How should I diagnose a macintosh laptop running OS X Lion 10.7.5 automatically booting at 12:00:09 sharp every night?

Question

Using the "Console" app within OS X and viewing the "syslog" file I can see the user shutdown their laptop (it was a HALT operation) around 10:22PM. For some reason, 9 seconds after midnight (12:00:09) the machine would boot up on its own. I looked through the log files to see if it was doing something suspicious. I saw the launch process followed by an mDnsResponder process, followed by a process trying to connect to the wifi network, followed by iCal, MobileMe, processes trying to perform a synchronization. Nothing really looked like it was doing something bad.

But why would the computer be starting up on it's own every night at exactly the same time?

Are there any good apps out there I can use to see if the machine has been hacked?

Is there a way I can temporarily "harden" the machine to see if the behavior disappears?

What are good command line utilities I can use to gather all / any information?

This question might be better suited on superuser.com – Hammo Jun 21 '13 at 02:20 — Hammo, Jun 21 '13 at 02:20

score 3 · Accepted Answer · answered Jun 21 '13 at 02:20

I saw the launch process followed by an mDnsResponder process, followed by a process trying to connect to the wifi network, followed by iCal, MobileMe, processes trying to perform a synchronization.

There you have it. The machine was probably calling home to update the various applications whose data reside in Apple's cloud somewhere. I really doubt it's anything malicious.

If you are really worried, start up wireshark and monitor the network traffic during that time.

But none of this should happen if the computer is turned off. Why would it boot up like this? What if I don't want it to boot up automatically? — user1068636, Jun 21 '13 at 03:36

score 1 · Answer 2 · answered Aug 15 '14 at 12:02

Macs can be scheduled to power on at a given time; pmset -g sched lists these times, though they're also in the file /Library/Preferences/SystemConfiguration/com.apple.AutoWake.plist

You can cancel these startups/wakeups using pmset schedule cancel <details>, or the Energy Saver preference pane under "Schedule...".

I agree with Terry's answer, that the likely root cause is that the Mac is signed up for MobileMe. It has its own preference panel.

How should I diagnose a macintosh laptop running OS X Lion 10.7.5 automatically booting at 12:00:09 sharp every night?

2 Answers2