Announcement: Upgrade to macOS Mojave

With features like Dark Mode, Stacks, and four new built-in apps, macOS Mojave helps you get more out of every click. 
Find out how to upgrade to macOS Mojave > https://support.apple.com/macos/mojave

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Question:

Question: Utorrent hangover

Hey everyone,


I've recently picked up a new macbook pro (well not new a 2015 one) and i've been downloading my previous software. I downloaded utorrent as this was the torrent client I am familiar with using however it wouldnt install. It seemed strange and I un installed it and tried again. Still no luck so went with another torrent client. However now when I try to download and install software such as VLC there volume drive icon where it could normally have VLC logo shows up as uTorrent. I'm sorry if i'm not accurately conveying what i'm trying to say but it seems utorrent still has something installed somewhere in my computer. When I go into finder and search Utorrent it comes up with my volumes folder where the Macintosh Logo is and next to it is a drive folder called GoogleSoftwareUpdate-1.2.10.105. When I open this it has a file named Utorrent however there is no visual logo and only becomes visable when highlighted. I've tried ejecting this and nothing happens and when I move to trash it says it cannot be deleted. Has anyone else encountered this? or have any advice on how to get rid of this utorrent hangover?


Many thanks,


User uploaded fileUser uploaded fileUser uploaded file

MacBook Pro with Retina display, iOS 10.3.3

Posted on

Reply

Page content loaded

Apr 22, 2018 8:07 AM in response to lowtechunderstanding In response to lowtechunderstanding

Hello lowtechunderstanding,

Maybe all you need to do is eject the "GoogleSoftwareUpdate" volume. However, uTorrent has nothing to do with Google, so this kind of looks like adware or malware. Maybe try this....


I wrote a little diagnostic program to help show what adware is installed. Download EtreCheck from https://www.etrecheck.com, run it, and paste the results here. EtreCheck is perfectly safe to run, does not ask for your password to install, and is signed with my Apple Developer ID. When you are done, EtreCheck can be thrown in the trash.


If adware is installed, EtreCheck will help you remove it, although you may have to supply a password. If you aren’t comfortable with that, just post the EtreCheck report here and other helpers can tell you exactly what files need to be deleted and how to do so.


Disclaimer: Although EtreCheck is free to download and use at first, it will eventually ask you to buy a license. There are also other links on my site that could give me some form of compensation, financial or otherwise.

Apr 22, 2018 8:07 AM

Reply Helpful

Apr 22, 2018 10:18 AM in response to lowtechunderstanding In response to lowtechunderstanding

EtreCheck is only going to list what software you have running in the background. If you have adware, it will help you disable it. Unfortunately, EtreCheck isn't going to help you eject the volume. You will always have to do that yourself.


If you don't want to use EtreCheck, you could try MalwareBytes instead (https://www.malwarebytes.com). But you will still have to download a program. Although it is very effective, MalwareBytes does includes a kernel extension, which is a low-level system modification. You can uninstall MalwareBytes later, but make sure to use the proper uninstaller app.


The problem is that these adware and malware apps also use low-level system modifications. I can tell you how to find and remove them manually, but it requires using the Terminal. You will also want to have a good backup. The few times that I've ever given people instructions on manually removing such system modifications, they get inside some hidden directory, get confused, and destroy the operating system so that it no longer boots. It looks like your machine is new enough to be immune to that, but you could still do damage if you don't know what to do or look for.

Apr 22, 2018 10:18 AM

Reply Helpful

Apr 22, 2018 11:20 AM in response to lowtechunderstanding In response to lowtechunderstanding

etresoft is a long time user here who developed and maintains EtreCheck. It has been used thousands of times on these forums alone. EtreCheck and MalwareBytes for Mac are pretty much the only two apps in this category experienced members will recommend without hesitation.


Still up to you, of course. I'm just saying there's nothing to worry about.

Apr 22, 2018 11:20 AM

Reply Helpful

Apr 22, 2018 2:54 PM in response to etresoft In response to etresoft

EtreCheck version: 4.2.1 (4C020)

Report generated: 2018-04-23 09:48:23

Download EtreCheck from https://etrecheck.com

Runtime: 2:45

Performance: Excellent


Problem: Other problem

Description:

utorrent hiding in volume


Major Issues:

Anything that appears on this list needs immediate attention.


No Time Machine backup - Time Machine backup not found.


Minor Issues:

These issues do not need immediate attention but they may indicate future problems.


Heavy RAM usage - This machine is using a large amount of RAM.

32-bit Apps - This machine has 32-bits apps that may have problems in the future.


Hardware Information:

MacBook Pro (Retina, 13-inch, Early 2015)

MacBook Pro Model: MacBookPro12,1

1 2.9 GHz Intel Core i5 (i5-5287U) CPU: 2-core

16 GB RAM Not upgradeable

BANK 0/DIMM0 - 8 GB DDR3 1867 ok

BANK 1/DIMM0 - 8 GB DDR3 1867 ok

Battery: Health = Normal - Cycle count = 375


Video Information:

Intel Iris Graphics 6100 - VRAM: 1536 MB

Color LCD 2560 x 1600


Drives:

disk0 - APPLE SSD SM0512G 500.28 GB (Solid State - TRIM: Yes)

Internal PCI 5.0 GT/s x4 Serial ATA

disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk0s2 () 500.07 GB

disk1s1 - Macintosh HD (APFS) 500.07 GB (22.33 GB used)

disk1s2 - Preboot (APFS) [APFS Preboot] 500.07 GB (64 MB used)

disk1s3 - Recovery (APFS) [Recovery] 500.07 GB (1.53 GB used)

disk1s4 - VM (APFS) [APFS VM] 500.07 GB (4.29 GB used)


Mounted Volumes:

disk1s1 - Macintosh HD 500.07 GB (471.69 GB free)

APFS

Mount point: /


disk1s4 - VM [APFS VM] 500.07 GB (471.69 GB free)

APFS

Mount point: /private/var/vm


disk2s1 - u******t 10 MB (9 MB free)

HFS+

Mount point: /Volumes/u******t


Network:

Interface en0: Wi-Fi

802.11 a/b/g/n/ac

One IPv4 address

2 IPv6 addresses

Interface en3: Bluetooth PAN

Interface bridge0: Thunderbolt Bridge

iCloud Quota: 4.11 GB available


System Software:

macOS High Sierra 10.13.3 (17D47)

Time since boot: About 13 days

System Load: 1.76 (1 min ago) 1.62 (5 min ago) 1.63 (15 min ago)


Security:

System Status
Gatekeeper Mac App Store and identified developers
System Integrity Protection Enabled


32-bit Applications:

3 32-bit apps


System Launch Agents:

[Not Loaded] 9 Apple tasks
[Loaded] 156 Apple tasks
[Running] 125 Apple tasks


System Launch Daemons:

[Not Loaded] 39 Apple tasks
[Loaded] 159 Apple tasks
[Running] 133 Apple tasks


User Launch Agents:

[Loaded] com.google.keystone.agent.plist (Google, Inc. - installed 2018-04-10)


Internet Plug-ins:

QuickTime Plugin: 7.7.3 (installed 2018-01-19)


Time Machine:

Time Machine Not Configured!


Top Processes by CPU:

Process (count) Source % of CPU
WindowServer Apple 10
Google Chrome Helper (66) Google, Inc. 4
kernel_task Apple 3
Google Chrome Google, Inc. 1
sandboxd Apple 1


Top Processes by Memory:

Process (count) Source RAM usage
Google Chrome Helper (66) Google, Inc. 9.06 GB
kernel_task Apple 1.14 GB
Google Chrome Google, Inc. 512 MB
Pages Mac App Store 344 MB
WindowServer Apple 161 MB


Top Processes by Network Use:

Process Source Input Output
mDNSResponder Apple 6 MB 2 MB
netbiosd Apple 1 MB 203 KB
apsd Apple 18 KB 20 KB
SystemUIServer Apple 0 B 6 KB
kernel_task Apple 0 B 0 B


Top Processes by Energy Use:

Process (count) Source Energy usage (0-100)
Google Chrome Helper (66) Google, Inc. 6
WindowServer Apple 4
Google Chrome Google, Inc. 1
mds Apple 0
logd Apple 0


Virtual Memory Information:

Available RAM 1.63 GB
Free RAM 20 MB
Used RAM 14.37 GB
Cached files 1.61 GB
Swap Used 1.37 GB


End of report

Apr 22, 2018 2:54 PM

Reply Helpful

Apr 22, 2018 4:47 PM in response to lowtechunderstanding In response to lowtechunderstanding

I don't see anything there, other than the mounted disk image. It should be listed in your Finder sidebar on the left hand side. If not, go to Finder > Preferences and make sure "Devices" is selected. You could also get to it using Disk Utility.


It should go away if you restart too.

Apr 22, 2018 4:47 PM

Reply Helpful

Apr 22, 2018 6:25 PM in response to lowtechunderstanding In response to lowtechunderstanding

lowtechunderstanding wrote:


Thanks etresoft. I'll try restart now. One more question, Is it not odd that google chrome helper is using 9.06gb of ram?

That is quite a bit, even for Chrome. That "(66)" means that there are 66 distinct Chrome processes. I assume that is at least one for each tab. Do you have that many tabs open?


EtreCheck only looks closely at Safari and Safari is getting harder and harder to inspect. It doesn't know anything about Chrome. You could have adware or other malicious extensions in Chrome. It can never hurt to review your extensions.

Apr 22, 2018 6:25 PM

Reply Helpful

Apr 23, 2018 6:05 AM in response to lowtechunderstanding In response to lowtechunderstanding

All of Google's apps are extreme resource hogs. Chrome, Google Earth, etc. Their actual function is to watch your Internet usage (what you buy, sites you visit) and send that marketing data back to Google's servers. That's what the process com.google.keystone.agent.plist does the entire time your Mac is on, whether Chrome or other Google app is running or not. Personally, I will always strongly recommend removing anything by Google from your computer.

Apr 23, 2018 6:05 AM

Reply Helpful

Apr 23, 2018 8:09 AM in response to lowtechunderstanding In response to lowtechunderstanding

Hi there,


just me personally I'm very happy and I would swear for Transmission BitTorrent client. It's widely used cross-platform lightweight torrent client, although it got also infected in 2016 it's quite closely monitored by the community and information about all possible problems spreads pretty quickly. It should be available from https://transmissionbt.com/


I would say everything around BitTorrent clients and sites is a bit shady area and everyone have to be careful when installing this kind of software because it's often used to spread malware and viruses. You should definitely check file hashes, those are available from Transmission Download page and I would also go and check both download-link and also unpacked content of downloaded file with https://www.virustotal.com


This should give you some confidence about what are you setting up on your system.


Btw. good luck with cleaning up your Mac from Google's stuff have great day,


Manoli

Apr 23, 2018 8:09 AM

Reply Helpful
User profile for user: lowtechunderstanding

Question: Utorrent hangover