Once in a while a program nags me out of the blue to update. I seldom yield since I always suspect a trojan. For example today I get a persistent:
I launch Activity Monitor
and sure enough, there is indeed a process with that name.
Yet after the last upgrade (to El Capitan) I didn't bother installing either Google Chrome or Google Earth. I confirm this in my /Applications
folder.
But I do see the folder ~/Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin
, presumably left from a previous installation. I am puzzled. After looking at my login tasks
I see that Google Earth should not be running at login.
What launched it, and, more importantly, how do I confirm that such a request from an "Update Helper
" is not a trojan?
Update
The answers and comments indicate that what I was asking is not clear. There are four questions/problems that need to be solved in this context. In order of increasing difficulty they are:
- I no longer use Chrome or Earth. How do I remove the Google Software Updater.
- How do I remove any one particular software updater if I no longer use, nor have installed since the last major OS X upgrade, that software?
- Some random window pops up and asks me to enter my password. It's bad enough if my user files are contaminated, but it's a completely different problem if I give a suspect program superuser privileges and take a chance in contaminating the system. How do I confirm which piece of software is popping the window? (And how could something be running without being present in the login tasks? I don't see any root cron jobs. Where else should I be looking?)
- There is a problem with OS X major release upgrades. I upgrade in-place (i.e., without formatting my drive). Both ~/Library and /Library are swelling
(
sudo du -h -s /Library
reports 3.5G andsudo du -h -s ~/Library
reports 4.7G). How do I purge the unnecessary folders?
I meant to ask Q3, but I'll gladly settle for an answer to Q1.
In your answers and comments several people have recommended that this discussion will solve Q1. While that article is indeed very helpful, I don't have the file
~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/\
Resources/GoogleSoftwareUpdateAgent.app/Contents/Resources/install.py
The nearest file I have is
~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/\
Resources/GoogleSoftwareUpdateAgent.app/Contents/Resources/ksinstall
I'm tempted to just wipe out the folder
rm -fr ~/Library/Google/GoogleSoftwareUpdate/
Suggestions?
defaults write com.google.Keystone.Agent checkInterval 0
should at the very least disable the updater until a solution is found to remove it completely. – I0_ol Aug 20 '16 at 14:58install.py
file has been replaced withksinstall
. – I0_ol Aug 20 '16 at 15:03~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/Resources/ksinstall --uninstall
does indeed purge the subtree rooted at~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/
. Afterwards runningdefaults read com.google.Keystone.Agent
replies withDomain com.google.Keystone.Agent does not exist
. All is well. Would you care to summarize an answer for reference? – Calaf Aug 20 '16 at 15:21