," or open System Preferences, and then "Power saving" or "Battery" depending on what version of macOS you are running, then set the screen to darken after whatever period of time you want (I use 15 minutes on external power, 5 on battery), then just leave the screen open and walk away. After the set time, the screen will go dark, the machine will go to sleep.

I'm baffled by the idea that a closed application can open on its own and actually execute actions without some external actor in play. Do you have a password on your system and is it active? By that I mean you have NOT turned on Automate Login in System Preferences/Users & Groups under your login? And are you near enough to any neighbor that they might be connecting to your machine remotely by WiFi and/or Bluetooth? I wonder if not using your password on wake up of the Mac, coupled with someone connecting remotely is allowing someone to "play" with your system. Having an active password and NOT using Automatic Login is the way to stymie such mischief. That is a really long shot, but easy to prevent it happening.

 

[sdynak]

That is probably a Windows virus that won't affect the Mac at all. I find those in emails every once in a while, usually from either a spammer or someone who isn't careful at all about where they go or what they click on and are using Windows.

Recent items is a new Dock function that is controllable in System Preferences/Dock & Menu bar. Just remove the tick from the box labelled "Show Recent applications in Dock."

What happens if you don't close the lid? Just leave the lid open and either click on the  in the upper left corner and then "Sleep," or open System Preferences, and then "Power saving" or "Battery" depending on what version of macOS you are running, then set the screen to darken after whatever period of time you want (I use 15 minutes on external power, 5 on battery), then just leave the screen open and walk away. After the set time, the screen will go dark, the machine will go to sleep.

I'm baffled by the idea that a closed application can open on its own and actually execute actions without some external actor in play. Do you have a password on your system and is it active? By that I mean you have NOT turned on Automate Login in System Preferences/Users & Groups under your login? And are you near enough to any neighbor that they might be connecting to your machine remotely by WiFi and/or Bluetooth? I wonder if not using your password on wake up of the Mac, coupled with someone connecting remotely is allowing someone to "play" with your system. Having an active password and NOT using Automatic Login is the way to stymie such mischief. That is a really long shot, but easy to prevent it happening.

The interesting thing is I have the "show recent applications in Dock" disabled but there was a separate finder like window that was opened with them in it. It was not in the dock displaying them.

Yes.. one way around this not happening is leaving the lid open. When I do this nothing happens and the screen will eventually time out. I have it set for 5 min. I never seem to have any issue this way and only after actually closing the lid. I have not actually tried to see if clicking on "sleep" will make a change before closing but I can try that. I have some confidence that if I just leave the lid open it will not happen.

I do not have a PW required for after wake but I do not have automate login on. I think this is what you mean (see below screen shot).

I'm pretty sure it is not my neighbors.. it will happen when I'm the only one around during the day (work from home) and my neighbors rely on me for tech support as they are not savvy in the least bit. For how long this has been going on and how quick it can happen like as soon as I close the lid I come back and something changes... I'm thinking it is unlikely someone is standing by waiting to get it.

 

[MacInWin]

The interesting thing is I have the "show recent applications in Dock" disabled but there was a separate finder like window that was opened with them in it. It was not in the dock displaying them.

Interesting. The "Recents" in Finder on my system shows files, not applications. I have never seen a "Recent" in Finder with applications.

From the other symptoms it sure seems like the system is restarting somehow and all the open programs are reopening. When you close a program, how do you do that? The red "X" does NOT exit most programs, it just pushes it out of view, leaving it running. If the machine sleeps, I think those hidden windows all open up again. Could that be it? The better (and proper) way to shut down an app and not have it running is to click on the app name in the top bar, then "Quit" the application. That actually shuts it down completely, not hidden, not running.

 

[sdynak]

Interesting. The "Recents" in Finder on my system shows files, not applications. I have never seen a "Recent" in Finder with applications.

From the other symptoms it sure seems like the system is restarting somehow and all the open programs are reopening. When you close a program, how do you do that? The red "X" does NOT exit most programs, it just pushes it out of view, leaving it running. If the machine sleeps, I think those hidden windows all open up again. Could that be it? The better (and proper) way to shut down an app and not have it running is to click on the app name in the top bar, then "Quit" the application. That actually shuts it down completely, not hidden, not running.

I have to be honest.. I saw recents and it is very possible it was the recents files in finder. I should have looked at that more carefully before I closed. it. All I knew is the window was open and it was not like that before I closed the lid so it was just a reaction to frustration after having just wiped and reinstalled everything.

I make sure I "Quit" applications I do not want running. I am aware of that and the X does not close it out.

I just picked it up after sitting for at least an hour I suppose and the underneath on the screen side rear was warm. Not by the battery so it is cranking the CPU for sure. But I did not see anything strange that time after opening. Sometimes it just takes seconds and websites are clicked.. new tabs opened in Chrome (had tried Safari also and have similar).

I wish I could see what is going on when the lid closes. It is like something takes control.

Another thing I have noticed that it does not seem to happen when it is not on the power adapter. In the past I had disabled "wake" and "enable power nap" without success.

Will keep trying some things and post results.

 

[MacInWin]

Another thing I have noticed that it does not seem to happen when it is not on the power adapter. In the past I had disabled "wake" and "enable power nap" without success.

So, it only happens when on external power? Are the settings in System Preferences for the two conditions (battery and external power) the same? Do you have any "helper" applications from third party, things like download helpers, video helpers, memory helpers, antivirus or antimalware? What is loaded and started up at login (System Preferences/Users & Groups/your account)?

