2

Macbook Pro (Mid 2012) Catalina 10.15.7

My camera came on this morning. It's still on. Never noticed that before. When i googled it, i found a recommendation to use Terminal and the results are below. i don't remember installing any "virtual camera". Although i did install something called QRCapture a few weeks ago to read QRs. Chrome & Zoom are the only other camera authorized apps in SysPrefs-Security&Privacy. Malwarebytes detected nothing.

What is CoreMediaIO?

Why would it be in my Macbook?

Is it possible i accidentally installed a trojan hack?

Why didn't my Little Snitch catch this?

Why would someone want to look at my face?

Can you see my face? Do i need a haircut? ok this is devolving.

Terminal:

tmcdanel@MBP-KEC ~ % lsof | grep "AppleCamera" tmcdanel@MBP-KEC ~ % lsof | grep "iSight" tmcdanel@MBP-KEC ~ % lsof | grep "VDC" Google 450 tmcdanel txt REG 1,7 424176 1152921500312547843 /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/VDC.plugin/Contents/MacOS/VDC avconfere 1735 tmcdanel txt REG 1,7 424176 1152921500312547843 /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/VDC.plugin/Contents/MacOS/VDC tmcdanel@MBP-KEC ~ %

Here is an Activity Monitor screenshot of what is running. When i tried to kill AXVisualSupportAgent the camera did not go off, and it instantly restarted.

Activity Monitor screenshot

Improve this question

1 Answer 1

Reset to default
3

CoreMediaIO is Apple's low-level framework that enables developers to interact with audio/video devices such as for example web cameras.

Usually, developers will use the AVFoundation framework to work with audiovisual data I/O on a Mac. However, it is quite high-level framework, so if a developer requires low-level, direct access for performance reasons, it is possible to "skip" AVFoundation and talk directly to CoreMediaIO.

In either case, the CoreMediaIO framework governs access to the web camera - and the frameworks code will run on your CPU in order to get video data from the camera to your applications.

The CoreMediaIO framework comes with macOS in the standard installation.

The particular file you're referring to (VDC) is responsible for handling USB connected web cameras. The name itself means USB Video Device Class, which is a part of the USB specification that standardises communication with web cameras. This is probably more commonly known as UVC.

The Terminal output you have is unfortunately cropped (i.e. only parts of the process names are actually listed) - but it looks like the processes you have found are probably Google Chrome and avconferenced. The latter is a part of macOS and governs access to audiovisual devices - so this will be used by for example FaceTime, SideCar and other macOS built-in features.

Now, you ask if it is possible that you have installed a trojan hack. It could be possible - depends on what you have actually done ofcourse. But there's nothing in your question that indicates or proves that this is the case.

Little Snitch is used to monitor and control network access. A webcam of this sort (USB) is not considered a network device in that respect, and is in that way completely out of reach of Little Snitch.

I would suggest simply trying to close down some of your running programs to see when the webcam stops being used. Start by ensuring that FaceTime is not running, and look through your Google Chrome tabs for a web site using the camera. Close down Google Chrome and check if that solves it.

Improve this answer
4
  • Thank you for your reply. i completely copied what Terminal belched up, so it was not clipped. i tried it a couple of times & got the same output. i turned off every app's permission for Camera access in Sys Prefs, only 3: Google Chrome, QR Capture, Zoom. i will have to remember to turn it back on when i use Zoom. i suspect QR Capture, an odd internet download of recent, so i'll throw it away but if it has obscure system libraries i'll never find them. But since i restarted, this has not happened again. Probably just some odd OS system glitch cleared up by the restart. Thank you, jksoegaard.
    – Terry McDanel
    Jan 22, 2022 at 1:19
  • You misunderstand - the output was clipped already when it was displayed in the Terminal. It doesn’t have to do with your cut-n-paste. Sounds good that it was fixed
    – jksoegaard
    Jan 22, 2022 at 7:36
  • i don't understand why the response would be clipped? i had hoped. But the camera came on again yesterday evening. i have no clue what triggered it. No applications in System Preferences have permission to access the camera. i installed an app called Oversight, but it was not running in the background when the camera came on, so i don't know if it works. When i closed the laptop and let it sleep for a minute, the camera was off when i opened it. Thanks for your reply, jksoegaard.
    – Terry McDanel
    Jan 23, 2022 at 15:32
  • The response is clipped because the string is longer than what your Terminal width and the options to the command allow. It is perfectly normal - no need to worry about that.
    – jksoegaard
    Jan 23, 2022 at 15:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .