How do I get rid of 'Empdaemon' for good?

[Ethan H 1234]

I noticed there were a number of questions regarding 'empdaemon' on here, but none answered my specific dilemma.

I noticed 'empdaemon' was appearing regularly at the top of my Activity Monitor CPU, especially when watching youtube. It also used small amounts of CPU even when I wasn't watching video of any kind. I looked into it and found out it was the result of 'Elmedia Player'. I don't even remember installing this, and couldn't find any sign of it on my system apart from some files in my library. I ran the 'uninstall elmedia player', and deleted the library files. However 'empdaemon' is still appearing in my CPU processes when I start up my mac. Via terminal I looked to see if I had any third-party kernel extensions, and indeed 'elmedia player' was listed (along with one for soundflower (something I downloaded a while back and never use)).

Can someone explain how to resolve this? 1) why is it still appearing on my system, and 2) how do I remove it? Does the fact it's a third-party kernel extension mean it is restarted every time I boot up my mac? (apologies for my lack of understanding on something which is no-doubt very basic) Also, as a final question, what is the point of Elmedia Player?... when watching youtube, if I quit 'empdaemon' via Activity Monitor, it has no impact on the streaming of the video.

 

[satcomer]

Look at the blog post Elmedia uninistall.

 

[Ethan H 1234]

ok I did exactly what was suggested, but couldn't complete step 2, where it suggests to select 'First Start Guide.html'

The launcher for me was different, just an 'Elmedia Player.app' and a 'Applications' folder, and no 'First Start Guide'.html. I guess they have updated it, but I now have no idea how to uninstall it. Apologies for no doubt missing a really obvious solution.

 

[Weaselboy]

Install and run the app EtreCheck. That will create an anonymized report of everything running on your system. Post that report up here and we can tell you how to remove the startup process that is running this daemon.

 

[Ethan H 1234]

ok thanks, this ok?:

Kernel Extensions: ℹ️

/System/Library/Extensions

[loaded] com.Cycling74.driver.Soundflower (1.6.6 - SDK 10.6) [Click for support]

[not loaded] com.ZTE.driver.ZTEUSBMassStorageFilter (1.3.1) [Click for support]

[not loaded] com.caiaq.driver.NIUSBAudio2DJDriver (2.4.20) [Click for support]

[not loaded] com.caiaq.driver.NIUSBAudio4DJDriver (2.4.20) [Click for support]

[not loaded] com.caiaq.driver.NIUSBHardwareDriver (2.4.20) [Click for support]

[not loaded] com.caiaq.driver.NIUSBTraktorAudio2Driver (2.4.20) [Click for support]

[not loaded] com.caiaq.driver.NIUSBTraktorKontrolS4Driver (2.4.20) [Click for support]

[not loaded] com.caiaq.driver.NIUSBTraktorKontrolX1Driver (2.4.20) [Click for support]

[loaded] com.eltima.ElmediaPlayer.kext (1.0) [Click for support]

[not loaded] com.native-instruments.driver.NIUSBDeviceHelper (1.0.6) [Click for support]



Problem System Launch Agents: ℹ️

[killed] com.apple.AirPlayUIAgent.plist

[killed] com.apple.CallHistoryPluginHelper.plist

[killed] com.apple.CallHistorySyncHelper.plist

[killed] com.apple.cloudd.plist

[killed] com.apple.coreservices.appleid.authentication.plist

[killed] com.apple.EscrowSecurityAlert.plist

[killed] com.apple.icloud.fmfd.plist

[killed] com.apple.Maps.pushdaemon.plist

[killed] com.apple.nsurlsessiond.plist

[killed] com.apple.secd.plist

[killed] com.apple.security.cloudkeychainproxy.plist

[killed] com.apple.telephonyutilities.callservicesd.plist

12 processes killed due to memory pressure



Problem System Launch Daemons: ℹ️

[killed] com.apple.AssetCacheLocatorService.plist

[killed] com.apple.awdd.plist

[killed] com.apple.ctkd.plist

[killed] com.apple.ifdreader.plist

[killed] com.apple.installd.plist

[killed] com.apple.nehelper.plist

[killed] com.apple.nsurlsessiond.plist

[killed] com.apple.periodic-daily.plist

[killed] com.apple.softwareupdate_download_service.plist

[killed] com.apple.softwareupdated.plist

[killed] com.apple.wdhelper.plist

11 processes killed due to memory pressure



Launch Agents: ℹ️

[running] com.canon.MFManager.plist [Click for support]

[loaded] com.google.keystone.agent.plist [Click for support]



Launch Daemons: ℹ️

[loaded] com.adobe.fpsaud.plist [Click for support]

[loaded] com.cloudpath.maccmd.plist [Click for support]

[running] com.eltima.ElmediaPlayer.daemon.plist [Click for support]

[loaded] com.google.keystone.daemon.plist [Click for support]



User Launch Agents: ℹ️

[loaded] com.adobe.ARM.[...].plist [Click for support]

[loaded] com.valvesoftware.steamclean.plist [Click for support]



User Login Items: ℹ️

EOS Utility Application Hidden (/Applications/Canon Utilities/EOS Utility/EOS Utility.app)

ConnectService Application (/Library/Application Support/ArcSoft/Connect Service/ConnectService.app)



Internet Plug-ins: ℹ️

Flip4Mac WMV Plugin: Version: 2.3.4.1 [Click for support]

FlashPlayer-10.6: Version: 18.0.0.194 - SDK 10.6 [Click for support]

Default Browser: Version: 600 - SDK 10.10

Flash Player: Version: 18.0.0.194 - SDK 10.6 [Click for support]

AdobePDFViewer: Version: 9.5.5 [Click for support]

o1dbrowserplugin: Version: 5.41.0.0 - SDK 10.8 [Click for support]

QuickTime Plugin: Version: 7.7.3

googletalkbrowserplugin: Version: 5.41.0.0 - SDK 10.8 [Click for support]

Silverlight: Version: 5.1.30514.0 - SDK 10.6 [Click for support]

iPhotoPhotocast: Version: 7.0



3rd Party Preference Panes: ℹ️

Flash Player [Click for support]

Flip4Mac WMV [Click for support]

Native Instruments USB Audio [Click for support]



Time Machine: ℹ️

Time Machine not configured!



Top Processes by CPU: ℹ️

18% Activity Monitor

7% WindowServer

6% sysmond

4% mdworker(6)

1% com.apple.WebKit.Plugin.64



Top Processes by Memory: ℹ️

387 MB com.apple.WebKit.WebContent(4)

297 MB kernel_task

86 MB Safari

53 MB Finder

49 MB mdworker(6)



Virtual Memory Information: ℹ️

32 MB Free RAM

1.97 GB Used RAM

37 MB Swap Used

 

[Ethan H 1234]

hrm, just noticed I have 'com.valvesoftware.steamclean.plist' listed in the above... the 'flashback trojan'? Is that the root of the problem?

 

[Weaselboy]

hrm, just noticed I have 'com.valvesoftware.steamclean.plist' listed in the above... the 'flashback trojan'? Is that the root of the problem?

No, I believe that is just the background updater for the Steam client. I assume you have that installed?

Let's try this. Copy the path below then click the desktop then the Go menu, then go to folder and paste the path in and enter. Then delete both the ElmediaPlayer and the Soundflower plist files there. I know Soundflower has caused a lot of users troubles, so that may be part of your problem.

/System/Library/Extensions

Then do the same thing with this path and remove the ElmediaPlayer plist from there also.

/Library/LaunchDaemons

Restart after and see how things work.

 

[Ethan H 1234]

ok, I tried what you suggested an there is no sign of 'empdaemon' on start-up! Thanks!

Regarding: 'com.valvesoftware.steamclean.plist' I do have Steam, but , my thought that it was a 'Flash Trojan' came from this thread: https://discussions.apple.com/thread/6807297?tstart=0. I have also noticed my mac has slowed down quite a bit recently, for no apparent reason. You have been very helpful, but any ideas on this? Thanks

 

[Weaselboy]

ok, I tried what you suggested an there is no sign of 'empdaemon' on start-up! Thanks!

Regarding: 'com.valvesoftware.steamclean.plist' I do have Steam, but , my thought that it was a 'Flash Trojan' came from this thread: https://discussions.apple.com/thread/6807297?tstart=0. I have also noticed my mac has slowed down quite a bit recently, for no apparent reason. You have been very helpful, but any ideas on this? Thanks

I think that forum post is incorrect. I have never seen any evidence that that plist is part of Flashback.

https://support.apple.com/en-us/HT202456

Apple has a Flashback removal tool here you can run if you want to be sure.

Nothing jumps out as me in that Activity Monitor snapshot as chewing up CPU cycles, but you do appear to be low n available memory.

Since you have removed that empdaemon and I assume Soundflower also, try running another recheck report and post it up so can see how things look now. It is okay to post the whole thins since it is anonymized.