What is this mystery process: “-i”?
I have a mystery process visible in Activity Monitor, simply called "-i" - don't remember ever seeing this before. Its parent process is launchd, and belongs to root.
- Persists between reboots;
- Sometimes high CPU use.
Can't find any reference to it online anywhere either!
Macos 10.13.6
macos activity-monitor
edited Nov 30 at 23:48
Monomeeth♦
46.2k897140
asked Nov 30 at 22:50
Simbamangu
195210
add a comment |
I have a mystery process visible in Activity Monitor, simply called "-i" - don't remember ever seeing this before. Its parent process is launchd, and belongs to root.
- Persists between reboots;
- Sometimes high CPU use.
Can't find any reference to it online anywhere either!
Macos 10.13.6
macos activity-monitor
edited Nov 30 at 23:48
Monomeeth♦
46.2k897140
asked Nov 30 at 22:50
Simbamangu
195210
And when you press "quit"...?
– Mateus Ribeiro
Nov 30 at 23:36
what does it say when you runSample processon it ?
– Buscar웃
Dec 1 at 0:02
3
In Terminal runsudo /Applications/Utilities/Activity Monitor.app/Contents/MacOS/Activity Monitorto launch Activity Monitor with more privileges, then get info on the process and look at the "Open Files and Ports" for a hint.
– Redarm
Dec 1 at 0:16
The 'open files and ports' option is not something I've tried, works as well as thelsofcommand.
– Simbamangu
Dec 1 at 1:04
add a comment |
I have a mystery process visible in Activity Monitor, simply called "-i" - don't remember ever seeing this before. Its parent process is launchd, and belongs to root.
- Persists between reboots;
- Sometimes high CPU use.
Can't find any reference to it online anywhere either!
Macos 10.13.6
macos activity-monitor
edited Nov 30 at 23:48
Monomeeth♦
46.2k897140
asked Nov 30 at 22:50
Simbamangu
195210
I have a mystery process visible in Activity Monitor, simply called "-i" - don't remember ever seeing this before. Its parent process is launchd, and belongs to root.
- Persists between reboots;
- Sometimes high CPU use.
Can't find any reference to it online anywhere either!
Macos 10.13.6
macos activity-monitor
macos activity-monitor
edited Nov 30 at 23:48
Monomeeth♦
46.2k897140
asked Nov 30 at 22:50
Simbamangu
195210
edited Nov 30 at 23:48
Monomeeth♦
46.2k897140
asked Nov 30 at 22:50
Simbamangu
195210
edited Nov 30 at 23:48
Monomeeth♦
46.2k897140
edited Nov 30 at 23:48
Monomeeth♦
46.2k897140
edited Nov 30 at 23:48
Monomeeth♦
46.2k897140
46.2k897140
asked Nov 30 at 22:50
Simbamangu
195210
asked Nov 30 at 22:50
Simbamangu
195210
asked Nov 30 at 22:50
Simbamangu
195210
195210
And when you press "quit"...?
– Mateus Ribeiro
Nov 30 at 23:36
what does it say when you runSample processon it ?
– Buscar웃
Dec 1 at 0:02
3
In Terminal runsudo /Applications/Utilities/Activity Monitor.app/Contents/MacOS/Activity Monitorto launch Activity Monitor with more privileges, then get info on the process and look at the "Open Files and Ports" for a hint.
– Redarm
Dec 1 at 0:16
The 'open files and ports' option is not something I've tried, works as well as thelsofcommand.
– Simbamangu
Dec 1 at 1:04
add a comment |
And when you press "quit"...?
– Mateus Ribeiro
Nov 30 at 23:36
what does it say when you runSample processon it ?
– Buscar웃
Dec 1 at 0:02
3
In Terminal runsudo /Applications/Utilities/Activity Monitor.app/Contents/MacOS/Activity Monitorto launch Activity Monitor with more privileges, then get info on the process and look at the "Open Files and Ports" for a hint.
– Redarm
Dec 1 at 0:16
The 'open files and ports' option is not something I've tried, works as well as thelsofcommand.
– Simbamangu
Dec 1 at 1:04
And when you press "quit"...?
– Mateus Ribeiro
Nov 30 at 23:36
And when you press "quit"...?
– Mateus Ribeiro
Nov 30 at 23:36
what does it say when you run
Sample process on it ?– Buscar웃
Dec 1 at 0:02
what does it say when you run
Sample process on it ?– Buscar웃
Dec 1 at 0:02
3
3
In Terminal run
sudo /Applications/Utilities/Activity Monitor.app/Contents/MacOS/Activity Monitor to launch Activity Monitor with more privileges, then get info on the process and look at the "Open Files and Ports" for a hint.– Redarm
Dec 1 at 0:16
In Terminal run
sudo /Applications/Utilities/Activity Monitor.app/Contents/MacOS/Activity Monitor to launch Activity Monitor with more privileges, then get info on the process and look at the "Open Files and Ports" for a hint.– Redarm
Dec 1 at 0:16
The 'open files and ports' option is not something I've tried, works as well as the
lsof command.– Simbamangu
Dec 1 at 1:04
The 'open files and ports' option is not something I've tried, works as well as the
lsof command.– Simbamangu
Dec 1 at 1:04
add a comment |
1 Answer
1
active
oldest
votes
The best way to find out is to note the Process ID (PID) listed in Activity Monitor for the mysterious "-i" process.
Then open Terminal.app and execute the following command:
sudo lsof -p 1234
where 1234 should be replaced with the PID number you've found in Activity Monitor.
The lsof command will give you a list of files that are opened by the mysterious process. The first line of output will tell you the "cwd", which is the current working directory of the process. It is probably not going to tell you much.
The second line of output is usually a "txt" file descriptor that will tell you the name of the executable (i.e. the program) that is running in the program.
This should tell you which program is running as "-i".
answered Dec 1 at 0:17
jksoegaard
15.4k1642
2
This worked - turns out it's Malwarebytes RTProtectionDaemon, which must have changed in recent update as I've not seen that before.lsofis a great tool, thanks for the tip.
– Simbamangu
Dec 1 at 1:02
Wow. You'd really think that malware prevention software—of all things—would give their processes intelligent names. Hopefully this is a bug of some sort.
– Wowfunhappy
Dec 1 at 1:46
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "118"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fapple.stackexchange.com%2fquestions%2f344392%2fwhat-is-this-mystery-process-i%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The best way to find out is to note the Process ID (PID) listed in Activity Monitor for the mysterious "-i" process.
Then open Terminal.app and execute the following command:
sudo lsof -p 1234
where 1234 should be replaced with the PID number you've found in Activity Monitor.
The lsof command will give you a list of files that are opened by the mysterious process. The first line of output will tell you the "cwd", which is the current working directory of the process. It is probably not going to tell you much.
The second line of output is usually a "txt" file descriptor that will tell you the name of the executable (i.e. the program) that is running in the program.
This should tell you which program is running as "-i".
answered Dec 1 at 0:17
jksoegaard
15.4k1642
2
This worked - turns out it's Malwarebytes RTProtectionDaemon, which must have changed in recent update as I've not seen that before.lsofis a great tool, thanks for the tip.
– Simbamangu
Dec 1 at 1:02
Wow. You'd really think that malware prevention software—of all things—would give their processes intelligent names. Hopefully this is a bug of some sort.
– Wowfunhappy
Dec 1 at 1:46
add a comment |
The best way to find out is to note the Process ID (PID) listed in Activity Monitor for the mysterious "-i" process.
Then open Terminal.app and execute the following command:
sudo lsof -p 1234
where 1234 should be replaced with the PID number you've found in Activity Monitor.
The lsof command will give you a list of files that are opened by the mysterious process. The first line of output will tell you the "cwd", which is the current working directory of the process. It is probably not going to tell you much.
The second line of output is usually a "txt" file descriptor that will tell you the name of the executable (i.e. the program) that is running in the program.
This should tell you which program is running as "-i".
answered Dec 1 at 0:17
jksoegaard
15.4k1642
2
This worked - turns out it's Malwarebytes RTProtectionDaemon, which must have changed in recent update as I've not seen that before.lsofis a great tool, thanks for the tip.
