Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Is Google Earth Helper legit?

J

jerwin

Suspended
Original poster
Jun 13, 2015
2,895
4,652
So this shows up on my screen:

Screen Shot 2.png

How can I tell if this is a legit process and not some piece of horrible malware pretending to be something useful?
If it was a program, it would show up in the dock and I'd be able to figure out where it came from, and if it was signed. But this? Looks very anonymous.

I do use Google Earth. But scammers know this.
 
I got the same thing today. I almost typed in my password because it looks so legit, luckily I caught myself! I don't know if it's coincidental but I was using a bit torrent client when this popped up. I believe it is malware seeking root access. Do not--repeat--do not click on it.
 
Hello all,

I am wondering if you can help. Since yesterday, I keep getting the following message asking me to update Google Earth on my Mac running the latest version of El Capitan:
"Google Earth Update Helper wants to make changes. Type your password to allow this."

I am aware that Google has auto-updating functions into its products, but I have no way of verifying if this message is legit or not.

Has anyone else encountered this ?

Thanks!

Google Earth.png
 
I'm getting the exact same thing. I honestly don't know why. I haven't installed anything in days so it can't be a virus. A lot of people are seemingly having the same problem.
 
Yep I'm having the same problem. I haven't installed new software in a few days so I'm not sure where this is coming from.
 
I have it too, haven't downloaded anything, so it may be related to a website or something like that. I have Google Earth installed, but I don't think I have run it in a couple years...I have never seen it ask for an update like this either.

Don't put your password in whatever you do, I don't think it's trustworthy. I'm going to try a browser and computer restart (and install those updates I've been putting off...) to see if anything changes.
 
I also got the message (and hit Cancel) and have had installed the Google Earth app in the past.

I uninstalled it as per Google by moving ~/Library/Internet Plugins/Google Earth Web Plug-in.plugin to the trash and restarting the browser.
 
Alright, I did a restart and it popped right back up. So, I pulled up the Activity Monitor and found two things. First, I'm running a Google Software Update process, which is apparently launched from ~/Library/Google/GoogleSoftwareUpdate. This may be the Google update package

Second, and more importantly, there is also a Google Earth Update Helper application, but this one comes from a file in /private/tmp/KSInstallAction.(a bunch of text). It turns out there are three KS-something directories, one of which contains a disk image which mounts invisibly (it doesn't appear on the desktop, only in Disk Utility or the Terminal). I don't see anything in the files that indicates they are not related to Google, but random stuff showing up like this doesn't seem like a good thing.

In both cases the directories were created when I rebooted my computer, which likely means that something else is running that I can't see yet. I'm going to chuck all of it, and Google Earth for good measure, and see if that takes care of the problem.
 
Recently posted on Google forum:

Hi folks,

on behalf of the Earth team I apologize for the confusion. It appears that a while back we had disabled the auto-updater for the Mac Google Earth Plugin for Safari/Firefox, possibly because of this very issue. Today we inadvertently turned it back on. Oops!

There is no malware threat; the Updater is simply trying to update any installation of Google Earth Plugin you may have previously installed on your system (and possibly forgotten about).

You can uninstall the Earth Plugin and its associated files via the instructions here: https://support.google.com/earth/answer/21955?hl=en

Specifically: "4. Also, please delete the files at Library > Application Support > Google Earth."

Note that depending on what version of Earth Plugin you currently have installed, "Library" may refer to the one in the "root folder" of your hard drive (commonly called "MacintoshHD") and/or the one in your home folder. If the plugin is installed in either of those locations the Updater may notify you of an available update.

Once again I apologize of any inconvenience caused.

- Viet-Tam Luu (Google Earth developer)
Click to expand...
 
  • Like
Reactions: nicntj and jerwin
MC6800 said:
Recently posted on Google forum:
Click to expand...

Thanks for posting this, MC6800.

I have followed the instructions and have uninstalled the Google Earth app and all the associated files. For now, it seems to have worked: no more strange popup windows asking for my password...
 
I had some time ago uninstalled Google Earth and associated files, exactly as detailed in link shared by MC6800. Checked (both root folder and home folder) and no Google Earth folder or files existed. But I still got the same pop-up! Google Earth and Update Helper must have other files still installed? But currently no new pop-up occurrences.
 
If you open Disk Utility you will find one or more Google Earth Updater Helper Drives on your desktop, they're invisible. I selected them, (I had multiples) and ejected them, (after deleting all the other Google Earth related files. Hopefully this will solve the issue, but others have reported that it didn't. Fingers crossed.
 
Most recent from Google:
Viet-Tam Luu said:
Quick update: we've rolled back (undone) the changes that caused the update notifications so hopefully these will subside soon enough.

I wouldn't necessarily recommend removing the updater itself, as it may be used for other installed Google software (you can learn more about the Updater, or the version of it that we open-sourced, here: https://code.google.com/archive/p/update-engine/).

Regarding the password prompt, this is due to the latest version of the Plugin being installed as a system-wide software (just like the desktop Google Earth app is), rather than an app local to the user's account (as older versions did), which is why it is prompting for a password for login--just the same as if you were installing the desktop Earth app. So there's nothing nefarious going on--but again I do apologize about any concerns this may have caused.

Thanks,

Viet-Tam Luu (Google Earth developer)
Click to expand...
 
Same here as most of the above postings. It started showing up late in the afternoon, I cancelled and it started becoming pesky and persistent. I was working on another project and did not want to take the time to check the validity for this pop up. I don't ever recall this stuff coming in from Google before.

Today, nothing has showed up. I'm not sure if the poster MC6800 is legit or not. I have no desire to mess with this until it is determined to be necessary and legitimate.
 
  • Like
Reactions: nicntj
You shouldn't trust just me, which is why I included the google.com source link (I think you need to be logged in to Google to see it). But then I'm not sure poster Viet-Tam Luu is legit, other than that no one else from Google has posted in the past 8 hours that I know of. Of course Google themselves could be in on this... these tin foil hats are itchy, aren't they!
 
No offense intended as we are all behind our screens and could be anyone out there purporting aspects of insider knowledge without validation. I agree with the Tin Foil. I could never figure out whether to use the shiny side in or out!

It sure seemed odd to have had this happen.

Thanks
 
Well, either Google got a hand on it or deleting the invisible drives on my desktop (along with Google Earth and the Updater) worked. Haven't had the popup since. Here's hoping it stays away.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back