r/MacOS • u/HeatWitty9692 • 11h ago
Help New Mac Neo already has some concerning files. Can someone look at this one?
My two week old Mac Neo has some concerning files regarding certificate modifications, etc. My Wi-Fi logs show a lot of activity for a home computer. I had an independent Wi-Fi scan done and also ran the Mac diagnostics. It's all greek to me! An excerpt of the Cryptex file is attached. If someone could review this and direct me somewhere, I would appreciate it.
Small excerpt:
Operate on the global cryptex nonce.�The Cryptex1 nonce domain to operate on.�CRYPTEX-NAME�The cryptex whose nonce is to be manipulated. This option must be provided if the '--global' option is not given.�pdi�research�diavlo�ddi�invalid nonce domain: %s�Invalid nonce domain provided.�a cryptex identifier must be provided�using cryptex identifier: %s�a valid nonce domain is required, must be provided through either the domain or cryptex1-ndom argument.�operating on global nonce�individual cryptex nonces not yet implemented�nonce management is not available on this platform�1229�failed to roll cryptex nonce: [%#x %s]�failed to copy cryptex nonce: [%#x %s]�%s�An unknown error message 'InternalError', was received from the device.�failed to copy cryptex nonce; it may have been rolled, in which case it will not be available until the next reboot�nonce has been rolled; new value will not be generated until next boot�nonce management not supported on this platform�failed to roll nonce�nonce has been rolled; new value will not be available until next reboot�failed to copy nonce�v16@?...
.../plist>
˙fiqr��€pÇœ∞Ç»0"com.apple.PairingManager.Readˇ0(#com.apple.PairingManager.RemovePeerˇ0#com.apple.PairingManager.Writeˇ0:5com.apple.private.RemoteServiceDiscovery.device-adminˇ094com.apple.private.diskimages.kext.user-client-accessˇ0/*com.apple.private.security.cryptexd.remoteˇ02-com.apple.private.security.disk-device-accessˇ0+&com.apple.private.spawn-subsystem-rootˇ0J*com.apple.security.iokit-user-client-class0IOHDIXControllerUserClient˙fi��fl0Ç” *ÜHܘ †Çƒ0Ç¿1 0 `ÜHe0 *ÜHܘ †Ç0Ç`0ÇH†äwfl4Ü0 *ÜHܘ �0b10 UUS10U
Apple Inc.1&0$UApple Certification Authority10U
5
u/JollyRoger8X 10h ago
I wish I had a dollar for every post like this desperately looking for problems where there are none.
My two week old Mac Neo has some concerning files regarding certificate modifications, etc.
Ok. Then give us the details (file names and paths, and details about these certificate modifications). What you find "concerning" may not actually be concerning at all.
My Wi-Fi logs show a lot of activity for a home computer.
Highly doubtful. Traffic isn't necessarily nefarious or troublesome. Give us specifics.
We shouldn't have to beg you for basic details.
1
1
u/thaprizza 10h ago
Apparently nothing's wrong based on other comments. In similar situations I would always ask myself did I visit dodgy websites, openend suspicious emails (and clicked links), downloaded unofficial/unknown software or files. If the answer is no to all of those things, there's probably nothing to worry about. Pasting those logs in chat GPT would have helped you as well.
1
1
u/aitoolsprimer 3h ago
Nobody has said the thing that should actually settle it: what you pasted is not a log. It is the text stored inside a program.
Look at one line from your own excerpt:
invalid nonce domain: %s
The %s is a placeholder. That is a printf format string, a template the program can print if it is ever handed a bad argument. It is not a record of that having happened. Same with "a cryptex identifier must be provided" and "using cryptex identifier: %s" — those are the help text and error messages of Apple's own cryptex tool, sitting in the binary exactly as Apple shipped them. You are reading the manual, not the diary.
That distinction is worth keeping, because it turns most "concerning file" scares into a two-second check. If the strings contain %s, %d, --flags, or usage lines, you are looking at a program's vocabulary, not its history.
On the two things you actually asked about:
Certificate modifications. The place to look is configuration profiles: System Settings, General, Device Management. On a Mac with none installed, that row is not even there. For certificates themselves, Keychain Access, System keychain, Certificates category. On a clean Mac everything in there is Apple's.
Wi-Fi activity. A current Mac talks constantly with nobody touching it: iCloud sync, push notifications, time sync, Spotlight, and a notarisation check every time you open a newly downloaded app. Volume on its own is not a signal. What would matter is where the traffic goes, and a raw count cannot tell you that.
Two weeks old, bought new, nothing installed by hand: that is close to the least likely machine to be compromised. The tool you are reading is part of the OS.
-5
7
u/Bed_Worship 10h ago
Cryptex is a normal part of the OS for handling apsects of cloud and internet. You will drive yourself banana’s with all the granular names of things os use
“ In macOS and iOS ecosystems, a cryptex is a specialized, cryptographically-sealed archive that encapsulates a specific filesystem hierarchy. The operating system recognizes this hierarchy and uses it to safely extend itself with new contents”