– Simbamangu
Dec 1 at 1:02
Wow. You'd really think that malware prevention software—of all things—would give their processes intelligent names. Hopefully this is a bug of some sort.
– Wowfunhappy
Dec 1 at 1:46
add a comment |
The best way to find out is to note the Process ID (PID) listed in Activity Monitor for the mysterious "-i" process.
Then open Terminal.app and execute the following command:
sudo lsof -p 1234
where 1234 should be replaced with the PID number you've found in Activity Monitor.
The lsof command will give you a list of files that are opened by the mysterious process. The first line of output will tell you the "cwd", which is the current working directory of the process. It is probably not going to tell you much.
The second line of output is usually a "txt" file descriptor that will tell you the name of the executable (i.e. the program) that is running in the program.
This should tell you which program is running as "-i".
answered Dec 1 at 0:17
jksoegaard
15.4k1642
The best way to find out is to note the Process ID (PID) listed in Activity Monitor for the mysterious "-i" process.
Then open Terminal.app and execute the following command:
sudo lsof -p 1234
where 1234 should be replaced with the PID number you've found in Activity Monitor.
The lsof command will give you a list of files that are opened by the mysterious process. The first line of output will tell you the "cwd", which is the current working directory of the process. It is probably not going to tell you much.
The second line of output is usually a "txt" file descriptor that will tell you the name of the executable (i.e. the program) that is running in the program.
This should tell you which program is running as "-i".
answered Dec 1 at 0:17
jksoegaard
15.4k1642
answered Dec 1 at 0:17
jksoegaard
15.4k1642
answered Dec 1 at 0:17
jksoegaard
15.4k1642
answered Dec 1 at 0:17
jksoegaard
15.4k1642
15.4k1642
2
This worked - turns out it's Malwarebytes RTProtectionDaemon, which must have changed in recent update as I've not seen that before.lsofis a great tool, thanks for the tip.
– Simbamangu
Dec 1 at 1:02
Wow. You'd really think that malware prevention software—of all things—would give their processes intelligent names. Hopefully this is a bug of some sort.
– Wowfunhappy
Dec 1 at 1:46
add a comment |
2
This worked - turns out it's Malwarebytes RTProtectionDaemon, which must have changed in recent update as I've not seen that before.lsofis a great tool, thanks for the tip.
– Simbamangu
Dec 1 at 1:02
Wow. You'd really think that malware prevention software—of all things—would give their processes intelligent names. Hopefully this is a bug of some sort.
– Wowfunhappy
Dec 1 at 1:46
2
2
This worked - turns out it's Malwarebytes RTProtectionDaemon, which must have changed in recent update as I've not seen that before.
lsof is a great tool, thanks for the tip.– Simbamangu
Dec 1 at 1:02
This worked - turns out it's Malwarebytes RTProtectionDaemon, which must have changed in recent update as I've not seen that before.
lsof is a great tool, thanks for the tip.– Simbamangu
Dec 1 at 1:02
Wow. You'd really think that malware prevention software—of all things—would give their processes intelligent names. Hopefully this is a bug of some sort.
– Wowfunhappy
Dec 1 at 1:46
Wow. You'd really think that malware prevention software—of all things—would give their processes intelligent names. Hopefully this is a bug of some sort.
– Wowfunhappy
Dec 1 at 1:46
add a comment |
Thanks for contributing an answer to Ask Different!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fapple.stackexchange.com%2fquestions%2f344392%2fwhat-is-this-mystery-process-i%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
And when you press "quit"...?
– Mateus Ribeiro
Nov 30 at 23:36
what does it say when you run
Sample processon it ?– Buscar웃
Dec 1 at 0:02
3
In Terminal run
sudo /Applications/Utilities/Activity Monitor.app/Contents/MacOS/Activity Monitorto launch Activity Monitor with more privileges, then get info on the process and look at the "Open Files and Ports" for a hint.– Redarm
Dec 1 at 0:16
The 'open files and ports' option is not something I've tried, works as well as the
lsofcommand.– Simbamangu
Dec 1 at 1:04