|Four calls by ksfetch each hour||TomMcIn||6/14/12 9:10 PM|
After trying Google Chrome, tcpblock on os x 10.7.4 is blocks four calls each hour. whois on Netscan identifies these ip address 18.104.22.168, 32, 0, 14 :443 as Google sites.
|Re: Four calls by ksfetch each hour||TomMcIn||6/14/12 9:14 PM|
The Netscan report is
|Re: Four calls by ksfetch each hour||Nortonius||6/15/12 5:56 AM|
VirusBarrier X6 is giving me the same information as reported by TomMcIn, and these repetitive calls are extremely annoying: could someone, preferably from Google, please explain what ksfetch is, so that we can decide whether we want to block it or not? Thanks
|Re: Four calls by ksfetch each hour||seishin||6/16/12 4:20 AM|
I'm having the same issue. My firewall sends a multitude of notifications daily from "ksfletch (nobody)" that can't be Accepted or Denied to make the notifications stop. I've set the firewall with 43 Rules re: ksfetch to try to block the popups from occurring, but they're ineffective. From what I can tell, it's only associated with using the Chrome browser. I doubt I'll make it through another day before dropping Chrome, it's too frustrating & annoying and interferes with my computer usage. (Having the pop-up occur during a Diablo fight has been the last straw).
|Re: Four calls by ksfetch each hour||Nortonius||6/16/12 5:58 AM|
I just 'uninstalled' Google Chrome (according to this anyway http://www.mac-forums.com/forums/os-x-operating-system/259328-how-uninstall-google-chrome-completely.html ) but I'm still getting notifications about ksfetch...
|Re: Four calls by ksfetch each hour||TomMcIn||6/16/12 9:35 AM|
I have Quit Google Chrome and still get messages. I have Shutdown and Restarted my system and still get the messages. I have looked in the Activity Monitor (All Processes) for names like ksfetch and google chrome and nothing is there. The IP addresses in the messages from tcpblock point at "Do No Wrong" Google so according to their motto, it should be no problem. Somehow, Google has embedded this hack inside one of the OS X modules. Now trying tcpblock -b grep yes to see if I can get the PID of the OFFENSIVE GOOGLE Routine.
|Re: Four calls by ksfetch each hour||Nortonius||6/16/12 9:49 AM|
If it's any help, I found ksfetch in Activity Monitor by looking for it there before denying its call. I stopped ksfetch in Activity Monitor, but as it seems to come and go it may simply re-activate itself and call again, we shall see! BTW I also tried searching Finder for ksfetch while it was showing in Activity Monitor, but no joy. Hopefully someone more techie than me will find an answer soon!
|Re: Four calls by ksfetch each hour||seishin||6/16/12 10:09 AM|
Where are the Anonymous Hackers when we need them?
|Re: Four calls by ksfetch each hour||TomMcIn||6/16/12 10:20 AM|
The Anonymous Hackers seem to be working for Google as no one from Google bothers to explain what is happening, even after we stop using Chrome.
|Re: Four calls by ksfetch each hour||TomMcIn||6/16/12 10:33 AM|
Activated tcpblock -m to log each network access including the uid and pid. Turns out they start a new process, make a number of blocked requests, kill the pid then start another process and make more requests. All told them made 12 requests. on two pids, none of which exist after they get terminated. tcpblock does not have an option to freeze the state when a connection is blocked that I know of.
The parent of the offending process should be listed in the process information of a Task in Activity Monitor. That might indicate where Google is triggering ksfetch. Suspect they have embedded an entry in the Unix routines that automatically start other routines, as the calls by ksfetch occur almost every hour.
|Re: Four calls by ksfetch each hour||Nortonius||6/16/12 10:39 AM|
Duh, yeah why didn't I think to look for the parent process before quitting ksfetch in Activity Monitor?! It just called again, I already denied it before reading the above but it looks like I'll have another chance to look for the parent process... But it sounds like you're perfectly capable of doing that, and might beat me to it as I'll be watching football most of this evening!
|Re: Four calls by ksfetch each hour||dr2chase||6/16/12 11:04 AM|
Contents of /Library/Google (on 10.6.8) and /Library/LaunchAgents/com.google.keystone.agent.plist both look like candidates to me. I see the calls from LittleSnitch -- part of the problem is that each new instance of ksfetch appears to be a new binary written into /tmp.
|Re: Four calls by ksfetch each hour||TomMcIn||6/16/12 12:41 PM|
tcpblock does not seem to have a way to stop the questionable process that is making the outside connection. Have asked the developer if a stop is possible. I can wait until your football game is over.
|Re: Four calls by ksfetch each hour||TomMcIn||6/16/12 12:54 PM|
Using 10.7.4 and the only thing in /Library/Google is a GoogleSoftwareUpdate folder.
/Library/LaunchAgents has nothing for Google.
Need to look into how 10.7.4 supports timed starting applications. Just haven't recalled the magic word that will have Google return some articles. Autostart only brings up login related articles.
|Re: Four calls by ksfetch each hour||dr2chase||6/16/12 1:23 PM|
I am pretty sure ksfetch is software update. And for me, "keystone" in com.google.keystone.agent.plist looks suspiciously like an abbreviation for "keystone".
I also experimentally did a "sudo chmod 000 /Library/Google". Been quiet so far.
|Re: Four calls by ksfetch each hour||TomMcIn||6/16/12 3:17 PM|
Found ~/Library/Google/Google Chrome Brand.plist created on Jun 7 which is about when ksfetch started to appear.
Will Delete it and see what happens.
There is a folder named GoogleSoftwareUpdate which likely handles Google updates.
The other file is ~/Library/LaunchAgents/com.google.keystone.agent.plist which has a start interval of 3523 - very close to the 3600 second = 1 hour repeat time I am seeing.
|Re: Four calls by ksfetch each hour||Nortonius||6/16/12 3:33 PM|
Activity Monitor reports that the parent process of ksfetch is Google Software Update! Can't find a folder of this name on my iMac...
|Re: Four calls by ksfetch each hour||TomMcIn||6/16/12 4:40 PM|
In /Users/tomm/Library/LaunchAgents there is a file com.google.keystone.agent.plist and in that plist is a string for <string>/Users/tomm/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent</string>
for key ProgramArguments
And there is /Users/tomm/Library/Google/GoogleSoftwareUpdate which contains GoogleSoftwareUpdate.bundle plus other folders.
|Re: Four calls by ksfetch each hour||Nortonius||6/17/12 12:54 AM|
Ah ok I suppose searching Finder for 'GoogleSoftwareUpdate' didn't reveal it because we're not supposed to look in the Library these days – sigh... I found it by following the path you gave. First thing I did was dump the whole folder 'GoogleSoftwareUpdate' in the trash; second thing I did was find this:
It says there to uninstall all Google programs before running one of two Terminal commands, or else Google Software Update will probably be re-installed soon. I 'uninstalled' Chrome via the advice I found above (i.e. in an earlier post); I uninstalled 'Google voice and video' with the uninstaller that came with it (though I don't remember ever downloading it in the first place!); and Google's instructions for uninstalling Google Earth say simply drag it to the trash. Having already dumped the folder 'GoogleSoftwareUpdate' in the trash, I haven't bothered running a Terminal command yet. Fingers crossed: the beast may arise once more, because I haven't done exactly what Google told me to do. Also there was mention somewhere along the way of re-starting your browser after dumping stuff, but I forget where; maybe wise anyway. So far so good: no calls by ksfetch! But frankly...
How very dare Google install their own software updater on my computer without my permission, which quietly does what it damn well pleases without asking me? I only know about it because my security software picked it up. Sod Chrome, I only used it as a 'control' for pages that wouldn't open in Safari: they usually wouldn't open in Chrome either; sod Google Earth, who needs it when there's Google Maps? And as for Google voice and video, I swear I have no recollection of downloading that: I use iChat or Skype as required, so who needs it? HTH, and if ksfetch comes back to haunt me I'll let you know.
|Re: Four calls by ksfetch each hour||seishin||6/17/12 5:48 AM|
I'd not posted to these boards prior to this issue happening. Is there a point at which Google Tech gets involved or are we left to problem solve this & bump heads on our own? I'm getting kind of pissed at the wall of silence. HEY GOOGLE!!! FIX THE PROBLEM!!!
|Re: Four calls by ksfetch each hour||Nortonius||6/17/12 7:09 AM|
7 hours and still no ksfetch calls for me! :) Fingers crossed, anyway... See previous post for what I did. Yes it doesn't look like any Google techs are paying attention to this, I couldn't even find a simple support link anywhere in Google, is there one? I agree, come on Google wake the @!*& up and do something about this... At least tell us when you're going to spring something like this on us! Then we can decide whether we want it or not. And, by the way, Intego's VirusBarrier X6 didn't seem to know what to do with it either, it kept offering me deny/allow on ksfetch calls to IP addresses I'd already blocked! And Intego tech didn't seem interested either, just told me to contact Google... Though, it is Sunday as I write, I've since given them an update so I might hear more from them...
|Re: Four calls by ksfetch each hour||TomMcIn||6/17/12 8:00 AM|
I went back to a "pre Chrome" version of the file
com.google.keystone.agent.plist in /Users/tomm/Library/LaunchAgents
The unexpected accesses continued to happen.
I had renamed com.google.keystone.agent.plist com.google.keystone.agent.plistxxx in my users LaunchAgents folder on the assumption, launched would bypass files that were not named .plist. As mentioned, ksfetch keeps repeating. Now I will move it to LaunchAgentsDisabled.
Seems Google has slithered their new update processes under the name KeyStone (ks) without telling anyone. I use a special admin account to let me know when something is updating OSX files but I guess when they upgrade Chrome in Applications, they got permission to slide the KSFETCH in. So much for Google's "Do No Harm" motto.
|Re: Four calls by ksfetch each hour||TomMcIn||6/17/12 8:01 AM|
When you are caught cheating, maybe it is best to lie low.
|Re: Four calls by ksfetch each hour||dr2chase||6/17/12 8:28 AM|
What worked for me was "sudo chmod 000 /Library/Google/". Presumably I'll need to manually take care of updates, or I can just make it 755 again when I feel like letting ksfetch run.
|Re: Four calls by ksfetch each hour||Nortonius||6/17/12 8:33 AM|
It just occurred to me to look at some dates: the GoogleSoftwareUpdate folder was created on 26 November 2009, but it was last modified on 12 June 2012, just five days ago! That's about when I started getting these ksfetch calls (which I seem to have stopped, none for about 8 hours now). So what's inside the folder? Well, there's GoogleSoftwareUpdate.bundle which was created on 23 May 2012; and there's a folder 'Ticketstore' with one item of interest for its date, 'Keystone.ticketstore' dated 12 June 2012, same as the last modification of the GoogleSoftwareUpdate folder! Looks like that's the offender then, but the date of 23 May 2012 for the .bundle file looks like they were planning this back then.
|Re: Four calls by ksfetch each hour||Nortonius||6/17/12 8:37 AM|
The more I think about how Google have been messing about with my computer, the more pissed off I'm getting! Why are they doing this?! Normally, when someone has an update to offer me, they just notify me! I've never come across anything like this before. Who the X!@& do Google think they are?!
|Re: Four calls by ksfetch each hour||TomMcIn||6/17/12 7:44 PM|
Renamed googles .plist in my LaunchAgents and that did not help. Deleted googles .plist file from my LaunchAgents and emptied the trash and still getting the accesses. Thought LaunchAgents was used to control the scheduled running of such processes. Are these files cached somewhere. Time to lock /Library/Google
|Re: Four calls by ksfetch each hour||TomMcIn||6/18/12 8:23 PM|
Used sudo chmod 000 /Library/Google/ /Library/Google so there is no access to the high level folder /Library/Google/ and no entry for Google in LaunchAgents and still getting the attempted access to Google sites.
Frustrating to say the least. Something else seems to be doing something.
|Re: Four calls by ksfetch each hour||dr2chase||6/18/12 8:33 PM|
What I noticed was that "someone" set the permissions back, and the calls began again.
So I deleted that directory, along with the google .plist files in LaunchAgents (or wherever it was).
|Re: Four calls by ksfetch each hour||Sie_Deen||6/19/12 2:46 PM|
Thanks for your reports. To clarify, Google Software Update is installed together with Chrome, so that Chrome (and any other installed Google products) can periodically check for updates. For Chrome, this ensures that you will always receive security updates and new feature whenever they are available, making sure you are not vulnerable to malicious attacks.
Each firewall/antivirus software has its own specific settings that may block incoming/outgoing/both connections, resulting in the notifications and prompts that you are seeing when Google Software Update periodically checks for new updates. If you want to keep using Chrome and receive updates (when they are available), check that your firewall/antivirus settings have incoming and outbound connections allowed for Chrome.
If you would prefer to not have Google Software Update on your computer, please follow the steps on this article, which is also linked to by Nortonius@. Keep in mind that changing the permissions for the folder containing Google Software Update won't remove Keystone, and may make it impossible to execute some of the steps in the article; you may have to undo any permission changes that you have done prior to following the steps on the article.
|Re: Four calls by ksfetch each hour||seishin||6/19/12 4:20 PM|
You're not understanding the problem. Even Accepting all communications from ksfetch doesn't stop the pop-ups from occurring. ksfetch is unique in that setting firewall permissions either for or against it make no difference, the pop-ups continue. The flaw is in the design & should be fixed by the developer.
|Re: Four calls by ksfetch each hour||dr2chase||6/19/12 4:41 PM|
Not understanding the problem, AND the advice is INCORRECT, as in, will not work.
The specific problem with ksfetch is that each instance is new, written out as an executable in (I think, as I recall) /tmp. THAT is the design flaw that thwarts the firewall settings, because each time ksfetch runs it is a shiny new program and the firewall knows nothing about it. OBVIOUSLY, it would be boneheaded to allow a program through a firewall just because its name matched that of a program already granted permissions (e.g., Safari.app). New executable means new permissions.
And Google, what this means is that your stuff is unusable with a firewall. This is too much of a PITA. If you cannot keep it safe and up-to-date in a firewall-friendly way, I guess I'll just have to uninstall it. Not the updater, the software itself. Kindly return to your drawing board and try again.
|Re: Four calls by ksfetch each hour||Nortonius||6/20/12 3:36 AM|
Sie_Deen, I take it from your little 'g' icon you're posting on behalf of Google? (sorry folks this is my first involvement with any Google forum) You've obviously read through the thread, so thanks for that; but surely, in doing that, you must already have picked up what seishin and dr2chase say above? Every single time ksfetch makes a call, it trips firewalls – or, in my case, VirusBarrier X6. You must also realise that this is a recent development: something fairly new is doing this, and for me it was only this that made me aware that Google Software Update even existed, and was working in the background without me ever being notified!
You say what to do '[if] you would prefer to not have Google Software Update on your computer...', but frankly that's absurd: you're saying that either we run Google software on our computers and allow Google Software Update to run in the background doing whatever it pleases, or we run NO Google software on our computers. Sie_Deen, even APPLE ask my permission before installing updates on my computer, and allow me to read detailed explanations of what the updates are for, because, well, it's MY computer: why should Google behave any differently, as though they can do what they like? It strikes me as extremely arrogant.
1. Google Software Update patently needs a fix, so that it doesn't trip firewalls or other security software *every time* it checks for updates.
2. Google Software Update needs to work like Apple's Software Update – hell, *everybody else's* software update – and have an interface with a setting whereby it can notify the user and ask what to do when an update becomes available.
I hope that's clear; and I hope I and everyone else will be notified when these two points have been addressed, so that we know it's safe to run Google software again. They *will* be addressed, right? (How ironic: in checking for security updates, Google Software Update makes me feel it's unsafe to run Google software... Are you gettting this, Google?)
|Re: Four calls by ksfetch each hour||seishin||6/20/12 5:09 AM|
Sie_Deen, I count 139 firewall notifications about ksfetch since the developer made the change a week ago. This is a major problem. This appears to be the same issue ignored in the post 'google chrome wants to use your confidential information stored in...your keychain' That forum was inappropriately marked as 'Answered' despite the ongoing issues. Please inform the developers of this issue they've created.
|Re: Four calls by ksfetch each hour||codecaver||6/20/12 7:13 PM|
Just adding another voice to this issue. ksfetch is tripping firewall settings for me as well, and for good reason! The way ksfetch functions matches the application behavior I would expect from a Trojan Horse/Virus, not a legitimate service from a company with the motto "Do No Evil". No way in hell I'm letting ksfetch run wild on my machine without supervision. If Google does not officially provide a solution for this, I will uninstall all Google software and begin suggesting that people treat Google Chrome like IE6: run it in a Virtual Machine if absolutely necessary, but otherwise keep it as far away as possible.
|Re: Four calls by ksfetch each hour||dr2chase||6/20/12 7:30 PM|
Hah! I have a great idea for virus writers. Guess what name they should use for the executable that wants to make a network connection....
|Re: Four calls by ksfetch each hour||TomMcIn||6/20/12 8:27 PM|
I was going to let ksfetch run before dr2chase 's comment and I realized that TCPBLOCK works on a whitelist of names. Not going to allow it and will delete Google programs that need it. ksfetch tries to access a number of IP addresses and I doubt TCPBLOCK validates each address.
|Re: Four calls by ksfetch each hour||Twitch_City||6/21/12 7:14 AM|
I am also having this issue on multiple computers. A fix would be EXTREMELY appreciated!
|Re: Four calls by ksfetch each hour||seishin||6/21/12 6:13 PM|
Obviously, these boards are not closely monitored, and I'm sure others have found how hard it is to reach anyone within Google.
Here's a way to reach Google by e-mail; if others follow the same steps, maybe they'll pay attention to what we're saying & finally fix their glitch.
1. Go to: PRIVACY TROUBLESHOOTER script at http://support.google.com/bin/static.py?hl=en&ts=1291807&page=ts.cs
Please view full forum thread at http://productforums.google.com/forum/#!category-topic/chrome/mac/yVump44eeOc for a more complete description of the issue. Here is a summary from our comments: "Since 7-8 days ago, our firewalls have set off 175 alarms and counting, despite setting firewalls to 'Accept All' or 'Deny All' to allow or disallow incoming & outbound connections for Chrome.
And Google, what this means is that your stuff is unusable with a firewall. Users will have to choose between having a firewall or using Google. If you cannot keep it safe and up-to-date in a firewall-friendly way, we'll have to uninstall it. Not the updater, the software itself. Please fix the issue so that we don't have to uninstall Google. Thanks.
|Re: Four calls by ksfetch each hour||Brojex||6/22/12 2:41 AM|
Same problem here since a week. GOOGLE DO SOMETHING NOW!!!!!!!!!
|Re: Four calls by ksfetch each hour||Brojex||6/22/12 2:42 AM|
I will wait until next week, then I'll erase every Google software from my Mac and remove the updater. I'll just go back to Firefox
|Re: Four calls by ksfetch each hour||seishin||6/22/12 7:16 AM|
Having freshly restarted my laptop for the 1st time in a week, I was bombarded by Google's Music Manager sending out 100+ back-to-back alarms. I can't take this. I've dumped Music Manager & am about to trash Google as a whole. It's not worth it. I was neutral before, but I'm growing to hate Google. Their customer service is non-existent & the developers are hack jobs.
|Re: Four calls by ksfetch each hour||Nortonius||6/22/12 8:22 AM|
Grim, huh? I think you're about on the money with your last sentence. I've emailed Google as you suggested, thanks for the tip, I'd about given up trying to find a way through the morass of irrelevant, dead-end stuff to a link which would actually let me contact someone, *anyone* at Google. I hope others email too, and that it gets picked up. But with every passing hour I care less: yes Google are being a complete PITA about this, and I seem to be getting along just fine without any Google software...! So @&*! them.
|Re: Four calls by ksfetch each hour||capracan||6/22/12 10:57 AM|
little snitch (i use for ca 2 years)
give me the path-info about the process (port: 443, tools.l.google.com, https)
i block all connections but the cryptic part is randomized, i think...i use google chrome but no problems before this month, no information about the process....so i block
|(unknown)||6/22/12 2:28 PM||<This message has been deleted.>|
|Re: Four calls by ksfetch each hour||worldpoop||6/22/12 2:30 PM|
I hate this ksfetch thing, it's killing me too. Turning off my firewall is not a choice. Do I really have to eradicate Chrome, Picasa, Chat plug-ins, all that?
|Re: Four calls by ksfetch each hour||seishin||6/23/12 12:33 PM|
I have no idea. And since we're not hearing from any Google reps... HEY GOOGLE!! WTF ARE YOU?!!! (...echoes of silence bouncing back from the Google void, interrupted by ksfetch notices...). I would start by uninstalling Chrome to see if that gets rid of the problem, and slice & dice other Google products from there if needed in order of priority.
|Re: Four calls by ksfetch each hour||Nortonius||6/23/12 2:21 PM|
See my post of 17 June, starts 'Ah ok' for what I did, and I haven't had any ksfetch calls since; nor, on the other hand, do I have any Google software on my computer any more, but the link I included in that post explains why...
|Re: Four calls by ksfetch each hour||capracan||6/24/12 6:54 AM|
|Re: Four calls by ksfetch each hour||capracan||6/24/12 6:59 AM|
how i can backup passwords and so on?....when i know , then i will try to uninstall all the google stuff
|Re: Four calls by ksfetch each hour||Z-12345||6/24/12 5:04 PM|
I am also getting alerts about ksfetch via Little Snitch. This is really unacceptable for a software updater to constantly create new processes with a randomized identity, making it impossible to permanently allow or deny. I am looking forward to Big Google Brother fixing this and secretly installing the patch on my computer while I sleep.
|Re: Four calls by ksfetch each hour||freakqnc||6/24/12 6:05 PM|
Sadly Google is notorious about not giving support for its products, free or paid for. Until they get in the business of giving a flying f**k about users the only usable services are search, email and maps. The rest are services like Picasa (which I basically had to abandon because it would lock constantly when updating images/videos making the service unusable, drive I won't even start ranting as this is not the appropriate venue, suffice to say is not quite there yet like many comparable services, and I'll leave it at that.
I will not use until they'll get serious about them inclusing providing support and listening to user feedback.
My own personal experience with how supports operates when it comes to receiving support is the main reason why I'd never even consider in the remotest of ways to buy a chrome book or any such consumer/SOHO level hardware/software. I am actually surprised Google is even thinking it can put out services like that and not back them with any responsive support.
Until things change and the geniuses at Google will eventually wake the F up, you can try on OS X10.6.x to go to terminal and issue this command:
defaults write com.google.Keystone.Agent checkInterval 0
That should turn off the monstrous annoyance in your little snitch... it's a pity that Google continues to completely ignore the user community and relies on this antediluvian way to provide support (Group BBS) where most posts are "me too" problem descriptions where we all pitch in to share out frustrations and a handful are possible solutions/patches.
...and there's never a Google support rep in sight sometimes for months and in some posts even years.
That said I hope the info above will help some mac users keeping Google software installed but effectively having the terribly written Agent shut the F up and get our of the way once and for all.
PS: Google if you are listening maybe could consider to add a pref in the system prefs for the agent or in Chrome (?) to manage how frequently update checks should happen. Alternatively you could simply have the updates run at launch or have a fix (rather than random) process that would take care of scheduled checks... there are many possibilities to make this right... question is, will you give a flying this time?
|Re: Four calls by ksfetch each hour||dru347||6/24/12 6:57 PM|
Everyone complaining, be sure to use the "Help" -> "Report an Issue" menu to from inside Chrome.
|Re: Four calls by ksfetch each hour||seishin||6/24/12 10:55 PM|
Thank you so much, freakqnc!!!
|Re: Four calls by ksfetch each hour||worldpoop||6/25/12 12:35 AM|
Yes, thank you freakqnc!
The irony is, if Google ever bothers to find and fix this, you won't automatically get that update. But oh well... this is still a huge relief, thank you!
|Re: Four calls by ksfetch each hour||blazicekj||6/26/12 7:26 AM|
I would reccomend 1password or similar service. In fact, I think it's much preferable to have your passwords stored in an external application than a browser. The integration with browsers is pretty much seamless. But the exporting itself probably does have to be done by hand (e.g. install 1password, go to a site, log in, accept a prompt to save your pwd in 1password).
|Re: Four calls by ksfetch each hour||hejsan||6/27/12 6:32 AM|
The reason the firewall programs can't block it properly is because a new executable called ksfetch is created each time with a different path. Thus in my Little Snitch rules I now have a trillion lines with /tmp/lk0dfs9somerandomcrap/ksfetch. It is never the same path and that just doesn't go well with firewall rules. They don't allow wildcards.
So if some Google employee reads this please point out to your supervisors that it is bad programming to generate a new executable with a random path every time something needs to be done.
|Re: Four calls by ksfetch each hour||heavyboots||6/28/12 10:38 AM|
This is pretty much the way I handle Google Update too.
Back when google decided to update all their products automatically, I just Get Info->Locked the folders right after emptying them. Same way I handle cookie files. Let the OS deny the access…
|Re: Four calls by ksfetch each hour||Sie_Deen||6/28/12 2:40 PM|
If you disable the Google Software Update by setting com.google.Keystone.Agent checkInterval 0, keep in mind that you may miss out on automatic updates that includes security updates, and updates to new features. Alternatively, you can set 0, to a different elapsed time in seconds for the frequency to check for update.
Some of you have mentioned seeing notifications for ksfetch from Little Snitch, which is a 3rd party outbound traffic monitor (not a firewall software), that checks executables by path instead of file content or code signature. We appreciate your input and definitely take your points into consideration.
|Re: Four calls by ksfetch each hour||seishin||6/28/12 3:15 PM|
Google's last automatic update was awesome, thanks for that. If not for the most recent update & ensuing lack of tech support, disabling Google's software updates wouldn't be on the table for discussion.
|Re: Four calls by ksfetch each hour||worldpoop||6/28/12 4:05 PM|
Thank you for the much coveted feedback, and I hope you will consider addressing these frustrations. I appreciate the note about 3rd party software like Little Snitch. However, folks have noted that other firewalls have difficulty too, as good firewalls (rightly) consider path in their filtering. Regardless, the third-party thing seems a bit of a dodge as no other software other than Google update has ever exhibited this difficult behavior on Apple products...
...and Google Update is likewise third-party software!
Third-party software should behave.
It should not be spawning Cylon clones all over one's computer unbeknownst to the user, which poses a host of potential complications beyond triggering firewalls. This is new behavior for Google Update. Not good behavior. It seems likely to me that other OS bugaboos could result, though general users would have no way of identifying the keystone "multi-spawn" as the culprit. It's not wise programming design, neither is it friendly.
|Re: Four calls by ksfetch each hour||dr2chase||6/29/12 9:07 PM|
I want my software up to date. I want my internet connections monitored. I want to not be unnecessarily interrupted because you guys can't get this right.
All you need to do is stop writing a brand new executable out to disk for each instance of "ksfetch". I just reinstalled Chrome, and what did it to, but fire up "/tmp/KSOutOfProcessFetcher.pkaQthDyiZ/ksfetch"
Cut it out, okay?
|Re: Four calls by ksfetch each hour||codecaver||6/29/12 9:54 PM|
Intego Virus Barrier is also generating these notifications. I would imagine that Norton and other advanced virus protection / Internet security suites are as well. I've uninstalled all Google desktop applications from my computer. Hopefully Google will correct this issue in the near future so I can return to using Chrome.
|Re: Four calls by ksfetch each hour||FelixAdam||6/30/12 10:09 AM|
I think it is not bad that there is an update check ... But why in a tmp folder and why does it change it's folder every fucking time?
This makes it extremely hard to white-list the daemon in my firewall settings.
Google please make this optional and get rid of the folder bouncing.
|Re: Four calls by ksfetch each hour||Brojex||7/1/12 7:57 AM|
This is unacceptable. I'm uninstalling every Google software from my mac, as suggested.
|Re: Four calls by ksfetch each hour||genenyc||7/1/12 4:58 PM|
And does the average lay person, know how to do this, probably not. As previously mentioned that is a very bad business practice on Google's part to release software that is so intrusive, behaving like a virus or spybot. and for the rest of the group, I started having this ksfetch problem with Little Snitch ever since installing Music Manager/Google Play. I couldn't understand why this was happening repeatedly from the same service and port until hejsan explained that a random path is generated each time. What a nuisance! Makes we want to never install any Google Apps on my Mac again!
|Re: Four calls by ksfetch each hour||Chellspecker||7/2/12 3:10 AM|
What interval would you suggest to mitigate the irritation involved in having to allow the new connections approximately every hour (3523 seconds) without missing out on security updates? How often do they come out? What would be a secure interval?
defaults write com.google.Keystone.Agent checkInterval 0 = never
defaults write com.google.Keystone.Agent checkInterval 3523 = once every 0.9786 hours (your default, as written, which is what all these complaints are about)
defaults write com.google.Keystone.Agent checkInterval 86400 = once every 24 hours
defaults write com.google.Keystone.Agent checkInterval 604800 = once a week
I have to wonder if it's more than just security and new feature updates that we're supposed to be finding out about. Do you really need to know what version of your software we're running every hour? I understand security threats like viruses etc. disperse quickly and the quicker security fixes can be implemented the better.
I'll be blunt: are you also collecting information about users' browsing, searching or other computer/internet use? I believe this is information which many advertisers are eager to get their hands on in order to better tailor our "user experience", and wonder if you might not be providing it to them surreptitiously. Certainly sending out encrypted information every hour without telling people it is happening, without telling them how to stop it, and suggesting it's in their best interest to let the info flow looks a bit suspicious. Or maybe I'm just paranoid. I'd appreciate any clarification you feel inclined to offer. Thanks.
|Re: Four calls by ksfetch each hour||msgabbani||7/2/12 4:11 AM|
It shows up if I use Safari and Firefox as well.
|Re: Four calls by ksfetch each hour||Nortonius||7/2/12 5:27 AM|
On Monday, 2 July 2012 12:11:06 UTC+1, msgabbani wrote:It'll show up no matter what you use, if you don't fix the source of the problem in Google software – I politely advise you to read the thread! :o)
|Re: Four calls by ksfetch each hour||p4pan||7/2/12 11:50 PM|
I also got this annoying little snitch popups every time I need to change my user.
do you mind to open an improvement request with your developer crew so this stuff gets changed if not already done? This would be an "urgent" request.
So far the only solid "fix" is to change the permissions and make this folder inaccessible but this cannot be a permanent solution.
chmod 000 /Library/Google/GoogleSoftwareUpdate/
Unfortunately a FW cannot predict a random path of an executable google is creating in /tmp every time this stuff gets triggered.
Thanks in advance
|Re: Four calls by ksfetch each hour||NotToScale||7/4/12 9:47 AM|
I've had this problem for a very long time. I searched it a while back and saw that it was from Google, and since then have been constantly "accepting" these connections. Just today I realized, what if today's "ksfetch" was not from Google? Do I have to play detective every five minutes?
I'm not a unix power user, so I am hesitant to start typing commands into a terminal window. That's not a solution for the long run.
To me it appears this "Auto-update" nonsense runs like a virus. Can't uninstall it. Doesn't jive with the firewall. Won't go away. There must be someone outside Google we can talk to? A government agency? An antivirus company who can make more people aware of the issue? A media outlet? This is a serious flaw and if Google is going to ignore it, we need to make more noise.
|Re: Four calls by ksfetch each hour||TomMcIn||7/4/12 10:47 AM|
Previously posted this in the wrong topic
This just came via http://www.infoworld.com/t/cringely/10-worst-tech-screwups-of-2012-so-far-196433?source=IFWNLE_nlt_notes_2012-07-02
I reloaded Chrome and turned on the Update check in the About Window. DUMB. Started getting calls to KSFETCH every hour. The hourly setting is in my System > Library > LaunchAgents > com.google.keystone.agent.plist . My user setting is 86400
Are you using a virtual machine? Chrome only updates when an update is pushed to users on the same channel. If you are using a different device and have a custom channel that might be something to consider.
I am not using a virtual machine, just pure OSX. I do have other Google products on my system. Reinstalling Chrome restarted the calls to ksfetch. The ports being hit on are
|Re: Four calls by ksfetch each hour||codecaver||7/4/12 11:17 AM|
I agree with @NotToScale and would like to see this topic covered somewhere like Engadget or TechCrunch to gain publicity. This application behavior is completely unacceptable.
|Re: Four calls by ksfetch each hour||worldpoop||7/4/12 12:18 PM|
Interesting where this discussion has gone, arriving at the InfoWorld mention and surely what this is really about. As a simple update service there is no need / incentive to be so aggressive and evasive. This is exactly what Little Snitch and other security filters are for, to identify such misbehavior.
A thought experiment: Imagine Firefox exhibiting this behavior? Exactly. And here's why -- none of us here are Google customers. The advertisers are the customers and we users are the products. There is nothing wrong with that! -- that is how most free television works too. However, for us we pay not with a monetary fee but in our exploitation. By mining and spying on users, Google improves the quality of the product that advertisers pay far, and that's the fine line here. Unlike television, Google as an interactive network service has much greater opportunity to invade our lives, not just our senses. Without a check on that, going too far is not an if but a when. However government regulation is a slippery slope where individual freedoms and rights often so the slipping and sliding. So where's the oversight? I think it has to be users, constantly. And media.
Anyway, by way of example, if you go to the Engadget website http://engadget.com , at the bottom right is a tiny link that says "tip us on news". My pontifications above are bold enough, and I don't feel like going farther than this discussion thread, but maybe other people want to push it and suggest these issues and topics to the mags. Codecaver and NotToScale might have a good suggestion. Other sites like Techcrunch have their various means of contact too. Have fun. Oh, oh yeah, interesting page on contacting Google Customer service (and how to!): http://tinyurl.com/5pr4ab -- but we all knew this.
|Re: Four calls by ksfetch each hour||surfaces||7/5/12 12:16 PM|
Sie (or anyone else), how do I "set com.google.Keystone.Agent checkInterval 0"? I'm not new to tinkering with software settings, etc... but I have no idea where this can be changed...
|Re: Four calls by ksfetch each hour||spikewerx||7/5/12 12:33 PM|
according to http://forums.obdev.at/viewtopic.php?f=1&t=6720&start=0
who are the guys that develop little snitch:
"To stop the ksfetch (Google's auto-updater software) from checking every hour run the following in terminal:
defaults write com.google.Keystone.Agent checkInterval 604800
604800 is a week in seconds. Divide by 7 to check daily.
Keystone agent is generating a new temporary executable file on each update check. This is why Little Snitch is asking repeatedly for permission. If Little Snitch were updated to allow regex for name checking then this could be solved. No doubt this would introduce other issues that would need to be considered."
have done this, and will see if it makes a difference.
|Re: Four calls by ksfetch each hour||swagv||7/7/12 11:10 AM|
This didn't work for me.
Add me to the people who were brute-force compelled to chmod 000 the Google Updater directory.
Nice job, Google. I see your software design standards have gone into the crapper.
|Re: Four calls by ksfetch each hour||neverman||7/7/12 8:54 PM|
On Sunday, June 17, 2012 8:58:24 PM UTC+5:30, dr2chase wrote:
> What worked for me was "sudo chmod 000 /Library/Google/". Presumably I'll need to manually take care of updates, or I can just make it 755 again when I feel like letting ksfetch run.
I've read everything in this forum, and found a lot of useful info. I'm trying dr2chase's Terminal command string and will see how this works.
Given I don't have Chrome, I did check Library/Google and did find the GoogleSoftwareUpdate folder per others posts in this forum. It includes an item GoogleSoftwareUpdate.bundle, and another folder called Ticket Store with two items: Keystone.ticketstore & Keystone.ticketstore.lock. The GoogleSoftwareUpdate.bundle element was added dated 5/12/2012, while the Google & Ticket Store folders and Keystone components are dated 2011. So my guess is the GoogleSoftwareUpdate.bundle is the culprit.
I will try running dr2chase's Terminal command and see how that fairs before deleting the GoogleSoftwareUpdate.bundle.
|Re: Four calls by ksfetch each hour||Thomas01||7/8/12 1:08 PM|
Sie_Deen, com.google.Keystone.Agent did not contain the "checkInterval" variable on my system, nor any other interval variable, and ksfetch was attempting to access the Internet three times in a row every hour. It seems that different Google products use the prefs file differently, and have different means of setting the update check interval.
