What is the "Google LLC" login item and what is it doing? It just added itself to my login items.

I just got a notification from MacOS that Google LLC added itself to my login items.


This has me asking a few questions.

Hoping someone can help answer the following:


What is Google LLC login item?

What is it doing?

How is it functionally different form Google Updater?

Why is it able to install itself in my log in items without any authentication or opt-in action on my part?


A little background, in case it is relevant:


I have Chrome installed but barely use it for privacy reasons, however I do want keep it on the machine

I used to have Google Backup and Sync installed, but uninstalled over a year ago

I use Google Docs regularly in other browsers


Screenshot from System Prefs > General > Login Items



MacBook Pro 14″, macOS 13.4

Posted on Nov 8, 2023 10:29 AM

Reply
Question marked as Top-ranking reply

Posted on Nov 25, 2023 6:42 AM

adrianfulop wrote:

Yeah, your sarcasm can be felt even without the <sarcasm> tag here.

Do tell me though, how can a LaunchDaemon add a NEW entry to the login list, expect for the one it was already adding?

The Login list or the background items list--they are different, though located in the same place.

Either way, the app likely updated itself as it was allowed to do by installing it with elevated privileges. That update (to the updater in this case) triggered a change in the Login Items or the Background items (possibly both). Based on this and other posts, it appears they changed their signing certificate as that is what is displayed in the Background items list (not the name of a program which seems to be confusing a lot of people).

The key point here is we have a NEW entry, which was not there before.

If it was updated, it is a NEW item. If the signing certificate changed, it is definitely a "new" item to macOS.


Nobody can answer the question of "What is a Goolag LLC Login Item?" because that name is not an item. It is the name registered with the signing certificate. To answer the related question, "What is the app associated with the Goolag LLC login item," we would have to install that software on our Macs. Or, we can suggest ways you can determine for yourself such as looking at what is in LaunchAgents and LaunchDaemons or using a tool like EtreCheck which will show you what you have installed and what app is related to it.

To the second question I refer to the answer to the first. If we don't install it, we can't tell you what it does.

The third question goes directly to your question about giving your password to Goolag. By using your admin password to elevate the privileges of the installer, you grant that app permission to do just about whatever it wants. It appears it has decided to update itself and in the process of the update, altered the signing certificate for the app which generated a "new" item.

55 replies

Nov 15, 2023 1:51 PM in response to o_183

o_183 wrote:

It is a save guess to presume: using Google Chrome leads to getting that Google LLC on your computer.

First of all, there is no "Google LLC". If you try to search for it on your computer, you'll never find it. It doesn't exist.


The problem is that this is name of the entity that signed the digital signature attached to some app or portion of one. Since this name is in a digital signature, it's actually encrypted. So even if you were to scan the entire hard drive, you would never find the text "Google LLC" at all, because it's encrypted. 😄


I don't why why Apple chose to surface this particular information, and only this information, and only sometimes. Other times, it says "Google Update". Ironically enough, only the "Google LLC" part is reliable. Anyone, even dedicated, committed malware developers could release something and call it "Google Update" and that's what Apple would tell you it was. 😄 That's because the "Google LLC" is part of that encrypted digital signature whereas "Google Update" is just a string.

But I got that same indication just today, and I don’t have Chrome nor any other Google software installed

I'm pretty sure you do. Remember that in addition to not actually existing, any associated files for these things are in hidden folders. They will not even show up in the Finder and your searches will not acknowledge their existence.

Can just browsing a Google-owned website lead to the installation of a background app in my OS?

No.

Nov 25, 2023 4:19 AM in response to etresoft

''Because at some point in the past, you gave Google full control over your computer and all of your data."


Well, I DIDN'T and I'm pretty sure many others didn't either. When asking for full disk access, I always deny it, especially to any Google software :) Automatic update checking is always OFF, so there is no reason whatsoever for that login item to be there, especially to install itself there without my specific consent.


"How did this happen? Google asked for an administrator password and you provided it."


Correct me if I'm wrong, but when installing a software on your Mac, aren't you actually providing your administrator password to the OS, so it knows that you have administrator privileges? How and why would that password be passed on to Google? It makes no sense whatsoever.


"All this then leads us back to the question that everyone wants answered. What should you do about this file? Leave it alone, obviously. You don't have anything to hide, do you?"


Now this is THE biggest problem with modern mindset. You know what? I and many others DO have something to hide. It's called PRIVACY, and we especially like to hide it from people people/software who try to invade it!


Oh... and my answer to "what should you do with this file" is DELETE IT, as well as every single piece of privacy invader crap Google software you find on your machine.

Nov 8, 2023 10:41 AM in response to harenet

It's associated with Google Chrome which is very invasive with all of its supporting files it puts in so many places on your drive. There are a lot of similar login items of developer's names instead of the name of the app. It's confused me along with many others in the beginning (when Ventura was released).


It's also a very overactive system resource hog, CPU and memory, and sends back info on where you go and what you look at to its home servers for sale to online vendors. You're have much more privacy with Firefox or Brave as browsers if you don't ike Safari.


Nov 12, 2023 3:23 PM in response to Scott Ahten

Scott Ahten wrote:

This seems to be legit. See: https://support.google.com/chrome/thread/243035925/what-is-the-google-llc-login-item-on-macos-and-what-is-it-doing?hl=en

It doesn't seem to be legit to me. It looks like ChatGPT output, which is always junk.


Unfortunately, Apple's new user interface in Ventura for displaying the "Login Items" and "background tasks" is also junk. It is normal for people to get confused when they see this kind of meaningless gibberish. I'm a big Apple fan in most respects, but not here. I have some personal theories about why it works the way it does, but those are well into conspiracy theory territory.


Apple sprang this new interface on developers without notice. Well, yes, they did give them a few months notice. But this was a major architectural change for an area where very few developers outside Apple, or even inside Apple, know anything about. This is really, really obscure stuff. Nobody cared because it was all background tasks based on files in hidden directories. That is, until Apple threw in that end-user-facing control interface. What a royal mess!


And because the interface is such a mess to being with, I can't even tell if this is just some old app that Google actually fixed. That's the problem with these kinds of major changes. Google sure didn't know about it when they released that software signed by "Google LLC" however many years ago. (I'm just guessing that it old app. I don't really know and Apple isn't helping any.)


To get back to the original question, "What is the "Google LLC" login item and what is it doing? It just added itself to my login items." Sorry, no clue. You'll have to dig around in those hidden folders ands background tasks to find out.

Nov 13, 2023 8:14 AM in response to harenet

PS: Full disclosure time. One of the reasons that this Apple user interface is so annoying is that I've developed my own app that, in my humble opinion, does a much better job of this. It will tell you exactly what file is using that "Google LLC" signature. It can't tell you what the software actually does. Again, you'll just have to trust "Google LLC", but at least you'll be able to see if it is just another part of (what is claimed to be) the software updating component.


However, my app doesn't allow you to disable those components. I had considered it years ago, but decided right away that I didn't want to be interfering with other people's apps. You installed this "Google LLC" software for a reason. I don't want you using my software to break it. If you don't want to run the software, my app will show you all the pieces. If you decide you don't want to use the software, you can then install it using any legitimate method (which is a whole different, very long discussion - never use "app zappers" or "clean up" apps for this). If there are any pieces left installed, my software will show you what they are and where they are so you can (safely) complete the uninstallation.


Chances are, with a major developer like Google, the app is probably doing what it says it is doing. And it is also probably collecting information too. There isn't anything wrong with that. Maybe they want to know why people run the updater, or why they don't. Collection of information is not necessarily malicious. Sometimes, the information is used to improve the user experience. But you'll never know for sure. It's 100% based on trust.


Alas, the Apple discussion forum rules prevent me (as the author) from giving you a direct link to my app. You can use Google to find it, or someone else can tell you, but I can't.

Nov 13, 2023 1:05 PM in response to harenet

Yes, and this is an extremely bizarre conversation, which I followed in hopes that that very simple question could be answered. Bracket rants about Google, extraneous suggestions that Google be removed from our computers, rude and condescending remarks, and etc and the whole of the discussion boils down to:

"Hey, Google just added some stuff to my computer, what is it and what does it do?"

"We don't know." -> "and we don't care because Google is (commence endless circular rants and etc.) ."


I just want to know if the items will do anything overtly annoying or disruptive, with specific description of same, in which case I will disable them, unless doing that will similarly do something overtly annoying or disruptive, and specifically what that would be. Just that.

"I don't know and am not sure anyone does" is an appropriate response, but I think we already have gathered that from those of you who have felt the need to respond at length anyway.

And yes, Google is annoying and disruptive and manipulative and very sneaky by nature and design, and there are ways to disentangle from it, and we all hate it to various degrees, and make various decisions re our use of it in that context, but that is another discussion. "It will continue to exploit and attempt to own you, mind, body and soul you fatuous idiot" is not useful here.

If anyone wades to this point who actually does the exact functions of those two items, it'd still be nice to know.

Jeez.






harenet wrote:

To clarify, I was responding to John Galt, not to your response, so apologies if there was a misunderstanding there.

That said, I don't expect anyone to know these answers. I'm just hoping someone with more skill or knowledge than I have will be able to help me and others with the same questions find the answers.




Nov 13, 2023 4:02 PM in response to BeccaJC1212

BeccaJC1212 wrote:

If anyone wades to this point who actually does the exact functions of those two items, it'd still be nice to know.

No one (at least no one who knows what they are talking about) is going to make any statement about what some random file on someone else's computer might be. All we know if that it was signed by "Google LLC".


Most likely, these are the same files shown here: Can you help me understand my Etrecheck r… - Apple Community

or here: Etrecheck Report Analysis - Apple Community

or here: My EtreCheck report for my 27"iMac, late … - Apple Community


Is that guaranteed? No. It is not. It could be something completely different.

Nov 13, 2023 5:41 PM in response to etresoft

Love it when people that don't know what the answer is use it as an excuse to talk down to the people asking honest a simple questions.

At this point:

Google LLC is a login item of unknown origin to all on the thread.

No one seems to know what it does.

No one can say if it is in any way related to Google Updater.


Standby and many will be scouring the internet and other resources to answer those questions and some will just return with long-winded sarcastic comments.

Nov 13, 2023 5:41 PM in response to Arthur7

Arthur7 wrote:

It was explained that there is no "Google" so the solution is to "uninstall Google" is a least unhelpful and is coming across as pretentious. Uninstall "x", "y" and "z" might be a helpful comment or leave it alone.


If you do not know what you installed on your Mac, then follow the instructions I posted for others to determine what you installed.


Excerpted from Effective defenses against malware and other threats - Apple Community:


  • Never install something without first knowing what it is, what it does, how it works, and how to get rid of it when you don't want it any more.


"Google LLC" will not appear unless you installed a Google product or service on your Mac.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

What is the "Google LLC" login item and what is it doing? It just added itself to my login items.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.