TechEmpireSearch Pop UP???

[judger]

Recently a popup keeps appearing on my Mac OS X 10.14.6. It says "TechEmpireSearch requests to allow access". I do not recall ever installing this app. It is not in Applications or Utilities.

Any suggestions what it is and how to remove it?

Thank you.

 

[Raz0rEdge]

Is the popup coming from the browser or does it look like a macOS window? If the browser, does it come on a specific site? Clear the cache/data of your browser for starters. Then check what extensions you have installed and if you don't have thing like uBlock Origin, Ghostery or other similar extensions installed, do so immediately.

You can also grab a copy of MalwareBytes and see if it is find and remove that for you.

 

[judger]

I can move pop-up around Desktop. This mean it's from OS X?

Here is screen print:

 

[Lifeisabeach]

That's definitely a macOS prompt, not a browser prompt. I did some googling and can't turn up anything matching "TechEmpireSearch". This is certainly something to be wary of. Can you tell us what apps are loading on login? Open System Preferences » Users & Groups. Click on your user account and then the Login Items tab. There are other places to check for anything loaded on startup. Here's a website that does a good job of reviewing more of them.
https://www.fireebok.com/resource/how-to-remove-unwanted-startup-items-on-mac-os.html

EDIT: I should add that at the end of that page I linked to, they tout a piece of software they develop to make this easier. I've never used it and have no option on it, but the page is still a good resource for manually checking all the places that could have something loading on startup.

 

[Lifeisabeach]

One other thing to do is download and run DetectX Swift. It's free for home use (just close the window asking to register it). Let's see if that turns anything up.

 

[Raz0rEdge]

That is indeed a OS X/macOS pop-up, so open up Activity Monitor when it appears and go to the CPU tab. Now either sort by application name or search for 'Tech' and see if you can find anything. If you do, click on it and hit the (i) icon to get the folder where this thing is sitting.

Like LiB, I did a google search and couldn't find anything for that string.

 

[judger]

Here is what Activity Monitor finds on this app doing a search on "tech". Note that it is owned by root.

 

[judger]

Her is what I found when I did System Preferences » Users & Groups and clicked on my user account and then the Login Items tab:




What is that Android File Transfer Agent? I did at one time long ago try to sync my Mac with Android smartphones to transfer photos. But I never noticed this pop-up before. This feature is not critical to me. Should I attempt to delete this item just to see if the pop-up goes away?

 

[Lifeisabeach]

There's your problem. Mac Cleanup Pro.
How to Remove Mac Cleanup Pro (Dec. 2019 Update)

DetectX, if you haven't tried it yet, should be helpful in getting rid of it. If not, that link I posted has instructions. Don't use the software that the page is touting.

Also, just because there is so much Android malware, where did you get the Android File Transfer Agent from? Yes, it's on your Mac, but that whole ecosystem is a cesspool of iffy software.

 

[Slydude]

Android File Transfer Agent is probably not the issue. I've had it on my Mac in the past as part of a program called Android file Transfer (used to move files from Android phones to a Mac). I've never seen the type of popup he OP is seeing. If I were cleaning this up I'd do things in the following order/priority:

1. Get rid of all traces of Mac Clean Pro and reboot the Mac. That should cure things.
2. If step 1 doesn't correct the problem, or you no longer need Android File Transfer, get rid of that transfer agent.
3. Post back if the problem persists Besides, LB needs a good head scratcher of a problem to start the new year.

 

[Lifeisabeach]

Android File Transfer Agent is probably not the issue. I've had it on my Mac in the past as part of a program called Android file Transfer (used to move files from Android phones to a Mac). I've never seen the type of popup he OP is seeing.

Oh I have no doubt that there is a legit "Android File Transfer Agent" app for macOS, but with such a vague generic name, I wouldn't assume he has the legit one. Even with a non-generic name, I wouldn't assume anything. Lots of malware pose as legit stuff.

Post back if the problem persists Besides, LB needs a good head scratcher of a problem to start the new year.

Har! Well now that I've figured out the head scratchers in my own household, I am feeling restless...

 

[Slydude]

You're quite right about malware posing as legit stuff.

BTW since you're feeling a bit restless you're welcome to tackle the head scratchers here. SWMBO seems t think that every time I'm asked to tackle something it either,

1. takes twice as long to do half the work, or
2. to results in solutions Rube Goldberg would be proud of.

 

[Lifeisabeach]

You're quite right about malware posing as legit stuff.

BTW since you're feeling a bit restless you're welcome to tackle the head scratchers here. SWMBO seems t think that every time I'm asked to tackle something it either,

1. takes twice as long to do half the work, or
2. to results in solutions Rube Goldberg would be proud of.

Sounds too much like my childhood. I'd rather avoid reliving that trauma.

 

[judger]

Could not find Mac Cleanup Pro in Finder applications or utilities. Found the app in Trash - I do not delete entire Trash EVER.

Went to System Preferences: Removed mac Cleanup Pro in Users & Groups

Did Google search on removing Mac Cleanup Pro and it suggested looking for entries in System Preferences -> Profiles. Found 3 items with Tech whatever in them and deleted them.

I now wait to see if the pop-up is gone and will report if previous steps failed to resolve.

Thank you, All, for your help. ))

 

[MacInWin]

I do not delete entire Trash EVER.

May I ask why? Trash is for things you don't want. Empty it and regain the space immrdiately. The system will eventually delete things when it needs room anyway, so why not just get rid of it?

I know some people use Trash as a "holder" for things, but instead of that, create a "pending" folder and put stuff in there. Once you know you don't want/need it, put it in Trash and empty the trash.

 

[judger]

Trash space is not a problem. I use little. Keep for just in case.

Well, the pop-up came back. I did find a plug in in the Chrome browser that I rarely if ever use - use Fire Fox mostly. I deleted it. Still monitoring it.

 

[Lifeisabeach]

Trash space is not a problem. I use little. Keep for just in case.

Well, the pop-up came back. I did find a plug in in the Chrome browser that I rarely if ever use - use Fire Fox mostly. I deleted it. Still monitoring it.

If you haven't tried DetectX, give it a whirl. I'm increasingly impressed with this app. I've been running through some options and tutorials on it this evening and enabled the Folder Observer option. I subsequently decided to uninstall Malwarebytes and immediately got an alert that my startup items was changed. That's a HUGE plus! With that enabled, any nefarious software trying to infect my system can't do so without a warning.

 

[chscag]

I've been running through some options and tutorials on it this evening and enabled the Folder Observer option.

Thanks for the tip. I wasn't even aware of that option. I just enabled it.

 

[Lifeisabeach]

Thanks for the tip. I wasn't even aware of that option. I just enabled it.

Yeah, I was doing the "Expertise" achievements mainly to familiarize myself with all of its features and that's how I wound up enabling that in particular. I wound up registering it. For 10 lousy bucks, it's well worth the support to the developer.

 

[judger]

If you haven't tried DetectX, give it a whirl. I'm increasingly impressed with this app. I've been running through some options and tutorials on it this evening and enabled the Folder Observer option. I subsequently decided to uninstall Malwarebytes and immediately got an alert that my startup items was changed. That's a HUGE plus! With that enabled, any nefarious software trying to infect my system can't do so without a warning.

I am researching DetectX - a bit leary of such "cleaners".

I looked at the Activity Monitor again and did a search on any app starting in "tech". See below. Note that all 3 entries are owned by "root". That's the "admin", right? If one goes into the terminal emulator as "root" are there tools or things one can do to get rid of stuff root owns? Are there any suggested links that one can educate themselves about these matters?

Thank you, All, for helping with this. ))