My home network has connected: an iMac (recently updated from Monterey to Sequoia), a Windows machine, and a fairly old HP LaserJet 2100 TN. Before the update, both computers could print to the HP reliably. After the update to Sequoia, printing does not work anymore for the iMac. The printer is accessible via ping and traceroute, but when I try to print to it from the iMac, **System Settings > Printers & Scanners** says that the printer queue is idle, but when I open the printer queue, it says the "printer is not responding". I tried to reinstall the printer. I removed the current printer definition and used "add printer" to install a new one. Since the list of printers in the **Defaults** tab was empty, I clicked on the **IP** tab and installed instead the "generic PCL driver" using the IP address of the printer. If I remember correctly, I also had to do this after buying the iMac (which was shipped with Monterey). After reinstalling the printer drivers, **System Settings > Printers & Scanners** again says that the printer is idle, but if I click on **Printer Queue**, I now immediately see "Printer offline". It is interesting to note that printing works fine from the Windows machine, but **only** if the iMac is turned off (or in sleep mode) by the time the HP is turned on. Once the iMac runs for a while (or tries to print something), the Windows machine can't print to the HP either. This makes me suspect whether the problem could also be due to some bad settings in my router, though I don't know what to look for. In case it is important: My router has an IP address 10.1.1.11, the printer has 10.1.1.20 (fixed address assigned). For my iMac the command ifconfig -a | grep broadcast displays:

inet 10.1.1.23 netmask 0xffffff00 broadcast 10.1.1.255
inet 10.1.1.21 netmask 0xffffff00 broadcast 10.1.1.255

which all look reasonable to me. Does anybody have a suggestion on what I could do to narrow down the problem? **UPDATE** As requested by _LincDavis_, I'm providing the output of lpstat -t $ lpstat -t scheduler is running system default destination: _10_1_1_20 device for _10_1_1_20: ipp://10.1.1.20/ device for EPSON_WF_2860_Series: dnssd://EPSON%20WF-2860%20Series._ipp._tcp.local./?uuid=cfe92100-67c4-11d4-a45f-389d9227c894 _10_1_1_20 accepting requests since Sun Jun 22 12:28:57 2025 EPSON_WF_2860_Series accepting requests since Sun Jun 22 12:13:57 2025 printer _10_1_1_20 is idle. enabled since Sun Jun 22 12:28:57 2025 printer EPSON_WF_2860_Series is idle. enabled since Sun Jun 22 12:13:57 2025 Explanation: The HP printer I'm talking about, is the 10.1.1.20. The EPSON WF 2860 is another printer on the network I have added. It is a printer/scanner. Printing to it does not work either (I get the message _Communication error_ when looking at the print queue), but scanning from the Epson works. From the Windows computer on the network, printing and scanning with the Epson works. I hadn't included the information about the Epson, since I thought that it unnecessarily confuses the matter. As for installing the Epson, I did not use the "add printer" dialogue built into MacOS, but a setup program which I downloaded from the Epson site. **UPDATE** Also as requested by @LincDavis, I'm providing the output of

/var/log/cups/*

: ==> /var/log/cups/access_log /var/log/cups/error_log . <== I just wonder what information we can get from this, except what we already know, i.e. that the printer does not react. **UPDATE** Here is the content of my /etc/cups/ppd directory: -rw-r--r-- 1 root _lp 1417134 Nov 1 2024 EPSON_WF_2860_Series.ppd -rw-r--r-- 1 root _lp 1417134 Nov 11 2023 EPSON_WF_2860_Series.ppd.O -rw-r--r-- 1 root _lp 53365 Jun 22 12:28 _10_1_1_20.ppd **UPDATE** **UPDATE** I managed to install a dedicated printer driver downloaded from the HP site. Now I don't get anymore an error message in Red, but still can't print. See this screenshot of the Printer Queue:

Whenever I'm logged in as a certain user and trigger a shutdown or restart, I get prompted to enable FileVault. - I have searched everywhere to find the hook that causes this prompt, but I can't find it. - I've searched all the LaunchDaemon and LaunchAgent directories I can find. - I've reviewed the output of launchctl find. - I've done other things in the past as well but I don't remember them all. - I have upgraded my computer and transferred my user account multiple times since this started happening. It seems to stick to my user account. - I believe this might have come from Symantec Endpoint Encryption that was installed by my employer many years ago. But I've also tried all the uninstaller techniques I can find for that. It appears after all the desktop stuff has gone away. Any ideas for where else I can look for a hook that might trigger this? Update: **FileVault** is not currently enabled on the disk and I do not want to enable it. ![Screenshot of the FileVault dialog box saying 'To add this user to FileVault, enter the password for 'cquenell.'' ][1]

I've always had LuLu on my MacBook to block unwanted internet access, and recently realized that every minute or two, curl is being used by an unknown process to connect to a remote server. I'm denying every outgoing request to the server but the fact that in the background there's a process trying to make these calls is scratching my head… Going deeper in Activity monitor I followed a road of strange processes: sudo with parent osascript, with parent bash, the last one mentioning a hidden file in my user folder named .agent found in the tab "Open Files and Ports": The .agent file contains a script:

while true; do
    osascript <

It mentions another hidden file named .helper, but that's a binary and I can't see what it does. --- **Update**: Deleting the following infected files stopped the loop, but my Mac should be considered compromised nevertheless.

/Library/LaunchDaemons/com.finder.helper.plist
~/.agent
~/.helper

From what I've seen: /Library/LaunchDaemons/com.finder.helper.plist launches ~/.agent which in turn calls the script ~/.helper which actually contains the malicious payload. 5 days ago I did a batch install of a lot of 3D software and plugins; the creation date of the malicious files confirm that I got this during the various permissions for the installations. Being a batch install I can't really point to the single infected installer. Luckily I manually deny every unwanted connection to the internet, but it took me a while to notice the continuous silent curl request. These are the other "Open Files and Ports" from these processes: