qemu-system-x86_64 runs 100% CPU

You may be able to find where it is starting with:

etrecheck

Download etrecheck. Click on the download link at the bottom of the screen. http://etrecheck.com/

Run etrecheck. The first five runs are free.

How to post etrecheck findings:

1) click on "Share report"

2) click on "Copy report"

3) Paste the information into an ASC forum reply.

Using EtreCheck by etresoft, the author https://discussions.apple.com/docs/DOC-11591

Stamp of approval https://discussions.apple.com/docs/DOC-8181

MALWAREBYTES FOR MAC

Proven Malwarebytes technology crushes the growing threat of Mac malware. So you are protected and your machine keeps running silky smooth. Finally, cybersecurity smart enough for the Mac.

https://www.malwarebytes.com/pricing/mac/

If you have a current backup, you can Erase and Install clean copy of MacOS, then (at first run) use Setup Assistant and choose to automatically restore certain Groups of things, and then manually restore others:

So for example, you could transfer all Users, but separately restore only the Applications you desired, manually, using TimeMachine.app

--------

The other approach suggested is to post an Etrecheck report, and see if it calls out the errant process and its source. No personally-identifiable information is included in Etrecheck final report.

For what it's worth, I've finally solved the issue without having to do anything crazy. Give it a shot, it might work. Keep in mind I'm not a professional or anything, I just ran through the logical stuff.

STEPS:

1. Launch Activity Monitor and locate "qemu-system-x86_64"

2. Double click on it and on the bottom left of Activity Monitor click "Sample"

3. Once the sample has been taken, you should see lots of random digits which might intimidate you, but one of the subheadings in the sample should be called "Path:". Copy the path you see. My path was something like this: /usr/local/bin/qemu-system-x86_64

4. Launch Finder and simultaneously click "Shift" "Command" "G"

5. Paste the path that you copied from step 3 and click "Go"

6. This should locate a Qemu file, delete that immediately

7. For safe measure, we will now delete everything from your System which contains either the words "qemu" or "x86_64"

8. Press "Shift" "Command" "G" again and in the search box type "/system"

10. Where it says "search" on the top right of your finder, search for "qemu". For me this came up with nothing, but if you look closely that's because it's searching on "This Mac". Click the tab which allows you to search on the "System".

11. If this brings up a number of files, delete all of them. Make sure to empty your trash too.

12. Repeat steps 10 & 11 but instead of searching for "qemu" search for "x86_64"

13. Shut down your computer completely for a period of time. For me it was 10 hours, the time from when I slept to woke up the next day.

Hope this helps!

If you do not have a recent backup, your computer is like a ticking Time bomb. You are only one disk failure away fro losing EVERYTHING! Drives do not last forever. It is not a question of IF it will fail, only WHEN it will fail.

If you are using another direct-to-disk backup method that you prefer, and you currently have a recent backup, that is great. If not, you should consider using Built-in Time Machine. Take steps to acquire an external drive as soon as possible. If you buy one, a drive 2 to 3 times or larger than your boot drive is preferable for long term trouble-free operation. Do not pay extra for a drive that is fast. (You can get by for a while with a "found" smaller drive if necessary, but it will eventually become annoying).

Attach your external drive and use

System preferences > Time machine ...

... to turn on Time Machine. It may ask to initialize the new drive, and that is as expected.

Time Machine may spend all afternoon making your first full backup. You can continue to do your regular work while it does this. The first Full Backup is by far the biggest backup. After that, it will work quietly and automatically in the background, without interrupting your regular work, and only save the incremental changes.

Time machine's "claim to fame" is that it is the backup that gets done, because it does not ruin performance of the rest of the computer while doing its backup operations. You do not have to set aside a "Special Time" when you only do backups. When you need it, your Time machine Backup is much more likely to be there.

How to use Time Machine to Backup or Restore your Mac:

https://support.apple.com/en-us/ht201250

If you choose to connect your backup drive only from time-to-time, try to do so at least every-other day, at minimum. Otherwise, it may take several hours of computation just to decide what needs to be backed up, before any files are transferred.

What happened here might look like what happened to you, and it might even be the same, but these pillagings and plunderings can and do evolve and change.

What will probably clear this? Create a bootable installer, boot that, back up externally, back up a second backup copy, wipe your disk, install macOS, migrate over only your documents and not your apps, re-download apps, change all of your passwords to all of your services, change your passwords to your mail, to your web sites, watch your credit cards; assume everything was uploaded, passwords and contacts and photos and credit card data and all.

Here is my EtreCheck Report. I had downloaded some VST torrents that installed qemu-system-86x_64 and some other things (I force stopped in activity monitor.) I removed the files EtreCheck told me to do manually (EtreCheck said it was unable to do it and just highlighted the file.) It seems that it may have worked but I am unsure if it did or not. The two other things in activity monitor that were using 100+% CPU alongside qemu were called "Palaeoniscus" and "Elateridae".

I've the problem too, but at the end I've solved it. Here's the instructions:

Step 1: Go to Finder and press Shift Command G.

Step 2: Then copy & paste this ( /usr/local/Cellar ) in the text box.

Step 3: Delete the folder call qemu and empty the trash.

Step 4: Restart Your Mac.

Everything should be fine now. After the following the steps ↓

, if not delete everything named qemu in the system files

It is running as root. That means you gave it your administrator password at some point. Did you make note of how to remove it? It is open source, so it could have come from anywhere and in any other software package. Even if you could find uninstallation instructions, it could break something else if you try to remove it.

The first step is to identify exactly what you installed. Did you install qemu directly? Or is this part of something else? What did you install recently that required your administrator password?

You could have installed it years ago and it only started misbehaving when you upgraded to Mojave.

It is running as root. It is effectively part of your operating system. And you don't recall having ever installed it? Do you recall ever having installed anything to run Windows or Linux software on your Mac? Ever?

I doubt that will help. I assume you would restore from backup, which would just reinstall the same software. If you didn't restore, you would probably want reinstall your software, and that would likely put it right back again.

When you install software using your administrator password, you give full control over your computer, and all of your data, to the developer of that software. You are going to have to find out to whom you've given this level of control. qemu is not malware or anything. But you have given control over your machine to some unknown developers. You need to find out who now owns your computer and your data. They will give it back to you if you ask. But you need to find that out.

Start by finding out what software you have installed. All of it. You can go to Apple menu > About this Mac > System Report > Installations. That will list most of them, but maybe not all. Maybe you will get lucky and it will be listed.

qemu is open source software. As such, it is almost certainly going to require the Terminal to uninstall. I'm really not too eager to start handing out the commands necessary to uninstall. That gives me full control over your computer and all of your data. Plus it makes me responsible for any typos you might make.

Speaking of backups, do you have one? This is likely to be a very long thread. Attempting to manually remove this kind of low-level system modification when you don't even known how it got there is likely to go horribly wrong and require a restore from backup.

Step 1: Make a backup

Step 2: Follow the instructions above to list your installed software. Maybe we'll get lucky and something will be listed that can be tracked back to an official uninstaller.

Step 3: You begin the process to learn the UNIX command line. Hopefully we can avoid this step.

Okay, once you have complete and current backups if those aren’t already available, it’s time for an inventory: download the etrecheck tool, run it, and cut-and-paste the report here.

https://www.etrecheck.com/

Hi there,

I noticed my Macbook Pro is not running the way it used and found my way to Activity Monitor to see:

- qemu-system-x86_64 running over 100% CPU

- tools-service running over 100%

I have tried to Force Quit both, but qemu keeps coming back.

Is there no way to trace and remove these processes, without having to erase and start all over again? I tried to see if the "Open Files and Ports" tab in Activity Monitor would show some info, but it is not there.

My Macbook has been in use for quite a few years now and has a lot that needs to be backed if I proceed this way...trying to find an alternative option before doing this. I also installed many music VST/AU plugins recently, as I transitioned to FL Studio which was released for macOS. Prior to this, I was using Bootcamp for music production.

Majority of plugins are free too, available online and commonly used. Although some did require security permission to allow me to use the app, as perhaps they were from an unknown developer. I used a tutorial online which shows how to: How to Allow Apps from Anywhere.

I guess there is a risk. But there must be a way to completely quit this processes and remove it, if it is not essential for running macOS.

I will try to review the installed programs list to see if it is somewhere there too.

M.