10

Once in a while a program nags me out of the blue to update. I seldom yield since I always suspect a trojan. For example today I get a persistent:

Google Earth Update Helper wants to make changes. Type your password to allow this.

I launch Activity Monitor and sure enough, there is indeed a process with that name.

Activity Monitor

Yet after the last upgrade (to El Capitan) I didn't bother installing either Google Chrome or Google Earth. I confirm this in my /Applications folder.

But I do see the folder ~/Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin, presumably left from a previous installation. I am puzzled. After looking at my login tasks

Login tasks

I see that Google Earth should not be running at login.

What launched it, and, more importantly, how do I confirm that such a request from an "Update Helper" is not a trojan?

Update

The answers and comments indicate that what I was asking is not clear. There are four questions/problems that need to be solved in this context. In order of increasing difficulty they are:

  1. I no longer use Chrome or Earth. How do I remove the Google Software Updater.
  2. How do I remove any one particular software updater if I no longer use, nor have installed since the last major OS X upgrade, that software?
  3. Some random window pops up and asks me to enter my password. It's bad enough if my user files are contaminated, but it's a completely different problem if I give a suspect program superuser privileges and take a chance in contaminating the system. How do I confirm which piece of software is popping the window? (And how could something be running without being present in the login tasks? I don't see any root cron jobs. Where else should I be looking?)
  4. There is a problem with OS X major release upgrades. I upgrade in-place (i.e., without formatting my drive). Both ~/Library and /Library are swelling (sudo du -h -s /Library reports 3.5G and sudo du -h -s ~/Library reports 4.7G). How do I purge the unnecessary folders?

I meant to ask Q3, but I'll gladly settle for an answer to Q1.

In your answers and comments several people have recommended that this discussion will solve Q1. While that article is indeed very helpful, I don't have the file

~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/\
Resources/GoogleSoftwareUpdateAgent.app/Contents/Resources/install.py

The nearest file I have is

~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/\
Resources/GoogleSoftwareUpdateAgent.app/Contents/Resources/ksinstall

I'm tempted to just wipe out the folder

rm -fr ~/Library/Google/GoogleSoftwareUpdate/

Suggestions?

|improve this question
  • Not installing Google Earth after the last update is really not the same thing as having thoroughly uninstalled it. See applehelpwriter.com/2014/07/13/… as there's too much to precis here. – Tetsujin Aug 20 '16 at 7:01
  • This may not be a final solution but as per the article mentioned, running defaults write com.google.Keystone.Agent checkInterval 0 should at the very least disable the updater until a solution is found to remove it completely. – I0_ol Aug 20 '16 at 14:58
  • If you read the discussion completely you will find in the comments section one person wrote that the install.py file has been replaced with ksinstall. – I0_ol Aug 20 '16 at 15:03
  • @user556068 You're absolutely right. I've run this line and 0 seems to be behaving indeed as 'never'. Still, it would be nice to take this chance and get rid of the files leftover by Chrome/Earth in ~/Library. – Calaf Aug 20 '16 at 15:08
  • @user556068 Thanks. I had skipped the comments. I'm happy to report that running ~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/Resources/ksinstall --uninstall does indeed purge the subtree rooted at ~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/. Afterwards running defaults read com.google.Keystone.Agent replies with Domain com.google.Keystone.Agent does not exist. All is well. Would you care to summarize an answer for reference? – Calaf Aug 20 '16 at 15:21
2

As others have mentioned, this discussion has some good tips for accomplishing this.

I have not tested any of these solutions as I still frequently use Google Chrome and do not want to delete these files myself.

If your Library contains a install.py file:

python ~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/Resources/install.py --uninstall

or:

python /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/Resources/install.py --uninstall

If your Library instead contains a ksinstall file:

~/Library/Google/GoogleSoftwareUpdate/Google‌​SoftwareUpdate.bundl‌​e/Contents/R‌​esources/GoogleS‌​oftwareUpdateAgent.a‌​pp/Contents/‌​Resources/ksinst‌​all --uninstall

or:

/Library/Google/GoogleSoftwareUpdate/Google‌​SoftwareUpdate.bundl‌​e/Contents/R‌​esources/GoogleS‌​oftwareUpdateAgent.a‌​pp/Contents/‌​Resources/ksinst‌​all --uninstall

Test if it worked by running defaults read com.google.Keystone.Agent. If it worked you should see Domain com.google.Keystone.Agent does not exist.

Alternatively you can also disable the updater without removing it completely by running:

defaults write com.google.Keystone.Agent checkInterval 0. The 0 essentially tells the updater to never check for updates.

|improve this answer
1

Problem solved! Check this link out. It uses Terminal to stop the auto updating that is coming directly from Google! I did this about an hour or so ago and the updater never came back. This is for Mac, though!

http://applehelpwriter.com/2014/07/13/how-to-remove-googles-secret-update-software-from-your-mac/

|improve this answer
  • Welcome to Ask Different. While the link you provided is a good resource, it's better to post the relevant parts as part of your answer since links often times go stale making your answer unusable. – Allan Aug 20 '16 at 10:06
-2

I just had the same thing start happening. Just found this:

https://arstechnica.com/civis/viewtopic.php?f=19&t=1325327

May help explain. Seems it's a Google update error?

|improve this answer
  • 1
    Welcome to Ask Different! While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. – Tetsujin Aug 20 '16 at 7:01

You must log in to answer this question.

protected by Community♦ Aug 20 '16 at 7:54

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .