1

Working here on problems arising from IBM Trusteer Rapport security software.

Problem: Their daemon rooksd has 60,000 ports open; mac slowed to a crawl.

Question: Is the daemon rapportd part of Trusteer or is it an Apple MacOS daemon? Other comments here say it's Apple. But, IBM Trusteer support says it's theirs.

|improve this question|||||
  • My daemon is /usr/libexec/rapportd and is signed by Apple. Based on that, I think I can be sure it's Apple, and not IBM Trusteer, right? – ColSebastianMoran Jun 20 '19 at 15:44
  • Malware and even some legitimate software (I’ll leave you to classify IBM’s offering) often uses the same name to confuse people. Can you specify a specific path or process so we know which daemon / process you are observing? An edit to the question will help us help you. – bmike♦ Jun 20 '19 at 17:00
2

rapportd, or at least /usr/libexec/rapportd, is an Apple macOS daemon. From the man page:

Daemon that enables Phone Call Handoff and other communication features between Apple devices.

By examining RapportUninstaller.sh, the expected locations for Trusteer Rapport's rapportd are:

  • /Library/Rapport/bin/rapportd.app/Contents/MacOS/rapportd
  • /Library/Rapport/bin/rapportd
|improve this answer|||||
  • First, big thanks for clear answer from grg. – ColSebastianMoran Jun 26 '19 at 23:31
  • In case it helps anyone else, be aware that IBM Trusteer continues to insist that the daemon /usr/libexec/rapportd belongs to Trusteer Rapport (even though it's signed by Apple). I'll believe grg and not Trusteer support. Disappointing that they are giving the wrong answer. – ColSebastianMoran Jun 26 '19 at 23:32
-2

I believe the correct answer is: /usr/libexec/rapportd, is an Apple macOS daemon.

|improve this answer|||||

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .