Is Google Earth Helper legit?

Discussion in 'macOS' started by jerwin, Aug 19, 2016.

  1. jerwin macrumors 68000

    Joined:
    Jun 13, 2015
    #1
    So this shows up on my screen:

    Screen Shot 2.png
    How can I tell if this is a legit process and not some piece of horrible malware pretending to be something useful?
    If it was a program, it would show up in the dock and I'd be able to figure out where it came from, and if it was signed. But this? Looks very anonymous.

    I do use Google Earth. But scammers know this.
     
  2. aaronvan Suspended

    aaronvan

    Joined:
    Dec 21, 2011
    Location:
    República Cascadia
    #2
    I got the same thing today. I almost typed in my password because it looks so legit, luckily I caught myself! I don't know if it's coincidental but I was using a bit torrent client when this popped up. I believe it is malware seeking root access. Do not--repeat--do not click on it.
     
  3. SmashingPumpkin macrumors newbie

    SmashingPumpkin

    Joined:
    Aug 31, 2006
  4. jerwin thread starter macrumors 68000

    Joined:
    Jun 13, 2015
    #4
    Yeah, I updated manually. Better safe than sorry.
     
  5. doublep macrumors newbie

    Joined:
    Sep 3, 2011
    Location:
    Japan
    #5
    Hello all,

    I am wondering if you can help. Since yesterday, I keep getting the following message asking me to update Google Earth on my Mac running the latest version of El Capitan:
    "Google Earth Update Helper wants to make changes. Type your password to allow this."

    I am aware that Google has auto-updating functions into its products, but I have no way of verifying if this message is legit or not.

    Has anyone else encountered this ?

    Thanks!

    Google Earth.png
     
  6. nicntj macrumors newbie

    Joined:
    Aug 19, 2016
    #6
    I'm getting the exact same thing. I honestly don't know why. I haven't installed anything in days so it can't be a virus. A lot of people are seemingly having the same problem.
     
  7. nicntj macrumors newbie

    Joined:
    Aug 19, 2016
    #7
    Yep I'm having the same problem. I haven't installed new software in a few days so I'm not sure where this is coming from.
     
  8. Keymaster macrumors member

    Joined:
    Dec 15, 2003
    #8
    I have it too, haven't downloaded anything, so it may be related to a website or something like that. I have Google Earth installed, but I don't think I have run it in a couple years...I have never seen it ask for an update like this either.

    Don't put your password in whatever you do, I don't think it's trustworthy. I'm going to try a browser and computer restart (and install those updates I've been putting off...) to see if anything changes.
     
  9. MC6800 macrumors 6502

    Joined:
    Jun 29, 2016
    #9
    I also got the message (and hit Cancel) and have had installed the Google Earth app in the past.

    I uninstalled it as per Google by moving ~/Library/Internet Plugins/Google Earth Web Plug-in.plugin to the trash and restarting the browser.
     
  10. Keymaster macrumors member

    Joined:
    Dec 15, 2003
    #10
    Alright, I did a restart and it popped right back up. So, I pulled up the Activity Monitor and found two things. First, I'm running a Google Software Update process, which is apparently launched from ~/Library/Google/GoogleSoftwareUpdate. This may be the Google update package

    Second, and more importantly, there is also a Google Earth Update Helper application, but this one comes from a file in /private/tmp/KSInstallAction.(a bunch of text). It turns out there are three KS-something directories, one of which contains a disk image which mounts invisibly (it doesn't appear on the desktop, only in Disk Utility or the Terminal). I don't see anything in the files that indicates they are not related to Google, but random stuff showing up like this doesn't seem like a good thing.

    In both cases the directories were created when I rebooted my computer, which likely means that something else is running that I can't see yet. I'm going to chuck all of it, and Google Earth for good measure, and see if that takes care of the problem.
     
  11. campyguy macrumors 68040

    Joined:
    Mar 21, 2014
    Location:
    Portland / Seattle
    #11
  12. MC6800 macrumors 6502

    Joined:
    Jun 29, 2016
    #12
    Recently posted on Google forum:

     
  13. doublep macrumors newbie

    Joined:
    Sep 3, 2011
    Location:
    Japan
    #13
    Thanks for posting this, MC6800.

    I have followed the instructions and have uninstalled the Google Earth app and all the associated files. For now, it seems to have worked: no more strange popup windows asking for my password...
     
  14. Big Bad D macrumors regular

    Joined:
    Jan 3, 2007
    Location:
    France
    #14
    I had some time ago uninstalled Google Earth and associated files, exactly as detailed in link shared by MC6800. Checked (both root folder and home folder) and no Google Earth folder or files existed. But I still got the same pop-up! Google Earth and Update Helper must have other files still installed? But currently no new pop-up occurrences.
     
  15. RootBeerMan macrumors 6502a

    RootBeerMan

    Joined:
    Jan 3, 2016
    #15
    If you open Disk Utility you will find one or more Google Earth Updater Helper Drives on your desktop, they're invisible. I selected them, (I had multiples) and ejected them, (after deleting all the other Google Earth related files. Hopefully this will solve the issue, but others have reported that it didn't. Fingers crossed.
     
  16. MC6800 macrumors 6502

    Joined:
    Jun 29, 2016
    #16
    Most recent from Google:
     
  17. Cat Dancer macrumors newbie

    Joined:
    Jun 2, 2015
    #17
    Same here as most of the above postings. It started showing up late in the afternoon, I cancelled and it started becoming pesky and persistent. I was working on another project and did not want to take the time to check the validity for this pop up. I don't ever recall this stuff coming in from Google before.

    Today, nothing has showed up. I'm not sure if the poster MC6800 is legit or not. I have no desire to mess with this until it is determined to be necessary and legitimate.
     
  18. MC6800 macrumors 6502

    Joined:
    Jun 29, 2016
    #18
    You shouldn't trust just me, which is why I included the google.com source link (I think you need to be logged in to Google to see it). But then I'm not sure poster Viet-Tam Luu is legit, other than that no one else from Google has posted in the past 8 hours that I know of. Of course Google themselves could be in on this... these tin foil hats are itchy, aren't they!
     
  19. Cat Dancer macrumors newbie

    Joined:
    Jun 2, 2015
    #19
    No offense intended as we are all behind our screens and could be anyone out there purporting aspects of insider knowledge without validation. I agree with the Tin Foil. I could never figure out whether to use the shiny side in or out!

    It sure seemed odd to have had this happen.

    Thanks
     
  20. RootBeerMan macrumors 6502a

    RootBeerMan

    Joined:
    Jan 3, 2016
    #20
    Well, either Google got a hand on it or deleting the invisible drives on my desktop (along with Google Earth and the Updater) worked. Haven't had the popup since. Here's hoping it stays away.
     
  21. Keymaster macrumors member

    Joined:
    Dec 15, 2003
    #21
    What I did worked, I haven't had any popup windows since.
     

Share This Page