[Turnpike]

Had a strange problem today. Safari became the frontmost application of its own accord. A page started to load (I think I saw the words "Safari" and "pop" near each other in the window title) and immediately closed. I do have PithHelmet installed (an older version, from when it was still free) so it may have closed the window if it read it as an ad page.

I thought this was a bit strange, to say the least. Running top-u showed a process "SecurityAg" several times towards the top of the list, although none of them were taking significant CPU time... nothing else was, either. The topmost SecurityAg was at 1.5-2.1% CPU.

Looked deeper, it is called SecurityAgent (when not truncated as the top output is).

ps -aux | grep SecurityAgent | wc -l
produced the output 21. One of these was the grep, so there are 20 of these running on my machine. tried without the wc and verified that indeed, all but one are for SecurityAgent, the other was the grep. All are owned by root. EDIT: I do not run as root, and haven't logged in as root ever. I don't think I had sudo'd since the last restart, either.

I'm on 10.3.6. All but the latest security update installed (I'm going to go do that right now). Applications running at the time were Adium, Safari, Direct Connect (connect to one network, the campus network), QuickTime, Preview, and VLC. I'm suspicious of Direct Connect. It "feels" like a seedy program... low production values, et cetera, and I know filesharing apps have a history of having spyware... quitting Direct Connect didn't kill the processes, however.

1) Is this abnormal? I've never seen it, but I don't check top or ps very often... max once every two days or something.
2) can I safely sudo killall SecurityAgent?
3) Should I be worried?
4) I think it might be Direct Connect... should I keep running DC to try and reproduce the problem, or should I avoid it like the plague?


Thanks all...

[Chuckit]

SecurityAgent is part of the system. It's located at /System/Library/CoreServices/SecurityAgent.app/Contents/MacOS/SecurityAgent. You can see Apple's explanation if you're wondering what it does. However, it's not normal to have 20 instances of it running, or any more than one instance in fact.

That said, I strongly doubt there's spyware involved. For one thing, it's running as root, and I'd hope you wouldn't give root access to any app you distrust so much. Besides that, the only program for OS X that has ever been known to install spyware is LimeWire, and it was far less devious than to impersonate an OS-level process. I'd recommend doing the fsck/repair permissions dance, since it sounds like something's funny with your system.

[warpmoon]

It's Direct Connect, if it's the "official" version, I know from past experience.

I'll add that it's responsible for opening up that window in your browser. I do not know if it has any link to the 20 extra SecurityAgent processes you have running.

[Turnpike]

okay, thanks guys. I've yet to see anything strange since then. I restarted (that killed all the extra SecurityAgent processes) and applied the latest security update.

I also haven't run Direct Connect (yes, it is the official client) since then. I'll probably avoid it unless I need it for some reason until a different program comes along.

It doesn't look like Security Agent could do any harm... so I'm not too worried, just annoyed.


Thanks again.

[SoClose]

Originally posted by Chuckit:
Besides that, the only program for OS X that has ever been known to install spyware is LimeWire, and it was far less devious than to impersonate an OS-level process. I'd recommend doing the fsck/repair permissions dance, since it sounds like something's funny with your system.

Errr...really? LimeWire on Mac OS X installs spyware? Do you have any details? I haven't found any evidence of this (i.e.: spyware as a separate process), but haven't looked exhaustively.

[Turnpike]

It used to, a while ago... it installed something called LimeShop which I believe directed you to their Amazon affiliate link or something similar... it no longer does.