Google Chrome empty Finder window

bugfindergooglemalware

Today without (yet) no evident change in my working Mac running Mountain Lion (10.8.5) I saw at least 10 times an empty window pop up on top of my working environnment.Google Chrome empty window.

At each of these events, I noticed that the window in which I was typing lost the focus and consequently what I was typing.

After a few quick investigation I found that this empty window is a Finder window and is clearly related to error messages within:

~/Library/Logs/GoogleSoftwareUpdateAgent.log

as this typical one:

2014-09-25 12:16:23.302 GoogleSoftwareUpdateAgent[24197/0xb0289000] [lvl=3] KSDiskImageHDIUtilRun() KSDiskImage hdiutil execution (status: 1): "/tmp/KSDownloadAction.sQtnQHG3Yu/com.google.Chrome.dmg"
        STDOUT:

        STDERR:
                hdiutil: attach failed - no mountable file systems

I don't use the Chrome web browser.

I installed it one year ago to test it from time to time.

I didn't use it recently.

What may be causing these Google Chrome empty Finder windows?

Did someone noticed the same spyware-like behaviour?

Does someone see any way to investigate this suspicious behaviour?

Best Answer

Here is the way I removed this automatic upgrade which never explained me what was going on.

The best information I found about this automatic update, and its removal is here: how to remove Google’s secret update software from your mac.

Check the presence of GoogleSoftwareUpdate

defaults read com.google.Keystone.Agent

gives a lot of info confirming me that the GoogleSoftwareUpdate is active and configured.

Stop the agent

cd /Library/LaunchAgents
launchctl unload com.google.keystone.agent.plist

Uninstall GoogleSoftwareUpdate

cd ~/Library/Google
python GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/Resources/install.py --uninstall

defaults read com.google.Keystone.Agent

outputs:

Domain com.google.Keystone.Agent does not exist

which confirms that the GoogleSoftwareUpdate doesn't have any more any default configured.

Clean up

cd ~/Library/Google
rm -rf GoogleSoftwareUpdate

cd ~/Library/Logs
rm GoogleSoftwareUpdateAgent.log

cd /Library/LaunchAgents
/usr/bin/sudo rm com.google.keystone.agent.plist

cd /Library/Google
/usr/bin/sudo rm -rf GoogleSoftwareUpdate
Related Question