How do I get rid of 'Empdaemon' for good?

Discussion in 'Mac Basics and Help' started by Ethan H 1234, Jul 6, 2015.

  1. Ethan H 1234 macrumors newbie

    Joined:
    Jul 6, 2015
    #1
    I noticed there were a number of questions regarding 'empdaemon' on here, but none answered my specific dilemma.

    I noticed 'empdaemon' was appearing regularly at the top of my Activity Monitor CPU, especially when watching youtube. It also used small amounts of CPU even when I wasn't watching video of any kind. I looked into it and found out it was the result of 'Elmedia Player'. I don't even remember installing this, and couldn't find any sign of it on my system apart from some files in my library. I ran the 'uninstall elmedia player', and deleted the library files. However 'empdaemon' is still appearing in my CPU processes when I start up my mac. Via terminal I looked to see if I had any third-party kernel extensions, and indeed 'elmedia player' was listed (along with one for soundflower (something I downloaded a while back and never use)).

    Can someone explain how to resolve this? 1) why is it still appearing on my system, and 2) how do I remove it? Does the fact it's a third-party kernel extension mean it is restarted every time I boot up my mac? (apologies for my lack of understanding on something which is no-doubt very basic) Also, as a final question, what is the point of Elmedia Player?... when watching youtube, if I quit 'empdaemon' via Activity Monitor, it has no impact on the streaming of the video.
     
  2. Ethan H 1234 thread starter macrumors newbie

    Joined:
    Jul 6, 2015
    #3
    ok I did exactly what was suggested, but couldn't complete step 2, where it suggests to select 'First Start Guide.html'

    [​IMG]
    The launcher for me was different, just an 'Elmedia Player.app' and a 'Applications' folder, and no 'First Start Guide'.html. I guess they have updated it, but I now have no idea how to uninstall it. Apologies for no doubt missing a really obvious solution.
     
  3. Weaselboy Moderator

    Weaselboy

    Staff Member

    Joined:
    Jan 23, 2005
    Location:
    California
    #4
    Install and run the app EtreCheck. That will create an anonymized report of everything running on your system. Post that report up here and we can tell you how to remove the startup process that is running this daemon.
     
  4. Ethan H 1234 thread starter macrumors newbie

    Joined:
    Jul 6, 2015
    #5
    ok thanks, this ok?:

    Kernel Extensions: ℹ️

    /System/Library/Extensions

    [loaded] com.Cycling74.driver.Soundflower (1.6.6 - SDK 10.6) [Click for support]

    [not loaded] com.ZTE.driver.ZTEUSBMassStorageFilter (1.3.1) [Click for support]

    [not loaded] com.caiaq.driver.NIUSBAudio2DJDriver (2.4.20) [Click for support]

    [not loaded] com.caiaq.driver.NIUSBAudio4DJDriver (2.4.20) [Click for support]

    [not loaded] com.caiaq.driver.NIUSBHardwareDriver (2.4.20) [Click for support]

    [not loaded] com.caiaq.driver.NIUSBTraktorAudio2Driver (2.4.20) [Click for support]

    [not loaded] com.caiaq.driver.NIUSBTraktorKontrolS4Driver (2.4.20) [Click for support]

    [not loaded] com.caiaq.driver.NIUSBTraktorKontrolX1Driver (2.4.20) [Click for support]

    [loaded] com.eltima.ElmediaPlayer.kext (1.0) [Click for support]

    [not loaded] com.native-instruments.driver.NIUSBDeviceHelper (1.0.6) [Click for support]



    Problem System Launch Agents: ℹ️

    [killed] com.apple.AirPlayUIAgent.plist

    [killed] com.apple.CallHistoryPluginHelper.plist

    [killed] com.apple.CallHistorySyncHelper.plist

    [killed] com.apple.cloudd.plist

    [killed] com.apple.coreservices.appleid.authentication.plist

    [killed] com.apple.EscrowSecurityAlert.plist

    [killed] com.apple.icloud.fmfd.plist

    [killed] com.apple.Maps.pushdaemon.plist

    [killed] com.apple.nsurlsessiond.plist

    [killed] com.apple.secd.plist

    [killed] com.apple.security.cloudkeychainproxy.plist

    [killed] com.apple.telephonyutilities.callservicesd.plist

    12 processes killed due to memory pressure



    Problem System Launch Daemons: ℹ️

    [killed] com.apple.AssetCacheLocatorService.plist

    [killed] com.apple.awdd.plist

    [killed] com.apple.ctkd.plist

    [killed] com.apple.ifdreader.plist

    [killed] com.apple.installd.plist

    [killed] com.apple.nehelper.plist

    [killed] com.apple.nsurlsessiond.plist

    [killed] com.apple.periodic-daily.plist

    [killed] com.apple.softwareupdate_download_service.plist

    [killed] com.apple.softwareupdated.plist

    [killed] com.apple.wdhelper.plist

    11 processes killed due to memory pressure



    Launch Agents: ℹ️

    [running] com.canon.MFManager.plist [Click for support]

    [loaded] com.google.keystone.agent.plist [Click for support]



    Launch Daemons: ℹ️

    [loaded] com.adobe.fpsaud.plist [Click for support]

    [loaded] com.cloudpath.maccmd.plist [Click for support]

    [running] com.eltima.ElmediaPlayer.daemon.plist [Click for support]

    [loaded] com.google.keystone.daemon.plist [Click for support]



    User Launch Agents: ℹ️

    [loaded] com.adobe.ARM.[...].plist [Click for support]

    [loaded] com.valvesoftware.steamclean.plist [Click for support]



    User Login Items: ℹ️

    EOS Utility Application Hidden (/Applications/Canon Utilities/EOS Utility/EOS Utility.app)

    ConnectService Application (/Library/Application Support/ArcSoft/Connect Service/ConnectService.app)



    Internet Plug-ins: ℹ️

    Flip4Mac WMV Plugin: Version: 2.3.4.1 [Click for support]

    FlashPlayer-10.6: Version: 18.0.0.194 - SDK 10.6 [Click for support]

    Default Browser: Version: 600 - SDK 10.10

    Flash Player: Version: 18.0.0.194 - SDK 10.6 [Click for support]

    AdobePDFViewer: Version: 9.5.5 [Click for support]

    o1dbrowserplugin: Version: 5.41.0.0 - SDK 10.8 [Click for support]

    QuickTime Plugin: Version: 7.7.3

    googletalkbrowserplugin: Version: 5.41.0.0 - SDK 10.8 [Click for support]

    Silverlight: Version: 5.1.30514.0 - SDK 10.6 [Click for support]

    iPhotoPhotocast: Version: 7.0



    3rd Party Preference Panes: ℹ️

    Flash Player [Click for support]

    Flip4Mac WMV [Click for support]

    Native Instruments USB Audio [Click for support]



    Time Machine: ℹ️

    Time Machine not configured!



    Top Processes by CPU: ℹ️

    18% Activity Monitor

    7% WindowServer

    6% sysmond

    4% mdworker(6)

    1% com.apple.WebKit.Plugin.64



    Top Processes by Memory: ℹ️

    387 MB com.apple.WebKit.WebContent(4)

    297 MB kernel_task

    86 MB Safari

    53 MB Finder

    49 MB mdworker(6)



    Virtual Memory Information: ℹ️

    32 MB Free RAM

    1.97 GB Used RAM

    37 MB Swap Used
     
  5. Ethan H 1234 thread starter macrumors newbie

    Joined:
    Jul 6, 2015
    #6
    hrm, just noticed I have 'com.valvesoftware.steamclean.plist' listed in the above... the 'flashback trojan'? Is that the root of the problem?
     
  6. Weaselboy Moderator

    Weaselboy

    Staff Member

    Joined:
    Jan 23, 2005
    Location:
    California
    #7
    No, I believe that is just the background updater for the Steam client. I assume you have that installed?

    Let's try this. Copy the path below then click the desktop then the Go menu, then go to folder and paste the path in and enter. Then delete both the ElmediaPlayer and the Soundflower plist files there. I know Soundflower has caused a lot of users troubles, so that may be part of your problem.

    Code:
    /System/Library/Extensions
    Then do the same thing with this path and remove the ElmediaPlayer plist from there also.

    Code:
    /Library/LaunchDaemons
    Restart after and see how things work.
     
  7. Ethan H 1234 thread starter macrumors newbie

    Joined:
    Jul 6, 2015
    #8
    ok, I tried what you suggested an there is no sign of 'empdaemon' on start-up! Thanks!

    Regarding: 'com.valvesoftware.steamclean.plist' I do have Steam, but , my thought that it was a 'Flash Trojan' came from this thread: https://discussions.apple.com/thread/6807297?tstart=0. I have also noticed my mac has slowed down quite a bit recently, for no apparent reason. You have been very helpful, but any ideas on this? Thanks
     
  8. Weaselboy Moderator

    Weaselboy

    Staff Member

    Joined:
    Jan 23, 2005
    Location:
    California
    #9
    I think that forum post is incorrect. I have never seen any evidence that that plist is part of Flashback.

    https://support.apple.com/en-us/HT202456

    Apple has a Flashback removal tool here you can run if you want to be sure.

    Nothing jumps out as me in that Activity Monitor snapshot as chewing up CPU cycles, but you do appear to be low n available memory.

    Since you have removed that empdaemon and I assume Soundflower also, try running another recheck report and post it up so can see how things look now. It is okay to post the whole thins since it is anonymized.
     

Share This Page