7

Browsing my launch daemons/agents with LaunchControl today, I noticed this funny-looking user agent with the label "com.appstart.AppStart":

"/Users/jstrout/Library/Application Support/AppPolicy/AppStart" -i -c 216107 -isn 5CE1E809-EF23-41E1-B157-B429F09DCCFF

Looking at the executable, it is a 517264-byte executable in group wheel.

I've googled all over, but find very few mentions of this file, and none of them informative. Is this malware?

Improve this question

1 Answer 1

Reset to default
4

Seems fishy enough to investigate. It's either some custom software like java applet or other software that isn't the normal CodeSigned or app store installation.

  1. It's in the wrong location for apps to be typically
  2. Uses generic sounding names
  3. You're clearly not aware what it is or why it's there.

If you have Time Machine - you can do two things. Make a backup and then delete the file. Next, you can look in spotlight on the TimeMachine to see when it showed up and perhaps correlate it to other app installs. It could be a side app that does metrics or app updates - but I'd probably get rid of it or see what other files it has open or monitor where its talking with a tool like LittleSnitch. Malware Bytes anti malware is also very good and reputable product to scan for known adware, malware, scamware, etc...

Improve this answer
2
  • 2
    It's been there as long as my Time Machine backups go (last September), so no help there. Thank you for the recommendation of Malwarebytes Anti-Malware. It identified this file as part of "Adware.Spigot" (along with half a dozen other files).
    – Joe Strout
    Commented Jul 19, 2017 at 15:40
  • @JoeStrout Ouch. Back up all of your files immediately, then comb through them manually on a throwaway machine / OS. Tinfoil-hattery is better than data loss. See Information Security for more details.
    – wizzwizz4
    Commented Jul 19, 2017 at 20:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .