Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > uk.comp.sys.mac > #183724
| From | "David B." <"David B."@invalid.org> |
|---|---|
| Newsgroups | alt.computer.workshop, uk.comp.sys.mac |
| Subject | Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck |
| Date | 2026-05-27 23:36 +0100 |
| Organization | Retired |
| Message-ID | <n7p9v8FeeseU1@mid.individual.net> (permalink) |
| References | <n7obu5F9snuU1@mid.individual.net> <6a16ffde$0$47728$882e4bbb@reader.netnews.com> <n7oo9rFbpdcU1@mid.individual.net> <6a174d73$0$8464$882e4bbb@reader.netnews.com> |
Cross-posted to 2 groups.
On 27/05/2026 21:00, Brock McNuggets wrote:
> On May 27, 2026 at 10:34:51 AM MST, ""David B."" wrote
> <n7oo9rFbpdcU1@mid.individual.net>:
>
>> On 27/05/2026 15:29, Brock McNuggets wrote:
>>> On May 27, 2026 at 7:03:48 AM MST, ""David B."" wrote
>>> <n7obu5F9snuU1@mid.individual.net>:
>>>
>>>> Hello again, folks! 😄
>>>>
>>>> There has been some discussion across recent threads about standard
>>>> macOS uninstallation behaviour — specifically whether dragging an
>>>> application bundle ('App') to the Bin is sufficient for all software.
>>>>
>>>> For most applications, it is. Self-contained, sandboxed apps leave
>>>> nothing behind that matters, and dragging to the Bin is perfectly
>>>> adequate. However, a distinct technical exception applies to utilities
>>>> that require elevated privileges to scan system hardware, read
>>>> restricted logs, or monitor storage health.
>>>>
>>>> EtreCheck is a prime example of this class of software.
>>>>
>>>> To perform its deep system analysis, EtreCheck installs a *Privileged
>>>> Helper Tool* — an elevated background daemon that requires admin
>>>> authorisation on first run. This is entirely legitimate behaviour, but
>>>> it has a practical consequence for uninstallation.
>>>>
>>>> *The problem with "drag to Bin" for this category of software*:-
>>>>
>>>> 1. *The App Bundle* — Dragging the `.app` to the Bin removes the user-
>>>> facing interface, as expected.
>>>>
>>>> 2. *The Lingering Daemon* — macOS does not automatically unregister or
>>>> remove privileged helpers when their parent app is trashed.
>>>>
>>>> 3. *The Binary* — The helper executable persists in the root-level
>>>> directory `/Library/PrivilegedHelperTools/`.
>>>>
>>>> 4. *The Property Lists* — Associated configuration files remain in the
>>>> system launch directories.
>>>>
>>>> For ordinary apps that only write to `~/Library/Application Support/` or
>>>> `~/Library/Caches/`, this isn't a concern — those files are dormant and
>>>> easily ignored or removed. But when a utility has installed a persistent
>>>> background daemon that survives deletion of the main app bundle, a
>>>> dedicated uninstaller (or at minimum an inline **Uninstall** menu
>>>> option) is not just courteous — it's the correct design choice. Without
>>>> one, users are left manually navigating root-level directories to remove
>>>> components most wouldn't know to look for.
>>>>
>>>> Hopefully this clarifies things for anyone tracking file-system
>>>> behaviour or managing utility software on their Macs.
>>>
>>> This is a decent description of Privileged Helper Tools in general —
>>> unfortunately it describes a problem that the evidence refuses to cooperate
>>> with.
>>>
>>> https://shottr.cc/s/PDfQ/SCR-20260527-b1c
>>>
>>> This is screensho showing AppCleaner's complete findings for EtreCheckPro.
>>> AppCleaner specifically scans /Library/PrivilegedHelperTools/ and
>>> /Library/LaunchDaemons/ — hunting down exactly these kinds of remnants is
>>> rather the whole point of the application. The result? Seven items, every
>>> single one sitting in perfectly ordinary user ~/Library/ locations. No daemon.
>>> No privileged helper. Nothing that survives a reboot, let alone plots against
>>> you in the background.
>>>
>>> You can verify this in about eight seconds. Open Terminal and type:
>>>
>>> ls /Library/PrivilegedHelperTools/
>>>
>>> If there's no com.etresoft.* entry, the centrepiece of your argument
>>> evaporates — and what AppCleaner found is exactly what I've been saying all
>>> along: standard, dormant, utterly unremarkable Library files that every Mac
>>> app leaves behind.
>>>
>>> Which brings us to the .plist. A .plist is a small XML file that remembers
>>> things like your window position and preferred settings. It does not run. It
>>> does not phone home. It does not lurk. It just sits there, taking up 4 KB,
>>> waiting for an app that may never come back. Every application on your Mac
>>> left one behind — including whatever you used to compose this post. Raising
>>> the alarm about a .plist file is the digital equivalent of reporting a
>>> restaurant to the health inspector because they wrote your name on a notepad.
>>>
>>> You own me an apology for your nonsense. And EtreCheck's developer.
>>
>> There is no need for an apology, Brock, because you are looking at a
>> clean room
>> and concluding the house was never built.
>>
>> Earlier today in the "Screenshot!" thread, you explicitly stated: "I
>> believe I
>> deleted them since the last time we discussed this." Running a third-
>> party uninstallation utility after you have already deleted the software
>> and its components is not a benchmark for what the software installs
>> during live operation.
>> For the benefit of the group, here is how EtreCheck's architecture
>> actually functions:
>>
>> The main application bundle runs in standard user space. However, when a
>> user initiates
>> tasks that require root privileges—such as reading restricted system
>> logs, running advanced storage diagnostics, or granting "Full Disk
>> Access" for deeper malware scans—EtreCheck explicitly prompts the user
>> for an administrator password.
>> It is at that specific moment of authorization that macOS copies and
>> registers the
>> privileged helper tool
>> into:/Library/PrivilegedHelperTools/com.etresoft.EtreCheckHelper
>>
>> If a user runs EtreCheck in a limited, surface-level capacity without
>> ever triggering
>> or granting those elevated administrative tasks, the helper tool is not
>> deployed. But for users utilizing the full diagnostic suite, that binary
>> is explicitly installed—and dragging the .app bundle to the Bin
>> afterwards does not trigger macOS to remove it.
>> My technical note stands exactly as written. The persistence of
>> privileged helper
>> tools is a well-documented behavioral trait of macOS, and understanding
>> when and how they are installed is key to managing a clean file system.--
>> David
>
> I just ran it. Full scan. Nothing where you say in
> /Library/PrivilegedHelperTools/
>
> Even if there was, you would need to show it ran without EtreCheck running --
> even when deleted.
>
> You have not. Not will you because you are in over your head and have no clue
> what you are talking about.
>
> David, PLEASE stop making a complete idiot of yourself. And I have allowed you
> to waste my time on software I do not care about... all to help you learn
> (something you seem immune to on this issue) and to help defend software and a
> developer you keep attacking with your paranoia and ignorance.
<ANOTHER BIG SIGH>!
A standard "Full Scan" in EtreCheck does not automatically drop the
helper tool, Brock. That is entirely by design. The developer built the
core scanning engine to operate safely within regular user space so that
an everyday user doesn't have to input an admin password just to
generate a basic text report.
The privileged helper tool is explicitly gated behind specific, advanced
operations within the app—such as running low-level storage benchmarks
or choosing to execute root-level tasks that trigger a standard macOS
admin password prompt.
Until a user actively invokes a feature that requires that elevation,
macOS does not write the binary to the root directory.
However, the architecture to do so is permanently embedded in the
application. Anyone can verify this in seconds without even running the app:
Right-click the EtreCheck application bundle and select Show Package
Contents.
Navigate to /Contents/Library/LaunchServices/. Inside, you will find the
dormant binary executable: com.etresoft.EtreCheckHelper.
Open the app's main Info.plist file. You will see the security key
SMPrivilegedExecutables, which explicitly registers
com.etresoft.EtreCheckHelper with macOS for system-level escalation.
As for your second point: I have never claimed the helper runs
continuously in the background after the main application is deleted. It
is managed by launchd as a launch-on-demand service.
The issue being discussed is file system persistence, not active CPU cycles.
The technical reality remains exactly as stated in the opening note:
once a user triggers a feature that requires administrative
authorization, macOS copies that helper binary to
/Library/PrivilegedHelperTools/. When the user later drags the main .app
bundle to the Bin, macOS leaves that root-level binary behind as a
permanent orphan.
Understanding the conditional nature of how and when these tools are
deployed is fundamental to understanding macOS file structure.
--
David
Back to uk.comp.sys.mac | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-05-27 15:03 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-05-27 14:29 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Gremlin <nobody@haph.org> - 2026-05-27 15:15 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-05-27 15:34 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-05-27 18:34 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-05-27 20:00 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-05-27 23:36 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-05-27 23:33 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-05-28 12:48 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-05-27 20:31 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-05-27 23:42 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-05-27 23:39 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-05-28 08:48 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-05-28 12:26 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck David B. <boaterdave@hotmail.co.uk> - 2026-06-02 10:51 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-02 16:13 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-06-02 21:58 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-02 21:03 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck David B. <boaterdave@hotmail.co.uk> - 2026-06-02 21:21 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-02 21:46 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck David B. <boaterdave@hotmail.co.uk> - 2026-06-02 21:57 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-03 00:35 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck David B. <boaterdave@hotmail.co.uk> - 2026-06-03 07:46 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <Brock.McNuggets@gmail.com> - 2026-06-03 14:02 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck David B. <boaterdave@hotmail.co.uk> - 2026-06-03 14:54 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-03 15:43 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck David B. <boaterdave@hotmail.co.uk> - 2026-06-03 16:00 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-03 19:06 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck David B. <boaterdave@hotmail.co.uk> - 2026-06-03 19:40 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-03 19:48 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck David B. <boaterdave@hotmail.co.uk> - 2026-06-03 19:58 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-03 23:53 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck David B. <boaterdave@hotmail.co.uk> - 2026-06-04 08:08 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-04 13:53 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck David B. <boaterdave@hotmail.co.uk> - 2026-06-04 14:32 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <Brock.McNuggets@gmail.com> - 2026-06-04 14:47 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck David B. <boaterdave@hotmail.co.uk> - 2026-06-04 15:05 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-04 16:20 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-06-04 20:07 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-04 19:16 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-06-04 21:59 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-04 21:15 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-06-04 22:38 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-04 22:28 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-06-04 22:50 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-04 22:27 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-06-04 23:34 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-04 22:57 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-03 15:45 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-06-03 17:01 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-03 19:06 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck David B. <boaterdave@hotmail.co.uk> - 2026-06-03 19:46 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-03 19:49 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-06-02 09:59 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-02 16:14 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-06-02 22:02 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-02 21:05 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck pothead <pothead@snakebite.com> - 2026-06-02 22:23 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-03 00:40 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-06-03 08:51 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <Brock.McNuggets@gmail.com> - 2026-06-03 14:02 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Gremlin <nobody@haph.org> - 2026-06-03 20:22 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-03 23:45 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Gremlin <nobody@haph.org> - 2026-06-03 20:22 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-03 23:45 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-06-04 08:31 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-04 13:56 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-06-04 15:59 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-04 16:06 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Gremlin <nobody@haph.org> - 2026-06-05 03:42 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-05 03:59 +0000
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-06-04 08:26 +0100
Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-06-04 13:57 +0000
csiph-web