Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > uk.comp.sys.mac > #183725

Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck

Cross-posted to 2 groups.

Show all headers | View raw

On 27/05/2026 21:31, Brock McNuggets wrote:
> On May 27, 2026 at 7:03:48 AM MST, ""David B."" wrote
> <n7obu5F9snuU1@mid.individual.net>:
> 
>> Hello again, folks! 😄
>>
>> There has been some discussion across recent threads about standard
>> macOS uninstallation behaviour — specifically whether dragging an
>> application bundle ('App') to the Bin is sufficient for all software.
>>
>> For most applications, it is. Self-contained, sandboxed apps leave
>> nothing behind that matters, and dragging to the Bin is perfectly
>> adequate. However, a distinct technical exception applies to utilities
>> that require elevated privileges to scan system hardware, read
>> restricted logs, or monitor storage health.
>>
>> EtreCheck is a prime example of this class of software.
>>
>> To perform its deep system analysis, EtreCheck installs a *Privileged
>> Helper Tool* — an elevated background daemon that requires admin
>> authorisation on first run. This is entirely legitimate behaviour, but
>> it has a practical consequence for uninstallation.
>>
>> *The problem with "drag to Bin" for this category of software*:-
>>
>> 1. *The App Bundle* — Dragging the `.app` to the Bin removes the user-
>> facing interface, as expected.
>>
>> 2. *The Lingering Daemon* — macOS does not automatically unregister or
>> remove privileged helpers when their parent app is trashed.
>>
>> 3. *The Binary* — The helper executable persists in the root-level
>> directory `/Library/PrivilegedHelperTools/`.
>>
>> 4. *The Property Lists* — Associated configuration files remain in the
>> system launch directories.
>>
>> For ordinary apps that only write to `~/Library/Application Support/` or
>> `~/Library/Caches/`, this isn't a concern — those files are dormant and
>> easily ignored or removed. But when a utility has installed a persistent
>> background daemon that survives deletion of the main app bundle, a
>> dedicated uninstaller (or at minimum an inline **Uninstall** menu
>> option) is not just courteous — it's the correct design choice. Without
>> one, users are left manually navigating root-level directories to remove
>> components most wouldn't know to look for.
>>
>> Hopefully this clarifies things for anyone tracking file-system
>> behaviour or managing utility software on their Macs.
> 
> OK, did more work FOR you. To help you.
> 
> There is no evidence EtreCheck does as you say and puts something in
> 
>   /Library/LaunchDaemons/
>   /Library/PrivilegedHelperTools/
> 
> Or any other place where an uninstaller might be more useful. I even did a
> check in /Library/ for "EtreCheck" and found one item, and it was in:
> 
>   /Library/Logs/DiagnosticReports/
> 
> No issue with that.
> 
> But guess what, even if it did have stuff there, that would not mean an
> uninstaller would be absolutely needed. Here:
> 
>   
> https://www.telestream.net/telestream-support/screen-flow/help/Install.11.6.html
> 
> No uninstaller -- you have to manually go to:
> 
>   /System/Library/Extensions/TelestreamAudio.kext
> 
> And delete it.
> 
> How about Windscribe?
> 
>   
> https://windscribe.com/knowledge-base/articles/how-do-i-reinstall-the-windscribe-mac-app
> 
> This page talks about uninstalling it (even if the focus is on installing).
> Drag to trash and delete. But guess what... unlike EtreCheck it DOES leave
> things in the /Library folder.
> 
>   /Library/LaunchDaemons/com.windscribe.helper.macos.plist
> 
> Can you find anyone with a shred of concern about this? I would say ideally
> they should have a simple way to do this -- apps like Zoom and TeamViewer do
> have ways in the app itself.
> 
> But you are not only wrong -- there is no such cruft left behind in /Library/
> -- but even if there was you would STILL be making a mountain out of a
> molehill... whining about things you do not understand in the slightest.
> 
> David, I keep asking: stop these insane paranoid attacks against EtreCheck and
> its developer. You are making a complete and utter fool of yourself and doing
> so in thread after thread and across multiple newsgroups.

Thank you, Brock. You have just perfectly illustrated the exact 
technical point of this entire thread.

By bringing up Windscribe's leftover background daemon plist, you are 
explicitly confirming my premise: when software utilizes root-level 
privileges, dropping the application bundle into the Bin leaves 
persistent background configuration files or binaries behind in the 
system directories.

As you quite rightly noted yourself, apps like Zoom and TeamViewer 
provide an explicit, built-in mechanism to handle this cleanup because 
they use these elevated privileges. That is precisely the design 
standard I am highlighting.

Regarding your inability to find EtreCheck's privileged helper binary 
during your basic scan: as explained in my concurrent post, the helper 
is entirely conditional. The core scanning engine runs inside standard 
user space. The helper tool (com.etresoft.EtreCheckHelper) is only 
unpacked, registered, and written to /Library/PrivilegedHelperTools/ 
when a user executes specific, advanced tasks that trigger a standard 
macOS administrative password prompt (such as the low-level drive 
performance benchmark).

If you haven't triggered that admin elevation, the file won't be in your 
root directory yet. However, the blueprint is permanently baked into the 
software. Anyone can verify this by right-clicking the EtreCheck app 
bundle, selecting Show Package Contents, and looking inside 
/Contents/Library/LaunchServices/, or inspecting the 
SMPrivilegedExecutables array in its main Info.plist.

There is no "paranoia" or "attack" here. Pointing out the architectural 
reality of how macOS manages privileged helper tools, how specific 
software utilizes them, and why a standard "drag to Bin" leaves them 
behind is a matter of basic system administration.

--
Kind regards,
David

Back to uk.comp.sys.mac | Previous | Next — Previous in thread | Next in thread | Find similar

Thread

macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-05-27 15:03 +0100
  Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-05-27 14:29 +0000
    Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Gremlin <nobody@haph.org> - 2026-05-27 15:15 +0000
      Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-05-27 15:34 +0000
    Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-05-27 18:34 +0100
      Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-05-27 20:00 +0000
        Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-05-27 23:36 +0100
          Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-05-27 23:33 +0000
    Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-05-28 12:48 +0100
  Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-05-27 20:31 +0000
    Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-05-27 23:42 +0100
      Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-05-27 23:39 +0000
        Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck "David B." <"David B."@invalid.org> - 2026-05-28 08:48 +0100
          Re: macOS Technical Note: Privileged Helpers, dragging to Trash, and EtreCheck Brock McNuggets <brock.mcnuggets@gmail.com> - 2026-05-28 12:26 +0000

csiph-web