Removing unsigned files

Question

Level 1

6 points

Removing unsigned files

Hi

Just bought the new Macbook Air and transferred my old files via TM. I ran an etrecheck and found 4 unsigned and launched files - I'm no expert on this and need advice - should I just remove them? One of them says "Executable file is not accessible without Full Drive Access" - what does this mean exactly?

Should I and if so, how, should I allow full drive access to use Etrecheck?

Should I remove the three 32 bit apps (and how do I find them?)

Is there anything else I should remove?

Much obliged for your time.

Etrecheck

MacBook Air 13", macOS 10.15

Posted on May 21, 2020 4:27 AM

Reply

Answer 1

Top-ranking reply

Axel Foley

Level 10

149,724 points

May 21, 2020 11:44 PM in response to brendanxx

To allow full disc access -

Open System Preferences ➔ Security & Privacy. Locate and choose FULL DISC ACCESS found in the list on the left. Locate Etrecheck in the right window and place a check mark next to it.

You have a 2020 MacBook Air and you are running macOS Catalina. You will not be able to run any 32-Bit apps from this point on.

To find 32 bit software on your MacBook Air-

Choose Apple menu  > About This Mac, then click the System Report button.
Select Legacy Software in the sidebar.
Then check the list of apps on the right. Those are your 32-Bit apps. You can then find them and delete them if you like.

Axel F.

Reply

Answer 2

brendanxx Author

Level 1

6 points

May 22, 2020 1:54 AM in response to Axel Foley

Hi Alex,

Re Full Disc Access, I ticked all the boxes but it still said about not having full access so I still don't know whether to remove the file. I guess as it's listed under minor problems I'll just leave it. And I might as well leave the others as well.

Under Legacy Software it says there isn't any. On my old macbook 2011 under the apps section in system info it said which were 32 bit so I think I'll just check them on my old machine.

I just did another etrecheck and there was a file that could be cleaned - it's /Users/***/App_22F3A0D6-54C2-49FD-BD20-53538C0399FA-8494-000004DED1BE3FFE/Tapufind.app/Contents/MacOS/Tapufind

I would delete it but can't find it - where would I look?

Anyway - many thanks for your time and trouble.

Keep safe

Brendan

Reply

Answer 3

etresoft

Level 9

51,412 points

May 22, 2020 3:59 AM in response to brendanxx

Without Full Drive Access, the Mac App Store version of EtreCheck cannot check the digital signature of files in your home directory. And Apple makes Full Drive Access difficult to find and use in the Mac App Store. All of those blogs on the internet telling you how to enable Full Disk Access are wrong. They don’t apply to Mac App Store apps. You have to start the process in EtreCheck itself. Go to EtreCheck > Preferences > Privacy > Allow Full Access to the startup drive. There will be two steps you have to do. You may have already completed one.

But it is all a moot point. You don’t need a digital signature to tell that tapufind is adware. Go ahead and remove it.

Reply