1

Asking on behalf of a child who doesn't remember if/when some application was updated and required a restart to complete the installation.

OSX 10.8.5 , MacBook Pro. Here's what happens: when rebooting, a dialog window comes up with the "package" icon and asks "Continue with Install?" and one must select either 'yes' or 'abort'.

If 'yes' is selected, then a process owned by the user runs forever, incidentally consuming up a lot of RAM. Whether 'yes' or 'abort' is selected, the same dialog comes up on the next reboot.

In Activity Monitor, the process is just called "Installer."

Things we know were not initiated: any system upgrade.

My offspring vaguely remembers starting to update "some app" which was later deleted from the machine. Assuming that's the case, this installer appears to be hung trying to get to files that don't exist.

So, in any case, is there some file I can delete that will stop the installer from starting up on reboot? If there is something I can do to provide more info on what/where this Installer app is, let me know and I"ll post it up.

  • and you checked the User - Log in items in syst pref. In the Activity Monitor you can find who, by clicking on the Info icon, and new window will show how is asking. – Ruskes Jan 21 '15 at 19:08
  • I'm in the process of trying out the two answers provided so far. Will update with results "soon." – Carl Witthoft Jan 22 '15 at 0:51
1

Besides the Login Items (Open the Users & Groups pane of System Preferences), try this.

In Terminal, type

ls ~/Library/LaunchAgents

You will see your "personal" launch agents.

To see all the currently loaded agents, type this:

launchctl list

If you can identify the one you don't want, use the unload option:

launchctl unload ~/Library/LaunchAgents/whateverItIsYouWantToUnload
0

My suggestion would be to run an application called Etrecheck and post the results either in your original question, or in a gist here and then update the question with a link to the gist. This could be a malware infection. The output from Etrecheck might help to confirm this. It is very suspicious to me that something is claiming to be an "Installer" but not telling you what it is installing.

Alternatively you can use Activity Monitor to identify what is launching Installer. Within Activity Monitor select the Installer process, then click the Info button (or hit the and I keys) to bring up the Inspector window for that process. If you click on "Open Files and Ports" tab it will tell you where Installer is running from. The first entry on the list should be the location of the actual executable file. So you could kill the process and then go to that location and delete or move the application to another location. Note that in the screenshot below /Users/alistair/Downloads/EtreCheck.app/Contents/MacOS/EtreCheck is the process but /Users/alistair/Downloads/EtreCheck.app is the application bundle you would find within Finder. If you still aren't sure what the Installer is, giving us the full path to the executable in a comment might help us identify it if it is something malicious.

Example of Activity Monitor Inspector

0

Don't run the EtreCheck. It is almost certainly malware. What can be done to stop "EtreCheck" malware?

To add to the other person's answer checking your Launch Agents is a good idea but their recomendation would only check for launch agents started by the active user's user name and overlook those that are listed under the root user/by the system or any other user. Typing sudo will show you the System's launch agents and well for the rest of the random "users" you have you can try using "sudo launchctl asusuer 502 launchctl list" where 502 would be the UID of the another user. "dscl -raw localhost -readall /Local/Default/Users" will show you all the unique id's available. Activity Monitor will show you all of the other user names that currently have a process but to see all of the not loaded plists you'd need to use launchctl.

Know this is ancient history but wanted to mention those 2 items.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .