What is the "Google LLC" login item and what is it doing? It just added itself to my login items.

Not working, apparently :) I also just found these threads because that thing added itself to the login items list out of the blue and the way I see it, a high amount of diversion is going on because of a simple question.

adrianfulop wrote:

''Because at some point in the past, you gave Google full control over your computer and all of your data."

Well, I DIDN'T and I'm pretty sure many others didn't either. When asking for full disk access, I always deny it, especially to any Google software :) Automatic update checking is always OFF, so there is no reason whatsoever for that login item to be there, especially to install itself there without my specific consent.

That answer is a bit of a boilerplate that I haven't used for a long time.

In current practice, Apple has improved some of the security in operating system to prevent some of the most egregious violations in some case. But as you might notice, I used some qualifier words like "current", "some", and "egregious". That's because it's complicated. It depends on different things and has different meanings in different contexts.

You specifically mentioned "full disk access". I'm not sure what you mean by "denying" that. Apple has designed then system so that apps can't even ask for full disk access. You have to know about it and make the initiate to provide it. But the ultimate bottom line is that, if there is a login item there, you are the one who ultimately put it there, even if you don't remember it or realize it.

"How did this happen? Google asked for an administrator password and you provided it."

Correct me if I'm wrong, but when installing a software on your Mac, aren't you actually providing your administrator password to the OS, so it knows that you have administrator privileges?

Yes. You do have to trust Apple. No way around that. Apple bends over backwards to be trustworthy with your password and the rest of your personal information.

How and why would that password be passed on to Google?

Your password is never provided to Google or anyone else. If you have any Google software installed, you are the one who did that. Or maybe you let someone else use your computer, I don't know. I know Apple didn't do it.

"All this then leads us back to the question that everyone wants answered. What should you do about this file? Leave it alone, obviously. You don't have anything to hide, do you?"

Now this is THE biggest problem with modern mindset. You know what? I and many others DO have something to hide. It's called PRIVACY, and we especially like to hide it from people people/software who try to invade it!

Sorry, but I'm that guy who always neglects to include the <sarcasm> tag. 😄 This is the internet, where reason and logic go to die. A typical exchange is someone fighting mad over some perceived security failure by Apple, obsessively concerned about their privacy and security, focusing 100% on Apple, while also running every hack, pirate app, and personal information harvesting app known to man.

Oh... and my answer to "what should you do with this file" is DELETE IT, as well as every single piece of privacy invader crap Google software you find on your machine.

There is no "Google LLC" file! You'll never find it, so don't bother looking. Showing you that "Google LLC" string is just a really bad idea on Apple's part. If you go scrounge around in /Applications, /Library/LaunchDaemons, /Library/LaunchAgents, and <your home directory>/Library/LaunchAgents you can find and delete every "google" file you find. That is sufficient to stop Google from running.

Please don't look anywhere else. Those 3 locations are all you need. Scrounging around in other places is only going to cause problems. Yes. There will be lots of Google apps and files left on your computer. But they won't be running and they won't hurt anything. Leave well enough alone.

Note that any "Library" folder is hidden and won't show up in a search. You have to do this manually.

Please never, ever use any "app zapper" or "clean up" app. Google is actually one of the better apps here. It doesn't include any nasty low-level system modifications. You can just delete those files and Google won't be running any more. Easy, peasy. But if you try this with other apps, you can wreck your system really good.

adrianfulop wrote:

Why and how was Google LLC able to add itself to the login items list as a NEW item (apparently even on brand new Macs which have no Google software installed on them!), without having the user's previous consent? Every other software that I use which requires this will ask for my consent BEFOREHAND.

This doesn't happen. It's not possible. You're just confused. Sorry, but that's the way it is. This stuff is crazy complicated. No. It's far more complicated than that. It's really, really insanely complicated.

Well, you did write "you gave Google full access over your computer and all of your data". This implies full access to the disk :) Even if it's not full access, then at least access to the user data, which I didn't grant it (or at least I thought I didn't by unticking some boxes :) )

Also, I really want to understand what you mean by "I gave my administrator password to Google by installing their software". Are you implying that when you install an app on macOS and the system asks for your administrator password, that password is actually being given to the software developer?

As for deleting the file, of course I meant deleting the plist files which add the Google LLC entry to your login items.

As for "clean up" apps, I actually use App Cleaner and I'm very happy with it. I can delete (almost) all associated files in one click (which the uninstaller usually doesn't), instead of manually finding and deleting them. (I also use your app actually, which I find useful for finding out problems on my MBP.)

As for Google being one of the better apps, let me just tell you this story... this morning I noticed my Android TV, which was on standby, which is not connected to the internet, which has all useless apps removed, all useless settings turned off and which I only ever use to watch content from the box connected through HDMI , was being discovered by my MBP's Bluetooth :) As soon as I turned the TV on, the entry miraculously disappeared :)

Yeah, your sarcasm can be felt even without the <sarcasm> tag here.

Do tell me though, how can a LaunchDaemon add a NEW entry to the login list, expect for the one it was already adding?

The key point here is we have a NEW entry, which was not there before.

adrianfulop wrote:

Well, you did write "you gave Google full access over your computer and all of your data". This implies full access to the disk :) Even if it's not full access, then at least access to the user data, which I didn't grant it (or at least I thought I didn't by unticking some boxes :) )

Also, I really want to understand what you mean by "I gave my administrator password to Google by installing their software". Are you implying that when you install an app on macOS and the system asks for your administrator password, that password is actually being given to the software developer?

It means you allowed the installer to do whatever it wanted with elevated privileges. It had free rein to install anything just about anywhere.

adrianfulop wrote:

Yeah, your sarcasm can be felt even without the <sarcasm> tag here.

Do tell me though, how can a LaunchDaemon add a NEW entry to the login list, expect for the one it was already adding?

The Login list or the background items list--they are different, though located in the same place.

Either way, the app likely updated itself as it was allowed to do by installing it with elevated privileges. That update (to the updater in this case) triggered a change in the Login Items or the Background items (possibly both). Based on this and other posts, it appears they changed their signing certificate as that is what is displayed in the Background items list (not the name of a program which seems to be confusing a lot of people).

The key point here is we have a NEW entry, which was not there before.

If it was updated, it is a NEW item. If the signing certificate changed, it is definitely a "new" item to macOS.

Nobody can answer the question of "What is a Goolag LLC Login Item?" because that name is not an item. It is the name registered with the signing certificate. To answer the related question, "What is the app associated with the Goolag LLC login item," we would have to install that software on our Macs. Or, we can suggest ways you can determine for yourself such as looking at what is in LaunchAgents and LaunchDaemons or using a tool like EtreCheck which will show you what you have installed and what app is related to it.

To the second question I refer to the answer to the first. If we don't install it, we can't tell you what it does.

The third question goes directly to your question about giving your password to Goolag. By using your admin password to elevate the privileges of the installer, you grant that app permission to do just about whatever it wants. It appears it has decided to update itself and in the process of the update, altered the signing certificate for the app which generated a "new" item.

adrianfulop wrote:

Well, you did write "you gave Google full access over your computer and all of your data". This implies full access to the disk :) Even if it's not full access, then at least access to the user data, which I didn't grant it (or at least I thought I didn't by unticking some boxes :) )

Sorry. That was just muscle memory. I shouldn't have written it. If you would prefer a non-human AI chatbot, I can hook you up if you want.

But it is complicated. Mac App Store apps. Other apps. Software that runs in the background. Software that runs in the background and needs your admin password to install. They are all different.

And it is complicated on a whole different level. Virtually no legitimate apps care about your personal documents. It's only malware that might look for credit card numbers or keychain passwords. The scamware just wants your contacts list to scam them. Google is on a whole different level. Google's background software is really just for software updates. Google doesn't care about the files on your computer. Google cares about your internet activity. If you have Google software running in the background, you are probably running Google apps. Therefore, you are freely giving them your internet activity. That's what they sell to advertisers. You are Google's product. That's why it's free.

But Google's default security settings are much less restrictive. It's designed to collect your data and serve you ads, so it is designed for the advertisers, not you. Those people are very keen to exploit Google bugs and scam you. So if you do choose to run Google apps, you really should allow Google to automatically keep them updated.

Also, I really want to understand what you mean by "I gave my administrator password to Google by installing their software". Are you implying that when you install an app on macOS and the system asks for your administrator password, that password is actually being given to the software developer?

I don't know how many times I can say it, but it's complicated. When you provide your password to Apple software to install something, Apple doesn't give anyone your password. But apps (well, most apps) are free to ask for your password if they want. People regularly hand them over. People regularly provide any access that is requested. That's how scams work. If it doesn't work for you, that's great. Keep up the good work. You're in the 1%.

As for deleting the file, of course I meant deleting the plist files which add the Google LLC entry to your login items.

Yes. That is all that is really necessary. That will prevent the apps from launching automatically. Attempting to erase all traces of a particular 3rd party app can range from waste of time to catastrophic.

As for "clean up" apps, I actually use App Cleaner and I'm very happy with it. I can delete (almost) all associated files in one click (which the uninstaller usually doesn't), instead of manually finding and deleting them. (I also use your app actually, which I find useful for finding out problems on my MBP.)

If you use that on the wrong app, it will Mess. You. Up.

As for Google being one of the better apps, let me just tell you this story... this morning I noticed my Android TV, which was on standby, which is not connected to the internet, which has all useless apps removed, all useless settings turned off and which I only ever use to watch content from the box connected through HDMI , was being discovered by my MBP's Bluetooth :) As soon as I turned the TV on, the entry miraculously disappeared :)

Thanks for making my point for me. People complain that Apple doesn't let them delete Apple's built-in apps. They complain that Apple doesn't give them the control they want. So they buy Android. Well, there you go.

adrianfulop wrote:

Do tell me though, how can a LaunchDaemon add a NEW entry to the login list, expect for the one it was already adding?

The key point here is we have a NEW entry, which was not there before.

A LaunchDaemon runs with root privileges, unlike a LaunchAgent that runs as the user. As root, it can do virtually anything it wants, including installing additional software. That's one of the reasons why you should be cautious about giving out your admin password to install software like LaunchDaemons.

One of the changes in recent versions of macOS is that Apple has made the end user even more powerful that root in some situations. Those LaunchDaemons do not have access to certain restricted folders, such as your Documents folder. They also don't have any ability to change Apple software or Apple files. But the rest of your computer is their playground to do as they wish.

As I said above, this really isn't a big problem. If apps want access to people's personal data and have malicious plans for that data, all they have to is ask. Most people will hand over their data. When someone is running those multi-million dollar scams, it isn't worth the effort the effort to hack the few people who refuse. Just get the next sucker in the queue. That queue never runs dry.

Thank you for your explanations.

I simply brought up the Android TV story because you wrote Google is one of the better apps :) Besides, I didn't buy the TV because it runs Android, it bought it because it was cheap. I'm using an Android TV box for the sole reason of being able to watch Youtube without ads :)

harenet wrote:

To clarify, I was responding to John Galt, not to your response, so apologies if there was a misunderstanding there.

No misunderstanding. So few people actually respond to the person they intend to respond to that it isn't worth even looking at. Most of the time, they respond to themselves.

That said, I don't expect anyone to know these answers. I'm just hoping someone with more skill or knowledge than I have will be able to help me and others with the same questions find the answers.

Knowing the answer is the easy part. Getting anyone to accept it is the Impossible Challenge.

Hey there. I've been struggling with this Chrome issue, too, but unlike the OP, I want to completely uninstall Chrome and Google Updater and keep it that way. I've used several different web pages recommendations of files to search for and remove in /Library and ~/Library. In fact I went through every single folder in the libraries and checked for anything with "Google" or "Keystone." Delete, empty trash, restart computer. No sign of Chrome or anything Google in the "Background Items" list. A few days later, Chrome is reinstalled on my computer and the files are all replaced by some automatic process. Any ideas?

harenet wrote:

I'm new to these forums. Is there an etiquette or protocol when it comes to duplicate questions? Is there any reason I shouldn't just copy and paste this question there as well?

Duplicate Questions by the same User on the same day, regardless of where the user should post the question.

They are, generally subject to the discretion of the Apple Moderators to Action such Duplicate Questions.

I'd be asking that question over at a Google forum. Incidentally, there are browsers based on Chrome, with all the tracking and other junk stripped out, like Brave and Vivaldi.