phantom program eating up memory on macbook pro

Hello, I have a mid 2012 MacBook Pro running High Sierra 10.13.6 with 8gb of RAM and a 500gb hard drive which is barely half full. First, I should say, I have never had a problem with my computer. It's run like a charm since the day I bought it. Suddenly, two days ago, my Mac began running excruciatingly slowly. When I opened up the Activity Monitor, I noticed my memory pressure in the red and something called InstallAgent using around 9gb of memory. When I quit it, memory pressure returns to normal and computer function returns to normal. However, a matter of minutes later, InstallAgent is back and building up to a massive memory usage again slowing my computer to a near stand still. I quit it and my computer is fine and the process starts again. I've rebooted, cleaned up miscellaneous files, run antivirus software. I'm at a loss. Any ideas? Oh, and I hadn't installed any new software when this started. I did run the usual requested system updates from the App Store. Could something have hiccuped?

MacBook Pro, macOS High Sierra (10.13.6), 8gb RAM, 500gb hard drive

Posted on Sep 3, 2018 7:44 AM

Reply
Question marked as Top-ranking reply

Posted on Sep 3, 2018 8:49 AM

Unsigned Files:

[...]

Launchd: /Library/LaunchDaemons/com.webroot.security.mac.plist

Executable: /usr/local/bin/WSDaemon 'Webroot Mac Security Daemon'

Details: Exact match found in the whitelist - probably OK


Launchd: ~/Library/LaunchAgents/com.company.InstallerAgent.plist

Executable: /Users/***/Library/Company/.newoffers/InstallAgent

Details: Executable file is hidden - possibly adware

"probably OK" means the developer has seen this software before, and it is not know to be a flagrant "Bad Actor"

It is NOT OK for something to be sold as Virus Protection for Mac, but not be authenticated with a Mac Developer certificate. You should remove Webroot, and NEVER Install it again.


Fat lot of good it did you anyway, the next item is adware that got installed anyway.


DON'T install third-party so-called Anti-Virus software on your already well-protected Mac running ElCapitan or later it just wastes resources and makes the Mac unstable while providing no additional benefit.


If there were something else needed to protect you, Apple would have already included it.

Similar questions

12 replies
Question marked as Top-ranking reply

Sep 3, 2018 8:49 AM in response to SteelCityYarn

Unsigned Files:

[...]

Launchd: /Library/LaunchDaemons/com.webroot.security.mac.plist

Executable: /usr/local/bin/WSDaemon 'Webroot Mac Security Daemon'

Details: Exact match found in the whitelist - probably OK


Launchd: ~/Library/LaunchAgents/com.company.InstallerAgent.plist

Executable: /Users/***/Library/Company/.newoffers/InstallAgent

Details: Executable file is hidden - possibly adware

"probably OK" means the developer has seen this software before, and it is not know to be a flagrant "Bad Actor"

It is NOT OK for something to be sold as Virus Protection for Mac, but not be authenticated with a Mac Developer certificate. You should remove Webroot, and NEVER Install it again.


Fat lot of good it did you anyway, the next item is adware that got installed anyway.


DON'T install third-party so-called Anti-Virus software on your already well-protected Mac running ElCapitan or later it just wastes resources and makes the Mac unstable while providing no additional benefit.


If there were something else needed to protect you, Apple would have already included it.

Sep 18, 2018 8:18 AM in response to SteelCityYarn

Same here. Exactly the same. Since a couple of days. Mac mini. Late 2012. Mac OS high Sierra 10.13.6 and 8 gb RAM. That install agent took 20gb ram. And also the same with quitting. After a while iit comes back. Well I read that post. But not really sure what to do now. My English is quite alright I guess but maybe I missed something. Greetings from Germany.

Sep 3, 2018 8:35 AM in response to SteelCityYarn

EtreCheck version: 4.3.6 (4D041)

Report generated: 2018-09-03 11:31:13

Download EtreCheck from https://etrecheck.com

Runtime: 17:35

Performance: Poor


Problem: Computer is too slow

Description:

Phantom program is causing memory pressure to be in the red and slow down my computer.


Major Issues:

Anything that appears on this list needs immediate attention.


No Time Machine backup - Time Machine backup not found.

Unsigned files - There are unsigned software installed that could be adware and should be reviewed.

Poor performance - EtreCheck report took over 10 minutes to run. This is very unusual.


Minor Issues:

These issues do not need immediate attention but they may indicate future problems.


Upgradeable hard drive - This machine’s hard drive could be replaced with an SSD. This would dramatically improve your machine’s performance.

High battery cycle count - Your battery may be losing capacity.

Apps crashing - There have been numerous app crashes.

Apps with heavy CPU usage - There have been numerous cases of apps with heavy CPU usage.

32-bit Apps - This machine has 32-bits apps that may have problems in the future.

Abnormal shutdown - Your machine shut down abnormally.


Hardware Information:

MacBook Pro (13-inch, Mid 2012)

MacBook Pro Model: MacBookPro9,2

1 2.5 GHz Intel Core i5 (i5-3210M) CPU: 2-core

8 GB RAM - At maximum

BANK 0/DIMM0 - 4 GB DDR3 1600 ok

BANK 1/DIMM0 - 4 GB DDR3 1600 ok

Battery: Health = Normal - Cycle count = 1352


Video Information:

Intel HD Graphics 4000 - VRAM: 1536 MB

Color LCD 1280 x 800


Drives:

disk0 - APPLE HDD ST500LM012 500.11 GB (Mechanical)

Internal SATA 3 Gigabit Serial ATA

disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk0s2 [Core Storage Container] 499.25 GB

disk1 - Macintosh HD (Journaled HFS+) 498.88 GB

disk0s3 - Recovery HD (Journaled HFS+) [Recovery] 650 MB


disk2 - Disk Image 11 MB (Disk Image)

External Disk Image

disk2s1 [Partition Map] 32 KB

disk2s2 - W********************e (HFS+) 10 MB


Mounted Volumes:

disk1 - Macintosh HD 498.88 GB (247.24 GB free)

Journaled HFS+

Mount point: /


disk2s2 - W********************e 10 MB (6 MB free)

HFS+

Mount point: /Volumes/W********************e


Network:

Interface Bluetooth-Modem: Bluetooth DUN

Interface en0: Ethernet

Interface en4: iPhone

Interface fw0: FireWire

Interface en1: Wi-Fi

802.11 a/b/g/n

One IPv4 address

3 IPv6 addresses

Interface en2: Bluetooth PAN

Interface bridge0: Thunderbolt Bridge

iCloud Quota: 102.10 GB available


System Software:

macOS High Sierra 10.13.6 (17G65)

Time since boot: About a day

System Load: 1.47 (1 min ago) 1.62 (5 min ago) 1.70 (15 min ago)


Security:

SystemStatus
GatekeeperMac App Store and identified developers
System Integrity ProtectionEnabled


Unsigned Files:

Launchd: /Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist

Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Helper-Tool

Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.amazon.music.plist

Executable: /Applications/Amazon Music.app/Contents/MacOS/Amazon Music Helper

Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.valvesoftware.steamclean.plist

Executable: ~/Library/Application Support/Steam/SteamApps/steamclean Public

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

Executable: /Library/PrivilegedHelperTools/com.microsoft.office.licensing.helper

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchAgents/com.oracle.java.Java-Updater.plist

Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater -bgcheck

Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.amazon.music.startup.plist

Executable: /Applications/Amazon Music.app/Contents/MacOS/Amazon Music

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchAgents/com.webroot.WRMacApp.plist

Executable: /Applications/Webroot SecureAnywhere.app/Contents/MacOS/Webroot SecureAnywhere

Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.skype.skype.shareagent.plist

Executable: /Applications/Skype.app/Contents/Library/LaunchServices/com.skype.skype.shareag ent.bundle/Contents/MacOS/com.skype.skype.shareagent

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.webroot.security.mac.plist

Executable: /usr/local/bin/WSDaemon 'Webroot Mac Security Daemon'

Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.company.InstallerAgent.plist

Executable: /Users/***/Library/Company/.newoffers/InstallAgent

Details: Executable file is hidden - possibly adware


Safari Extension: Mac Protector


32-bit Applications:

27 32-bit apps


Kernel Extensions:

/Library/Extensions

[Loaded] SecureAnywhere.kext (Webroot Software, Inc., 9.0.8 - SDK 10.9)


System Launch Agents:

[Not Loaded] 8 Apple tasks
[Loaded] 170 Apple tasks
[Running] 52 Apple tasks
[Killed] 61 Apple tasks
[Other] 3 Apple tasks


System Launch Daemons:

[Not Loaded] 37 Apple tasks
[Loaded] 175 Apple tasks
[Running] 74 Apple tasks
[Killed] 50 Apple tasks


Launch Agents:

[Not Loaded] com.webroot.WRMacApp.plist (? 7330a2e1 - installed 2018-09-02)
[Loaded] com.microsoft.update.agent.plist (Microsoft Corporation - installed 2018-09-02)
[Loaded] com.oracle.java.Java-Updater.plist (? 45c9da3e - installed 2017-12-19)


Launch Daemons:

[Loaded] com.microsoft.autoupdate.helper.plist (Microsoft Corporation - installed 2018-09-02)
[Running] com.webroot.security.mac.plist (? e491c976 - installed 2018-09-02)
[Loaded] com.apple.installer.osmessagetracing.plist (Apple - installed 2018-07-04)
[Loaded] com.adobe.fpsaud.plist (Adobe Systems, Inc. - installed 2018-07-27)
[Loaded] com.microsoft.office.licensing.helper.plist (? 6d8cb30e - installed 2012-04-02)
[Loaded] com.oracle.java.Helper-Tool.plist (? e3fefdd2 - installed 2017-12-19)


User Launch Agents:

[Loaded] com.amazon.music.startup.plist (? 0 - installed 2018-07-02)
[Loaded] com.google.keystone.agent.plist (Google, Inc. - installed 2018-07-17)
[Loaded] com.valvesoftware.steamclean.plist (? 0 - installed 2018-09-02)
[Running] com.amazon.music.plist (? 0 - installed 2018-07-02)
[Loaded] com.skype.skype.shareagent.plist (? 0 - installed 2017-12-06)
[Running] com.company.InstallerAgent.plist (? 0 - installed 2018-09-01)


User Login Items:

iTunesHelper Application (? - installed 2018-07-10)

(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)


Internet Plug-ins:

WidevineMediaOptimizer: (installed 2014-06-09)

FlashPlayer-10.6: (installed 2018-08-14)

QuickTime Plugin: (installed 2018-07-18)

Flash Player: (installed 2018-08-14)

SharePointBrowserPlugin: (installed 2018-09-02)

AmazonMP3DownloaderPlugin101750: (installed 2013-05-08)

Unity Web Player: (installed 2017-04-13)

Silverlight: (installed 2016-08-01)

JavaAppletPlugin: (installed 2018-01-19)


Safari Extensions:

Mac Protector.safariextz - Unknown (installed 2018-06-26)


3rd Party Preference Panes:

Flash Player (installed 2018-07-27)

Java (installed 2018-01-19)


Time Machine:

Time Machine Not Configured!


Top Processes by CPU:

Process (count)Source% of CPULocation
system_profilerApple34
trustd (3)Apple16
WindowServerApple10
Activity MonitorApple6
AddressBookSourceSyncApple5


Top Processes by Memory:

Process (count)SourceRAM usageLocation
Google Chrome Helper (13)Google, Inc.1.00 GB
kernel_taskApple829 MB
system_profilerApple309 MB
mdworker (9)Apple291 MB
Google ChromeGoogle, Inc.212 MB


Top Processes by Network Use:

ProcessSourceInputOutputLocation
InstallAgent?1 KB5 MB/Users/***/Library/Company/.newoffers
mDNSResponderApple992 KB169 KB
apsdApple25 KB14 KB
netbiosdApple5 KB3 KB
SystemUIServerApple0 B824 B


Top Processes by Energy Use:

Process (count)SourceEnergy (0-100)Location
WindowServerApple4
codesignApple2
Activity MonitorApple1
WSDaemonWebroot Software, Inc.1
Google Chrome Helper (13)Google, Inc.0


Virtual Memory Information:

Available RAM3.34 GB
Free RAM29 MB
Used RAM4.66 GB
Cached files3.31 GB
Swap Used85 MB


Software Installs (past 30 days):

NameVersionInstall Date
Adobe Flash Player2018-08-14
Antivirus VirusKiller Lite5.0.22018-08-20
Gatekeeper Configuration Data1532018-08-29
Microsoft AutoUpdate4.2.180812012018-09-02
Office 2011 14.7.7 Update14.7.72018-09-02


Diagnostics Information (past 7 days):

2018-09-02 12:33:10 Last Shutdown Cause: 3 - Hard shutdown


2018-09-02 11:30:28 InstallAgent CPU (201 times)

InstallAgent


2018-09-02 09:37:04 Steam.app Hang

/Applications/Steam.app


2018-08-29 13:39:40 Steam Helper.app Crash

~/Library/Application Support/Steam/Steam.AppBundle/Steam/Contents/MacOS/Frameworks/Steam Helper.app


2018-08-27 17:37:03 Minecraft.app Crash (9 times)

/Applications/Minecraft.app



End of report

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

phantom program eating up memory on macbook pro

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.