1

My client suspects the imklaunchagent damages his computer. I did some research but found two explanations. One is Apple's system file and the other is virus. Which one is true?

Apple System File?

claim 1

man imklaunchagent" in Terminal.app says:

imklaunchagent is automatically invoked to launch input methods that are selected via direct user inter- action. It is not intended to be invoked via other means and must not be terminated. imklaunchagent monitors abnormal behavior and will disallow an input method from launching if it repeatedly terminates unexpect- edly within a short timespan.

(Reference: https://discussions.apple.com/thread/251183015)

claim 2

Do you happen to write in, say, Chinese or Japanese? I think the process you are mentioning is part of Apple's Input Method Kit framework ( http://developer.apple.com/releasenotes/Cocoa/RN-InputMethodKit/index.html), which is used to support languages that use complex scripts. The program itself is located in: /System/Library/Frameworks/InputMethodKit.framework/Versions/A/Resources/imklaun chagent (Reference: https://discussions.apple.com/thread/1463920)

claim 3 (see answer, not the question)

It's a standard macOS process. If you ever google a process name & all you get are 'malware removal sites trying to sell you something'… think twice about why. If the threat was real, the make-a-quick-buck sites would be far far down the list, well below real issues faced by real people.

The process is inside a protected area, in the System folder on the System partition. You'd have to try very, very hard to overwrite it with a malicious component - including rebooting to Recovery & manually disabling SIP. macOS simply will not let a random process anywhere near that area, even with admin permission.

(Reference: https://superuser.com/questions/1578763/how-do-i-remove-the-imklaunchagent-malware)

Virus?

(Reference: https://sensorstechforum.com/imklaunchagent-mac-remove/)

2
  • 3
    "Virus" site, compete & utter hogwash, absolute snake-oil. One of a million pages with a random name filled in depending on your search term, with some very generic 'how to remove an application' on a Mac utterly irrelevant to the actual issue searched; followed by "if this doesn't work, buy our software". That's precisely what 'claim 3' warns you about. Scam sellers, preying on gullible users.
    – Tetsujin
    Sep 11, 2020 at 7:14
  • The very first question that should be asked when someone suspects a file being malicious is "why do they think it's malicious?" When people self diagnose. whether it's tech or it's medicine, they see a symptom and immediately jump to the most unlikely and extreme diagnosis.
    – Allan
    Oct 11, 2020 at 5:40

1 Answer 1

1

I think my research already answers the question. Just to let my client feel safe and make sure the result is correct. I will keep this thread for other users.

1
  • The whole point of this site is to see what questions other people have asked, and what the answers are. It's not just for you! Of course you should keep this thread for others!
    – benwiggy
    Oct 11, 2020 at 10:40

Not the answer you're looking for? Browse other questions tagged .