Backservice.app using lots of energy - no idea what it is (after having followed guides to remove it) - is it a virus??

Hi community,


So I keep getting notifications (when I click on my battery icon) that Backservice.app is using lots of energy (see image below).


However when I open Activity Monitor it shows Backservice as greyed out, and it's been like that for a long time.


I have tried to get to the root of it, following guides (e.g. this) but I can't track down any errant .plist files!


I do run a windows partition set up via bootcamp, is it possible it's that? Or is it more likely a virus?


I do run Intego antivirus software on my mac, but it's never flagged anything to remove the backservice, which as you can see, persists.


I'm a bit worried that it is a virus though, but I'm a tad stuck. Any advice would be very welcome.


Many thanks,


Christian




MacBook Pro 15″, macOS 13.0

Posted on Jan 11, 2023 9:05 AM

Reply
Question marked as Top-ranking reply

Posted on Jan 11, 2023 5:14 PM

You should be able to get more information/details by selecting the process in Activity Monitor and right-clicking it (or one of the icons on the toolbar).


Uninstall the anti-virus software by following the developer's instructions. Anti-virus apps, cleaning/optimizer apps, and third party security software are not needed on a Mac. These types of apps usually cause more problems than they solve, plus they impact system performance. macOS already has great built-in security especially when users also practice safe computing habits as outlined in this article written by a respected forum contributor:

Effective defenses against malware and other threats - Apple Community


Now download and use MalwareBytes to see if it will identify & remove "Backservice" since a quick search reveals this is a browser hijacker. MalwareBytes is the exception to the above rule about not using anti-virus software (every rule seems to have an exception). The reason is MalwareBytes is less intrusive than any other anti-virus app and it is more familiar with macOS malware & adware than other solutions. After running MalwareBytes to remove the malware/adware, there is no reason to keep it...either select the "uninstall" option (on the app's "Help" menu), or at least turn off MalwareByte's real-time scanning protection.


If you still have a problem, then run EtreCheck and post the report here using the "Additional Text" icon which looks like a piece of paper. This report will provide information which will help us analyze your Mac and show what software is configured to run at boot & login.




4 replies
Question marked as Top-ranking reply

Jan 11, 2023 5:14 PM in response to Shiny@UCL

You should be able to get more information/details by selecting the process in Activity Monitor and right-clicking it (or one of the icons on the toolbar).


Uninstall the anti-virus software by following the developer's instructions. Anti-virus apps, cleaning/optimizer apps, and third party security software are not needed on a Mac. These types of apps usually cause more problems than they solve, plus they impact system performance. macOS already has great built-in security especially when users also practice safe computing habits as outlined in this article written by a respected forum contributor:

Effective defenses against malware and other threats - Apple Community


Now download and use MalwareBytes to see if it will identify & remove "Backservice" since a quick search reveals this is a browser hijacker. MalwareBytes is the exception to the above rule about not using anti-virus software (every rule seems to have an exception). The reason is MalwareBytes is less intrusive than any other anti-virus app and it is more familiar with macOS malware & adware than other solutions. After running MalwareBytes to remove the malware/adware, there is no reason to keep it...either select the "uninstall" option (on the app's "Help" menu), or at least turn off MalwareByte's real-time scanning protection.


If you still have a problem, then run EtreCheck and post the report here using the "Additional Text" icon which looks like a piece of paper. This report will provide information which will help us analyze your Mac and show what software is configured to run at boot & login.




Jan 12, 2023 3:53 AM in response to HWTech

Hello and thanks for the feedback. I've done as you said (chinned off Intego) and ran MalwareBytes, which didn't throw up anything interestingly.


However, when I was giving malwarebytes full disk access I noticed backservcie was among the other programmes requesting full access (which it didn't have).


I was able to right-click on it (which I couldn't do via activity monitor as it was greyed out) and find where it was -> Application Support -> Clever files. From there I was able to delete the lot.


So far, so good! But again thank you for your advice.

Jan 12, 2023 7:06 AM in response to Shiny@UCL

Shiny@UCL wrote:

I was able to right-click on it (which I couldn't do via activity monitor as it was greyed out) and find where it was -> Application Support -> Clever files. From there I was able to delete the lot.

I thought "Clever Files" sounded familiar, it seems it is Disk Drill. I do recall another thread on these forums which mentioned some unwanted app like "Backservice" being installed. Seems like Disk Drill itself or the server the app was downloaded from is adding in other stuff to the main download. Keep this in mind when downloading third party software...make sure to only download direct from the developer or a developer approved mirror. However, even some legitimate download site servers will end up bundling in other unwanted junk many times without alerting the user.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Backservice.app using lots of energy - no idea what it is (after having followed guides to remove it) - is it a virus??

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.