2

I have a process on my computer which keeps logging to the system.

May  2 19:50:06 laptop com.apple.xpc.launchd[1] (com.coconut-flavour.coconutBattery-Helper[23430]): Could not find and/or execute program specified by service: 155: Refusing to execute/trust quarantined program/file: com.coconut-flavour.coconutBattery-Helper

I cannot figure out where the process is located.

What I have tried:

sudo launchctl list | grep com.coc

sudo find / -iname com.coconut-flavour.coconutBattery-Helper

I have also tried sampling and finding the process in the launchd service in activity monitor.

It does not seem to exist. Anyone know what could be going on?

  • 1
    You might wanna give this a try. I've used it to diagnose weird little problems on my Mac before and it's always worked well. etrecheck.com. It's a free download. Of course it's understandable if you're hesitant to download something. But it's recommended by all the high level forum users at discussions.apple.com. – I0_ol May 3 '17 at 4:17
  • 1
    Did you try the find with a shorter part of the name and wildcards as well (*coconut*)? – nohillside May 3 '17 at 5:18
  • @I0_ol - etrecheck is an interesting tool. not sure if it fixes this issue, but I like it. – Dobler May 4 '17 at 6:09
  • @patrix - good suggestion. it found alot of stuff. – Dobler May 4 '17 at 6:11
4

Forgive my absence and untimely response. Okay, let's take this to the next level.

Let's attempt to locate either coconutBattery or Sparkle, a dependent, apparently. Do you find a 'coconutBattery.app' in /Applications, or any similar app?

sudo find /Applications -iname "*coconut*" -print    
sudo find /Applications -iname "*sparkle*" -print

Is there a relevant package receipt in the package utility?

sudo pkgutil --pkgs | grep -i coconut
sudo pkgutil --pkgs | grep -i sparkle

A brute method to find plists, preference files:

sudo grep -l -i "coconut" -r /System/Library/
sudo grep -l -i "sparkle" -r /System/Library/
sudo grep -l -i "coconut" -r /Library/
sudo grep -l -i "sparkle" -r /Library/

sudo grep -l -i "sparkle" -r /private/var/
sudo grep -l -i "sparkle" -r /private/etc/
sudo grep -l -i "coconut" -r /private/var/
sudo grep -l -i "coconut" -r /private/etc/

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Interesting situation.

First, let us determine in what user-context the service is running: login user, or root. I suspect that the service might be running in the login user context, which would explain why you will not find it by running 'launchctl list' as root ( via sudo ). A quick check:

launchctl list | grep -i "com.coco"

Avoid prepending 'sudo' to the launchctl command.

Also, the process id is reported in the syslog messages -- found within the block brackets [ ].

com.coconut-flavour.coconutBattery-Helper[23430]

The PID is 23430, in that example. I suggest using a ps like this:

ps -wwwAxo pid,ppid,state,%mem,%cpu,command | grep -i coco

Or grep the PID you discover from the syslog like this:

ps -wwwAxo pid,ppid,state,%mem,%cpu,command | grep 23430

If my hunch is correct, and it is under your login user's context that the service runs, then locate the offending plist in something like:

/Users/[your login user's short name]/Library/LaunchAgents

A quick-and-dirty method:

grep -r -i "coco" ~/Library/LaunchAgents/

This should identify the offending sneak. If not, please let me know and we will then take the hunt to the next level.

  • well i still can't find it. I've already looked in those locations. Whats the next level? – Dobler May 4 '17 at 20:21
  • I might have laughed harder, were the morphology of path more properly, comically expressed as something akin to ../~/Library/LaunchDaemons or even ~/Library/LaunchDaemons/../../... Indeed, the next level... – Francis from ResponseBase Jul 1 '17 at 2:04
2

You may want to try the LaunchControl utility. It's free and will show all launchdaemons/agents, what they do, and let you disable/enable. Very handy.

http://www.soma-zone.com/LaunchControl/

  • doesn't seem to be compatible with sierra – Dobler May 4 '17 at 20:22
  • I am currently running it on Sierra. – Hefewe1zen May 4 '17 at 21:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .