2

I'm new to mac os and Apple products in general, this is my first experience with it. While using my macbook pro for the first time, I saw that I have a "Confer" app which I didn't install, I tried to remove it but it fails because it's running.

I tried killing it from terminal with kill -9 and kill -15 but it just get a new pid. I also found the plist file but I cannot edit it to disable from restarting. Using launchctl to unload it has no result either.

My questions are: how did this end up in my machine? what is it and how can I remove it.

UPDATE:

Scooping around I found that the package is actually com.carbonblack.defense. Following @francis-from-responsebase instructions the associated files with that package are:

pkgutil --verbose --only-files --files com.carbonblack.defense
 Files from 'com.carbonblack.defense' on '/':
    Confer.app/ConferPerf.app/Contents/Frameworks/libpython2.7.dylib
    Confer.app/ConferPerf.app/Contents/Info.plist
    Confer.app/ConferPerf.app/Contents/MacOS/ConferPerf
    Confer.app/ConferPerf.app/Contents/MacOS/perf_info
    Confer.app/ConferPerf.app/Contents/MacOS/python
    Confer.app/ConferPerf.app/Contents/MacOS/rtt_info
    Confer.app/ConferPerf.app/Contents/PkgInfo
    Confer.app/ConferPerf.app/Contents/Resources/ConferPerf.py
    Confer.app/ConferPerf.app/Contents/Resources/__boot__.py
    Confer.app/ConferPerf.app/Contents/Resources/__error__.sh
    Confer.app/ConferPerf.app/Contents/Resources/common.pyc
    Confer.app/ConferPerf.app/Contents/Resources/include/python2.7/pyconfig.h
    Confer.app/ConferPerf.app/Contents/Resources/iotop_runner.pyc
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/MacOS.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/Nav.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_AE.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_Ctl.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_Dlg.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_Evt.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_File.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_Menu.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_Qd.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_Res.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_Win.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_codecs_cn.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_codecs_hk.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_codecs_iso2022.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_codecs_jp.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_codecs_kr.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_codecs_tw.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_collections.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_ctypes.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_functools.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_hashlib.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_heapq.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_io.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_json.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_locale.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_multibytecodec.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_random.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_scproxy.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_socket.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_ssl.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_struct.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/array.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/binascii.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/bz2.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/cPickle.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/cStringIO.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/datetime.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/fcntl.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/gestalt.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/grp.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/itertools.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/math.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/operator.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/parser.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/pyexpat.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/resource.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/select.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/strop.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/termios.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/time.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/unicodedata.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/zlib.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/site-packages.zip
    Confer.app/ConferPerf.app/Contents/Resources/nettop_runner.pyc
    Confer.app/ConferPerf.app/Contents/Resources/perf_info.py
    Confer.app/ConferPerf.app/Contents/Resources/perf_info.pyc
    Confer.app/ConferPerf.app/Contents/Resources/performance_data.pyc
    Confer.app/ConferPerf.app/Contents/Resources/process_data.pyc
    Confer.app/ConferPerf.app/Contents/Resources/round_trip_time.pyc
    Confer.app/ConferPerf.app/Contents/Resources/rtt_info.py
    Confer.app/ConferPerf.app/Contents/Resources/rtt_info.pyc
    Confer.app/ConferPerf.app/Contents/Resources/setup_perf.pyc
    Confer.app/ConferPerf.app/Contents/Resources/site.pyc
    Confer.app/ConferPerf.app/Contents/Resources/top_runner.pyc
    Confer.app/ConferPerf.app/Contents/_CodeSignature/CodeResources
    Confer.app/Contents/Info.plist
    Confer.app/Contents/MacOS/CbDefense
    Confer.app/Contents/MacOS/UnInstaller
    Confer.app/Contents/MacOS/UpgradeHelper
    Confer.app/Contents/MacOS/repmgr
    Confer.app/Contents/PkgInfo
    Confer.app/Contents/Resources/Base.lproj/MainMenu.nib
    Confer.app/Contents/Resources/CBD_Large_Logo120dpi.png
    Confer.app/Contents/Resources/CBD_Large_Logo144dpi.png
    Confer.app/Contents/Resources/CBD_Large_Logo192dpi.png
    Confer.app/Contents/Resources/CBD_Large_Logo96dpi.png
    Confer.app/Contents/Resources/CBD_Small_Logo120dpi.png
    Confer.app/Contents/Resources/CBD_Small_Logo144dpi.png
    Confer.app/Contents/Resources/CBD_Small_Logo192dpi.png
    Confer.app/Contents/Resources/CBD_Small_Logo96dpi.png
    Confer.app/Contents/Resources/Info.plist
    Confer.app/Contents/Resources/Raleway-Bold.ttf
    Confer.app/Contents/Resources/Raleway-Light.ttf
    Confer.app/Contents/Resources/Raleway-Medium.ttf
    Confer.app/Contents/Resources/Raleway-SemiBold.ttf
    Confer.app/Contents/Resources/about.css
    Confer.app/Contents/Resources/about.html
    Confer.app/Contents/Resources/cbd.icns
    Confer.app/Contents/Resources/cbd_dock_square.icns
    Confer.app/Contents/Resources/cbd_grey.icns
    Confer.app/Contents/Resources/common.css
    Confer.app/Contents/Resources/popup.css
    Confer.app/Contents/Resources/popup.html
    Confer.app/Contents/Resources/toggler.css
    Confer.app/Contents/Resources/ui-dialog.html
    Confer.app/Contents/Resources/ui-dialog_main.css
    Confer.app/Contents/Resources/ui_logic.tis
    Confer.app/Contents/Resources/vlist.tis
    Confer.app/Contents/Resources/vlist_threats.css
    Confer.app/Contents/Resources/wnd_chrome.css
    Confer.app/Contents/_CodeSignature/CodeResources
    Confer.app/cfg_reg.ini
    Confer.app/cloud.pem
    Confer.app/confer.ini
    Confer.app/db_whi
    Confer.app/eula.txt
    Confer.app/licenses.txt
    Confer.app/uninstall
    Confer.app/version
    Confer.app/yara.rule
  • Did you buy this computer second hand? – JMY1000 Nov 22 '17 at 3:02
  • Yes, a few days old. The app was not installed when I got it though, I checked all the installed apps, everything was apple apps. – jrsall92 Nov 22 '17 at 9:37
  • 2
    As with any second hand machine, I'd recommend just doing a clean installation. Just because it seems like everything is OK doesn't mean there's something you didn't detect. – JMY1000 Nov 22 '17 at 21:23
  • That's true, but I don't have a way to connect a flash drive to boot from yet. As far as I know it required for a clean install even on a mac, no? – jrsall92 Nov 23 '17 at 22:08
  • If your computer is fairly recent, you can use Internet Recovery. Press Option-Command-R or Shift-Option-Command-R at startup. – JMY1000 Nov 23 '17 at 22:15
1

First thing I would determine is the CONTEXT the process is being launched in — either your user or system (root). Pull up a user shell by launching Terminal.

launchctl list | grep -i confer 

Assuming the running process’ name is Confer, this should determine if it is being launched under user context. If no output, then we need to look at the system context.

sudo -s 

Type your password to initiate a root shell.

launchctl list | grep -i Confer

If no output, then let me know — we’ll have to look at legacy startup items and verify that there is no kernel extension component. We will also need to check the verboten directories used by launchd in /System for a renegade install.

We will then hunt down the location of the file which causes Confer to launch, and then remove it from bootstrapped items and from user items launched at login. If you wish to really remove this thing properly, then we will employ the package utility to delete every darned file that it might have reported to the installer via a package receipt.

You can see a list of files confer is using while it is running by:

opensnoop -n Confer

Or

lsof | grep -i confer

Lemme know how that all works,

F.

  • hi, thanks for the reply. the result of the first command is: '68 0 com.confer.sensor.daemon'. 'lsof' gave a list of.... I don't know what. keep in mind that while I'm familiar with linux, I'm less than a week in macos. Meaning I don't even know where to go from here in terms of how to use the package manager... I didn't even there was. – jrsall92 Nov 23 '17 at 20:37
  • No worries, amigo. I’ll walk you through the steps. It looks like confer is being run under the user context, then. Quick and dirty way to disable it: open a finder window, and hold down COMMAND KEY ( has the apple icon ) and the SHIFT KEY and the G KEY. This should open a sub window which asks where you want to GO in terms of the file system. You can also get this sub window from one of the pull down menus for Finder — i.e. ‘File’, ‘Edit’, ‘View’, etc. Type in : ~/Library/LaunchDaemons and look for a file, most likely called com.confer.sensor.daemon.plist and move it or delete it (cont) – Francis from ResponseBase Nov 24 '17 at 7:49
  • (Cont). If there is no file there, hold down the three keys mentioned above and type ~/Library/LaunchAgents and look for the same and remove it or move it out of this folder. Reboot. A better way: open a root shell, and type pkgutil —packages | grep -i confer. If anything is output, then have the package manager list the installed files with pkgutil —verbose —only-files —files (NAME OF PACKAGE REPORTED BY PREVIOUS COMMAND OUTPUT). HALT THERE AND DUMP THE LIST OF FILES HERE AND I WILL TELL YOU WHAT TO TYPE TO ERASE SAFELY THE CONFER INSTALLATION. – Francis from ResponseBase Nov 24 '17 at 8:04
  • I edited my original answer. – jrsall92 Nov 24 '17 at 13:26
  • Okay, this looks easy, assuming everything related was installed by this package alone. What I don’t see is the plist used by launchd. This likely is not the only package therefore. I recommend running the uninstaller located in /Applications/Confer.app/Contents/MacOS/UnInstaller. There appears also a Confer.app/uninstall. Run that as well. Then search for related packages by name: pkgutil —packages | grep -I carbonblack. Then check launchd for the com.confer.sensor.daemon and shut it down if so: launchctl remove com.confer.sensor.daemon ; launchctl disable com.confer.sensor.daemon – Francis from ResponseBase Nov 25 '17 at 5:33
1

I was able to uninstall the Confer app from safe mode. That's the good new I want to share first.

Coming to the app, not sure what exactly it does. Tried opening it and there was no response. Checked on google and learnt it was an app to record all our activities on screen not sure it may have captured from our camera too :( I was really concerned of this app and started to dig. Not too much time it took to uninstall the app. I checked on this website and the way of deleting was too much technical. I am not much familiar with Linux/AiX commands much of windows guy so I contacted the apple support. They gave few suggestions by killing the app from activity monitor and moving the app to trash but nothing worked. Then they suggested to restart in safe mode and follow the same process. Bingoooo, it worked.

Additionally I had Appcleaner app which cleared all the associated files along with it. So if you want to uninstall the app in a quicker way then go to safe mode, kill the process from activity monitor and move the app to appcleaner app and it will do the rest. Hope I was useful :)

1

Confer is related to Carbon Black Protection, an enterprise security solution. It is relatively difficult to uninstall because somehow it seems to come back and haunt you. More details at https://www.jamf.com/jamf-nation/discussions/28321/script-to-remove-carbon-black-protection-from-active-computer

  • Yowsers. The line between securing your OS and the things these “security” tools need to break / bend / pry into to surveil and report on people seems to be the same sort of code and implementation as really nasty malware. Great link and discussion and connecting the dots. They intentionally don’t name the process after the product which might show you how proud they are of their brand. – bmike Mar 9 at 19:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .