LaunchDaemon Help?

Question

Level 1

9 points

LaunchDaemon Help?

I noticed there is a LaunchDaemon on startup that I don't recognize or can't figure out. It can be seen in System < Library < Launchdaemons. Its called "com.AristotleLookupDaemon.plist". Has anyone seen this or know what it is for? It says it was create & modified about 5 months ago (on the same day) if that helps. Last opened date doesn't exist ( -- ---)

This is the text file that opens:

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.AristotleLookupDaemon</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/com.AristotleLookupDaemon/AristotleLookup</string>

</array>

<key>RunAtLoad</key>

<key>StartInterval</key>

</dict>

</plist>

MacBook Pro 15", macOS 10.13

Posted on Feb 21, 2019 4:29 PM

Reply

Answer 1

etresoft

Level 9

57,074 points

Feb 21, 2019 6:10 PM in response to josh2apple

All I can tell you is that it is adware or malware and does something malicious. I don’t recommend any “cleaner” software. Your antivirus apparently wasn’t adequate to remove it. I suggest MalwareBytes: https://www.malwarebytes.com

Reply

Answer 2

etresoft

Level 9

57,074 points

Feb 21, 2019 4:53 PM in response to josh2apple

It’s adware. You probably don’t want it.

Reply

Answer 3

josh2apple Author

Level 1

9 points

Feb 21, 2019 6:24 PM in response to etresoft

Thanks! Also, there is a folder in the system library called "MessageTracer"..within the folder there is a file "SubmitDiagInfo.default.domains.searchtree". Any idea what that is for?

I deleted the deamon you had advised was adware. I did also download the Malwarebytes & it said my system is OK.

Reply

Answer 4

etresoft

Level 9

57,074 points

Feb 22, 2019 8:43 AM in response to josh2apple

The system folder is (or should be) protected by System Integrity Protection. That would keep any 3rd party software out. I can’t say from from a short phrase like that. There are tens of thousands of system files and probably dozens that might fit that description. If you have specific files in mind at specific paths, those can be verified.

Reply

Answer 5

etresoft

Level 9

57,074 points

Feb 22, 2019 11:51 AM in response to josh2apple

There is some kind of “MessageTracer” in there. But there is no way to tell if you are talking about the system version or not. I can find this one:

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer

which means that one does exist. I’m not going to sit and let it churn for 10 minutes to find all of them.

Reply

Answer 6

josh2apple Author

Level 1

9 points

Feb 22, 2019 12:27 PM in response to etresoft

Thank you for all of the responses. I was referring to a folder that is easily seen/accessed in the library list. It is directly above (near) the folder "Messages".

Below I have copied/pasted a section of a list of details typically found in the directory of a Mac...this was taken from a list online.

If you scroll down and look between libarary/Mail and Library/Message...there is one called Library/MessageTracer. I was just wanting to confirm that IS indeed normal to be there, and not something I should remove. According to this list, it is normal..correct? It shows on my computer as a folder...located in the library section as seen in this link:

https://nektony.com/blog/how-to-get-to-library-on-mac

-/Library/LaunchAgents/

· /Library/LaunchDaemons/

· /Library/Logs/

·/Library/Logs/CrashReporter/

· /Library/Logs/DiagnosticReports/

· /Library/Logs/Xsan/

· /Library/Mail/

·/Library/Mail/Bundles/

· /Library/MessageTracer/ -----THIS ONE

· /Library/Messages/

· /Library/Messages/PlugIns/

· /Library/ModemScripts/

· /Library/OpenDirectory/

·/Library/OpenDirectory/Mappings/

· /Library/OpenDirectory/Modules/

· /Library/OpenDirectory/Templates/

Reply

Answer 7

etresoft

Level 9

57,074 points

Feb 22, 2019 12:57 PM in response to josh2apple

I’m glad I was being a stickler then. Technically, that directory is not under System Integrity Protection. This directory is designed for 3rd party software to use.

However, in this particular case, this MessageTracer file does appear to be from Apple. I have the same directory and the same “SubmitDiagInfo.default.domains.searchtree” file. It’s nothing to worry about.

Reply

Answer 8

josh2apple Author

Level 1

9 points

Feb 21, 2019 5:14 PM in response to etresoft

What exactly does that do and how did I get it? I have CCLeaner and AGV Antivirus.

Reply

Answer 9

josh2apple Author

Level 1

9 points

Feb 22, 2019 9:03 AM in response to etresoft

From what I have read, the MessageTracer folder is part of the Mac library list.. i.e. it is supposed to be there? Just wanted to confirm that it is not junk like in the other instance.

Reply

LaunchDaemon Help?

Similar questions