Software Update verifies updates multiple ways. Apple uses encrypted SHA-1 hashes and PGP to verify the downloaded contents, as well as some other stuff they don't disclose for obvious reasons. If you really want to, you can download the updates manually from http://www.apple.com/downloads/macosx/apple/ Note that you will have to sort out exactly what you need and don't need, as many of the updates may not be for your Mac.

Caches are used for various reasons. They don't mean that anything has been downloaded or installed.

The v1.3.1 of Java app is an older version of Java used for compatibility with older java programs. It's recommended that you leave it as it, as moving/editing/deleting it might cause more problems.

The flash player comes bundled with OS X. 'dave' was most likely the developer who was programming it at the time, and he somehow left some file paths with the "/users/dave" in the final released program. Nothing to worry about there wither.

What about the httpd install.log?

I can't remember exactly what that dialog about automatic updates says, but I think you are misinterpreting it.
What the situation regarding updates is that you can select to have them automatically downloaded, and you can select to have the downloaded updates automatically installed. (two different choices there)
Otherwise updates will be looked for at some specified time of the week and Software Update will come up to tell you about them.

um. no. That shows that the httpd directory is empty and that install.log is next in alphabetical order. Which is proper. Nothing wrong there.

hayne, I don't think the settings are incorrect, I think that mazzy is viewing the cache files as downloaded or installed updates.

See the reply and the attachment in this post.

That is not the httpd log. The arrow is pointing down, but because there is no httpd log, nothing is listed there. The install.log is a separate log (not related to httpd) that contains the log from your system install.

I am almost thinking that a fresh install populates the /Library/Caches/com.apple.SoftwareUpdate the first time the application pops open, such as when it prompts you to select your preferences.

Either way I don't see anything at all that confirms there actually are any installed updates. That would be in /Library/Recipts if memory serves.

What exactly in there did you find troublesome?
I don't see anything suspicious there at first glance, but it is rather small to see properly.
Note that for log files, it is better to either copy & paste the text into your replay (instead of showing a screen capture) or attach the log file as a plain text file (.txt or .log) using the Manage Attachments button at the bottom when you reply

Ok, I'm feeling better.....

I didn't find anything troubling in the log, just wasn't sure if it was ok.

Is it ok if, while I've got everyone's attention, I ask about other things in the log files? Then I can lay this to rest, and feel secure once again about having a mac and not a pc.

works for me. :D

Thanks;)

From asl.log (This is something I haven't seen before Many more like these.) Facility user? Facility daemon? Apple employees?
[Time 2008.01.25 19:50:59 UTC] [Facility daemon] [Sender crashdump] [PID 936] [Message crash report written to: /Users/roxy/Library/Logs/CrashReporter/Preview.crash.log] [Level 3] [UID -2] [GID -2] [Host roxys-computer]
[Time 2008.01.25 19:07:27 UTC] [Facility user] [Sender Crash Reporter] [PID 893] [Message For quality control purposes auto-submit is enabled by default for Apple internal users. Apple employees should still file RADARs for bug tracking purposes.] [Level 3] [UID -2] [GID -2] [Host roxys-computer]

From DirectoryService.server.log
2008-01-25 01:26:20 PST - DirectoryService 2.1 (v353.1) starting up...
2008-01-25 01:26:20 PST - Plugin <Configure>, Version <1.7>, processed successfully.
2008-01-25 01:26:20 PST - Plugin <NetInfo>, Version <1.7.4>, processed successfully.
2008-01-25 01:26:20 PST - Plugin <LDAPv3>, Version <1.7.4>, processed successfully.
2008-01-25 01:26:21 PST - Plugin <Search>, Version <1.7>, processed successfully.
2008-01-25 01:26:21 PST - Plugin "Active Directory", Version "1.5.4", is set to load lazily.
2008-01-25 01:26:21 PST - Plugin "AppleTalk", Version "1.3", is set to load lazily.
2008-01-25 01:26:21 PST - Plugin "Bonjour", Version "1.3", loaded successfully.
2008-01-25 01:26:22 PST - Plugin "BSD", Version "1.2.2", is set to load lazily.
2008-01-25 01:26:22 PST - Plugin "PasswordServer", Version "3.1.1", is set to load lazily.
2008-01-25 01:26:22 PST - Plugin "SLP", Version "1.3", is set to load lazily.
2008-01-25 01:26:22 PST - Plugin "SMB", Version "1.3", is set to load lazily.
2008-01-25 01:26:22 PST - Registered node /Configure
2008-01-25 01:26:22 PST - Plug-in Configure state is now active.
2008-01-25 01:26:22 PST - Plug-in Bonjour state is now active.
2008-01-25 01:26:22 PST - Registered node /NetInfo/DefaultLocalNode
2008-01-25 01:26:22 PST - Plug-in NetInfo state is now active.
2008-01-25 01:26:22 PST - Registered node /Search
2008-01-25 01:26:22 PST - Registered node /Search/Contacts
2008-01-25 01:26:22 PST - Registered node /Search/Network
2008-01-25 01:26:22 PST - Plug-in Search state is now active.
2008-01-25 01:26:23 PST - Plug-in LDAPv3 state is now active.
2008-01-25 01:26:24 PST - Network transition occurred.
2008-01-25 01:26:27 PST - Registered Locally Hosted Node /NetInfo/DefaultLocalNode
2008-01-25 01:26:30 PST - Network transition occurred.
2008-01-25 01:26:30 PST - Network transition occurred.
2008-01-25 01:26:30 PST - Network transition occurred.
2008-01-25 03:36:40 CST - Plug-in SLP state is now active.
2008-01-25 03:36:40 CST - Plugin "SLP", Version "1.3", loaded on demand successfully.
2008-01-25 03:36:40 CST - Plug-in SMB state is now active.
2008-01-25 03:36:40 CST - Plugin "SMB", Version "1.3", loaded on demand successfully.
2008-01-25 03:36:40 CST - Plug-in AppleTalk state is now active.
2008-01-25 03:36:40 CST - Plugin "AppleTalk", Version "1.3", loaded

If I don't use or need any of this, why has it loaded "on demand"? or "set to load lazily"? or "active"? I know that this is basic for most people, but I just need to know if it's normal.

cups_error.log (I know this is a normal process but 100 clients?)
I [25/Jan/2008:01:26:28 -0800] Listening to 7f000001:631
I [25/Jan/2008:01:26:28 -0800] Listening to b00f3000:0
I [25/Jan/2008:01:26:28 -0800] Loaded configuration file "/private/etc/cups/cupsd.conf"
I [25/Jan/2008:01:26:28 -0800] Configured for up to 100 clients.
I [25/Jan/2008:01:26:28 -0800] Allowing up to 100 client connections per host.
I [25/Jan/2008:01:26:28 -0800] Full reload is required.
I [25/Jan/2008:01:26:29 -0800] Full reload complete.

system.log.0.gz
Jan 25 01:26:20 localhost kernel[0]: HFS: created HFBT on Untitled
Jan 25 01:26:30 localhost configd[60]: executing /System/Library/SystemConfiguration/Kicker.bundle/Contents/Resources/enable-network

windowserver.log
Jan 25 01:26:23 [89] Server is starting up :eek: (what server?)
Jan 25 01:26:24 [89] CGXPerformInitialDisplayConfiguration
Jan 25 01:26:24 [89] Display 0x1cab4480: MappedDisplay Unit 0; Vendor 0x472 Model 0xad12 S/N 0; online enabled (0,0)[1024 x 768], base addr 0x3008000
Jan 25 01:26:24 [89] Accel caps: 00000001
Jan 25 03:30:13 [89] CGXRestartSessionWorkspace: session workspace exited for session 256 ( on console )

What is blued and why can't I stop it if I've turned bluetooth off?

And last, (my apologies for looking in system folders, but I have to know!)
Why do I have a folder /private/tftpboot/private/tftpboot/ with the last tftpboot being a symlink to my system.

Thanks for all of your help! Y'all have been kind and gracious to someone who's been hacked before, and is suspicious of everything! I know you'll be happy when I'm gone! And I'm very sorry for being such a pain!:o

I assume that "roxys-computer" is the name of your Mac - is that correct?
And that your user name is "roxy" ?

If so, this would appear to merely be a report about a crash of the Preview application.

Yes, I'm Roxy in the real world. Mazzy is my cat.

Yeah the "Preview crashed" part I got. It was the "facility" and "Apple Employee" part I didn't get.........

However, I'm fairly certain Apple doesn't want to employ me.:D

We can all agree there, right!?

Applications write all kinds of stuff to the logs - especially when something is going wrong (e.g. if they crash) and you shouldn't worry about it or even expect to understand it.
These messages are mostly intended for the programmers of those apps - so they can figure out what is going wrong (i.e. for debugging purposes).

Your Mac doesn't seem to be experiencing anything out of the ordinary, so I think you can just go about using it like a normal user. Normal users don't read logs etc - unless something starts to go wrong.

And I'd like to note that it is extremely, extremely, extremely (that's 3 'extremely's!) unlikely that your Mac will get hacked if you don't have any of the sharing services enabled, and if you refrain from installing or running software from untrustworthy sources.

No, sharing is turned off, airport and bluetooth off, though I still can't figure out why blued is running constantly and restarts as soon as I stop it. Airport starts again if I reboot.

I thought I had everything locked down until a couple of monts ago everything went crazy. Every website that came up in search was in Japanese....just all kinds of strange stuff. I guess I panicked!

Thank you for all the help.

Roxy (and Mazzy too - never leave out the cat...)

most of this stuff is there because the system is set up to have the capacity to do all kinds of things that you yourself might never do. so it registers plugins for bluetooth devices and appletalk and bonjour even though you don't use them, because someday you might, and it will be there waiting... think of it like having air conditioning in your car: you may never use it, but it's still there (and yes, you can really goof up your car if you try to tear it out)

loading lazily just means that service doesn't need to be accessed immediately, so it can start up in the background as time permits - the important stuff comes first.

crash reporter sometimes sends things to apple in the background (if it can) just for quality control. it's completely anonymous; no personal info involved.

CUPS is a printing service - if you set your computer up as a print server for other people, you could handle 100 other computers ('clients'). since you probably haven't done that, it's an irrelevant and harmless setting.

HFS is a disk's file system; configd is a background daemon (application without an interface) that helps set up your computer to run.

a window server is not an internet server; it's another daemon that takes care of creating and showing windows on the displays. that whole block is just telling you about what's on your monitor.

I'm not so sure about the private/tftpboot, but I suspect it's has to do with how the root kernel launches the system. anything in /private is system-only - you can really only access it from an administrator account, and even then it's hard to mess with. unless (again) someone has had physical access to your machine while it was logged into an administrator account (and you were off somewhere playing with the cat), it's extremely unlikely that anything in there is a security problem.

did I miss anything?

No, I think you covered it all. I'm going to go ahead and do an update, make a pot of coffee, and get back to the canvas and paint. I'm going to trust that there isn't a monster, or dave, or creepy hacker guy in my machine. (creepy hacker guy might be lurking around outside, but at least he can't get in my Mac!! If he gets in the house, I'll just shoot him! I would REALLY love to! It's legal in Texas!)

I'll sleep better tonight, and so will the cat!

Thanks and goodnight!:)