Remove unknown software...System Information app...

Question

Remove unknown software...System Information app...

The System Information app from Apple is a useful tool that summarizes important information about hardware, software and network information on the Mac.

Over time, I have tried a few softwares from outside the AppStore. While I have been largely careful, yet installation of some of those required overriding Gatekeeper security warnings. I have even forgotten the history. Now when I view the system information, I see a few entries from unknown developers, and I am unable to locate the source/ uninstall/ delete those apps/ extensions/ frameworks, because I don't know what they are.

Applications

Q1. I think the Backup System Folders and YouTube app are those I created using Automator. But I don't know what this Cocoa-AppleScript Applet is? Can I delete it?

Frameworks

All Frameworks are located in /System/Library/PrivateFrameworks or /System/Library/Frameworks.

Q2. How do I find out which app created these?

Q3. Is it safe to delete the folder containing these?

Q4. Will they be recreated by the source app after I delete them?

All the 'Extensions' installed are from Apple/ Identified Developers.

All Preference Panes are from Apple alone.

There are no Profiles.

There are no Startup Items according to this report. But that cannot be true since there are a few apps/ services that do startup during boot. I don't know why they don't show up in this list.

I have installed QL Video (https://github.com/Marginal/QLVideo), although I don't think it made any difference to the Finder thumbnails. The other apps I have installed from outside the AppStore are all from Identified Developers.

Q5. Based on the above, can we say my system is clean of any form of malware?

Thanks.

MacBook Pro 13″, macOS 10.15

Posted on Jun 25, 2020 1:43 AM

Reply

Answer 1

Jun 25, 2020 1:54 AM in response to Sridhar Ananthanarayanan

Answering several of your questions at once:

Do not start deleting stuff you don't know!

The two examples you showed are part of the system installation and should just be left alone.

Also: there are other places besides Startup Items (which is hardly used, if ever) where developers install things that start when you start your mac or login to your account.

Instead of telling you about more locations where you might look for this, I advise you to run the diagnostic program Etrecheck and post its report here for us to take a look.

Use the additional text button, as the report is too long to post directly in the message:

And let me tell you this very clearly: so far there is no indication of any real issue with your mac.

That doesn't mean that there is no problem, but please post the report and don't worry. Most of all, never delete stuff unless you are absolutely sure.

Reply

Answer 2

Jun 25, 2020 1:49 AM in response to Sridhar Ananthanarayanan

Q1. Cocoa-AppleScript Applet is a system item. It's normal to have it. Nothing wrong with it.

Reply

Answer 3

Jun 25, 2020 2:13 AM in response to Sridhar Ananthanarayanan

You have to be the judge of that.

The report contains no private information, and it will tell us if you have any system extensions or other items which might be recognized as "bad". It will tell us your mac model, OS version, how much RAM, how much space on your drives. Take a look at the report yourself to see if there is something you are not comfortable sharing.

Reply

Answer 4

Jun 25, 2020 2:39 AM in response to Luis Sequeira1

EtreCheck Report 2020-06-25

Here is the report.

EtreCheck took unusually long time just 'Starting up'. I think it took about 5 minutes just 'starting up' both times I tried running the app. What could be wrong?

I see under Network, Remote login is enabled. Is it necessary to enable it if I access my Mac over SMB/ SFTP from other devices on my local network? I don't want any remote access over the internet.

There is one app - App Cleaner & Uninstaller (Sergiy Savenko) which has a 'Helper' app that seems to be running all the time. I would like to disable it.

The unsigned app from Forklift (auto-update) is not installed on my system. I just have the app as a backup.

The kernel extension is Radio Silence. I think it is still considered a 'Legacy System Extension', yet it doesn't show up in Apple's System Information app. Don't know why.

Thank you for any other observations that require action.

Reply

Answer 5

Jun 25, 2020 2:58 AM in response to Sridhar Ananthanarayanan

Remote login should be enabled if you want to access your mac using ssh or sftp, yes.

If your mac is in an internal network, behind a router, it will have a local IP address and it won't be possible to reach it over the internet unless you do a lot of things to make it happen, so I would not worry about that.

You do not need anything with the "cleaner" in its name... See if it comes with an uninstaller, or consult the developer site for how to uninstall.

The unsigned app from Forklift (auto-update) is not installed on my system. I just have the app as a backup.

I don't know exactly what you mean by this. If it shows up in the report it is probably installed.

I will take a look at the report and will come back shortly

Reply

Answer 6

Jun 25, 2020 3:54 AM in response to Luis Sequeira1

Luis, thank you very much for your time and help.

1. Forklift app isn't in my applications folder. I deleted it. But I have the app file in a different volume. I thought only apps inside the Applications folder can actually run since they are "installed" in the system. Correct me if I am wrong.

2. I do have a couple of app cleaners from Nektony and FreeMacSoft that I use when uninstalling apps because they remove all the preference files and other junk which macOS doesn't remove automatically. These apps are not supposed to be running in the background, unless I launch them.

3. I use multiple devices and I would like to have the ability to connect to them whilst inside my local network. I use SMB or SFTP. I would like to limit this access only within the local network.

4. Radio Silence is the firewall I use to block outgoing connections for apps that should not need internet to work. It is a paid app I installed from outside the AppStore.

5. I actually don't have any problems with my Mac. All apps launch fine and fast. EltreCheck is the only app I found to take so much time just 'starting up'. I don't know why. I rarely use this app.

The only other app that is somewhat slow is the AppStore. The app launches in an instant, but takes anywhere between 7 to 10 seconds to load the Store. I also see that it shows app updates a few days later after they become available. Apart from this, there is no other problem. Downloading apps and updates happen fast and without any problems.

Only recently I had run First Aid from Recovery and all volumes passed the test without errors.

Reply

Answer 7

Jun 25, 2020 2:08 AM in response to Luis Sequeira1

Thank you very much. Is it safe to post the whole report on a public forum?

Reply

Answer 8

Jun 25, 2020 3:30 AM in response to Sridhar Ananthanarayanan

The report says performance is "below average".

This is unusual considering you have 2019 mac.

I don't see any obvious bad actors in there.

I am not familiar with "Radio Silence", but it appears to be a firewall application.

Assuming your mac is in a home network, such a software is not needed; it may be affecting network performance, but I can't say for sure.

All in all, I can't see any indication of malware, which was what brought you here in the first place.

Reply

Remove unknown software...System Information app...

Similar questions