You might try running Etrecheck to see what else is starting at power up and loading to run. Clearly something is detecting battery vs. external power and doing something.

 

[sdynak]

So, it only happens when on external power? Are the settings in System Preferences for the two conditions (battery and external power) the same? Do you have any "helper" applications from third party, things like download helpers, video helpers, memory helpers, antivirus or antimalware? What is loaded and started up at login (System Preferences/Users & Groups/your account)?

You might try running Etrecheck to see what else is starting at power up and loading to run. Clearly something is detecting battery vs. external power and doing something.

I have not changed the default power settings since I reinstalled other than when on power to turn off the screen sooner. The enable power nap if off on battery and on with power are the differences I see. As mentioned I defiantly had disabled both wake & nap while on power before. I can try again just to be sure.

I have not loaded any antivirus only the checks I did as recommended. Very minimal has been installed after the format.

Noting is set to load at login. This is all very fresh still.

I ran that Etechech once before and the results were confusing. I'll take another look at it.

 

[MacInWin]

Under Power Adapter, put a check in "Prevent computer from sleeping automatically when the display is off." Also disable "Power Nap" option. The first step will keep the CPU awake even when the screen is dark, so the machine won't really go into a sleep mode. That way it won't need to wake up, which is, I think, where the problem occurs. Ditto for Power Nap, which is just a partial sleep mode. The CPU doesn't take much power, so on external power adapter you don't need to let the CPU sleep.

 

[sdynak]

Under Power Adapter, put a check in "Prevent computer from sleeping automatically when the display is off." Also disable "Power Nap" option. The first step will keep the CPU awake even when the screen is dark, so the machine won't really go into a sleep mode. That way it won't need to wake up, which is, I think, where the problem occurs. Ditto for Power Nap, which is just a partial sleep mode. The CPU doesn't take much power, so on external power adapter you don't need to let the CPU sleep.

Gave it a shot.. we'll see. Thanks.

 

[sdynak]

Since the situation has been less noticeable but continues at times I went ahead and installed EtreCheck.. there was only 1 major item noted if I'm using it correctly. The item noted was a "runaway process". I assume it is identified under the "Other Processes". I don't notice anything strange when I look in my Activity Monitor but I wonder how it comes up with over 100%. Is this normal to see over 100% for other processes?

Top Processes Snapshot by CPU:
Process (count) CPU (Source - Location)

Other processes 107.53 % (?)

EtreCheck 7.95 % (App Store)

deleted 3.27 % (Apple)

Google Chrome 1.28 % (Google, Inc.)

NotificationCenter 0.92 % (Apple)

 

[Rod]

A quick hint. If you truly want to know what's running on your computer just press Command + Tab. You will see a line of active apps. While continuing to hold the Command key let go of the Tab key, hover your mouse over one of the apps and press the Q key (still keeping the Command key depressed). This is the same as Command + Q that MacInWin mentioned and apart from Quitting from the Application Menu the only way of completely shutting down most apps.

This does not explain why these "active" apps are performing tasks while the lid is closed.

I suspect it is either a fault or the way the Energy Saver settings are set up. Check if Wake for Network Access is on and Put Hard Disks to Sleep when possible. Note they are different for power adaptor and battery.
My wife's 2018 MBP used to chime for Notifications even when the lid was closed until I turned off the two above options.

 

[sdynak]

A quick hint. If you truly want to know what's running on your computer just press Command + Tab. You will see a line of active apps. While continuing to hold the Command key let go of the Tab key, hover your mouse over one of the apps and press the Q key (still keeping the Command key depressed). This is the same as Command + Q that MacInWin mentioned and apart from Quitting from the Application Menu the only way of completely shutting down most apps.

This does not explain why these "active" apps are performing tasks while the lid is closed.

I suspect it is either a fault or the way the Energy Saver settings are set up. Check if Wake for Network Access is on and Put Hard Disks to Sleep when possible. Note they are different for power adaptor and battery.
My wife's 2018 MBP used to chime for Notifications even when the lid was closed until I turned off the two above options.

Thanks Rod.. I am familiar with the command + tab like windows alt + tab to see what is running. Nothing abnormal has ever shown for an app running that I'm not expecting.

I have played with the power settings before over the years and it had not made a difference. My wife has a similar Macbook hers is just the 13" we got them at the same time. Hers does not have these issues and I never touched my power settings before any of this. They were always default.

From what MAcInWin recommended last below are my current settings. This mainly happens only when on power from what I have noticed. I believe for what you are asking I have them set that way. Changing them did not make a difference in what is happening. I'm pretty confident it is not the power settings themselves but as mentioned I do not seem to have the issue when unplugged. I am willing to keep trying the power settings but I had ruled this out a while back. I am a technical person by way of my education, profession and experience but not so much on the Mac side so appreciate the insight.

 

[MacInWin]

I would turn off the "Put Hard disks to sleep" option. When the Mac wakes up, it will expect the drives to be there, ready to use. If the OS has to wait for the drives to spin up from sleeping, it may decide they have been disconnected and produce a warning about detaching a drive before unmounting it. This applies to spinner drives, obviously, as there is no reason to put an SSD to sleep ever.

 

[sdynak]

I would turn off the "Put Hard disks to sleep" option. When the Mac wakes up, it will expect the drives to be there, ready to use. If the OS has to wait for the drives to spin up from sleeping, it may decide they have been disconnected and produce a warning about detaching a drive before unmounting it. This applies to spinner drives, obviously, as there is no reason to put an SSD to sleep ever.

Thanks.. I do have the SSD option in this unit. So doesn't matter then?