The only Google product I had installed was Google Drive. Due to the poor behavior of ksfetch, Drive is now gone.
|Re: Four calls by ksfetch each hour||goldlaus||7/9/12 2:59 PM|
unfortunately "sudo chmod 000 /Library/Google/" did not work for me either. after a while the perm was set back to the default (WFT!!).
even with a while do chmod bla; sleep XX; done in the background job I still received this annoying popups over and over again. so some google crap is constantly changing this back.
I had no choice, I removed all google apps and installed opera and also try safari even though Im pissed off as chrome was nice to use. maybe in the future again but not for now.
I have to admit that google inc really did some damage here....
|Re: Four calls by ksfetch each hour||ksfetch||7/11/12 2:46 AM|
bye google. Thats no way for me
|Re: Four calls by ksfetch each hour||tiktik36||7/11/12 7:21 AM|
You can stop Chrome from updating by using terminal commands in mac ... and something else in Windows that I don't know...but check it out here.
(Though google seems to have messed up the terminal command...don't add the $ to the beginning of the command)
|Re: Four calls by ksfetch each hour||dr2chase||7/11/12 1:11 PM|
Note that clicking Chrome "About Google Chrome" seems to trigger an update check.
It did do an update, and it did not change the checkInterval.
Things are not completely insane.
|Re: Four calls by ksfetch each hour||TNTechy||7/11/12 9:24 PM|
Try 'sudo defaults write com.google.Keystone.Agent checkInterval 0' to disable the updater permanently. Seems to be working for me (only restarted once, but littlesnitch has stayed quiet, as opposed to asking for ksfetch permissions every single boot up and every freaking hour.
Google, you suck. Even if some of your products are the best.
|Re: Four calls by ksfetch each hour||Epsilonindie||7/14/12 8:47 AM|
I do not have Chrome but the problem reported by the group in this conversation is also happening to me with Firefox. Please I need this harassment to stop! Any ideas? Help!
|Re: Four calls by ksfetch each hour||hdcase||7/15/12 9:20 AM|
Didn't knew exactly who had the problem, but for Hands Off (OS X Firewall), the trick was to add a rule on "All Applications" to allow networking & resolving to tools.google.com.
Using the same trick may work in other firewalls as well
|Re: Four calls by ksfetch each hour||dm33||7/15/12 11:21 PM|
More than consideration, it needs to be fixed, and soon. This is inspiring people to uninstall Google software or disable software updates or disable outbound firewalls. This can cause even more security issues.
Please fix. Sounds like you're complaining about Little Snitch doing its job rather than fix shoddy programming of a stealth application that imbeds like a virus.
|Re: Four calls by ksfetch each hour||sastian||7/19/12 3:22 PM|
agreed. im getting pretty pissed about this!
|Re: Four calls by ksfetch each hour||sunstorm||7/24/12 2:21 PM|
Try the workaround on the german website:
Hope it works!!!
|Re: Four calls by ksfetch each hour||sunstorm||7/24/12 10:12 PM|
... NO CHANCE!!! ... WE NEED HELP FROM GOOGLE !!!
The cause is obviously the background-updater from Google Chrome!
|Re: Four calls by ksfetch each hour||goldlaus||7/25/12 12:17 AM|
I did this with the google folder in the user library but only after I ticket the "locked" checkbox the messages disappeared I believe (or lat least I dont remember seeing those again)
|Re: Four calls by ksfetch each hour||nevso||7/25/12 2:59 AM|
This is the German workaround ...
"In the software (Google Earth, Google Chrome, Google Gears and Picasa Goolge), there is unfortunately no settings. So a further search on Google shows that the Google software update is a separate library that you can locate here:
Library / Google / Google Update software /
Anyone who thinks that it simply extends the list to delete and its gone, which has cut itself ... The Google Apps have installed all of a check, the check whether the Google software update directory exists and if not this just "fix" automatically ...
If that was not near enough to the definition of malware is in search times for an uninstaller or instructions from Google on how to remove the Google Software Update can ...
Do not go. There is no uninstaller there. The most common suggestions are to delete the Google Apps and Google Earth just to give Google Chrome, Google Gears and Picasa Goolge ... Not exactly practical ...
So there is only a workaround , we have applied themselves.
This sets the permissions of the directory Library / Google / Google Update software / just so that the ksfetch can not be started.
Simply list the Google Software Update found in the above path using Finder, then click the right mouse button and select in the context of "Information" dialog.
Then, the bottom of the window, rising to the directory the user rights are set.
Normally, these rights are grayed out and can not be modified directly. Clicking on the padlock in the bottom right corner of the window, opens a new window in which one gets with username and password the admin rights.
If the lock is open again, the directory permissions are set as follows:
System: Read & Write everyone: no rights
The folder will then receive a "one-way road-sign" in the lower right corner and the message disappears from ksfetch in Little Snitch since the Google Software Update can not be started.
If the trick worked for you too? Do you have a better solution to the problem? What you say about malware on Google?"
|Re: Four calls by ksfetch each hour||TNTechy||7/29/12 1:05 PM|
This is still working for me btw. Haven't seen that annoying thing since and I can still use Chrome.
|Re: Four calls by ksfetch each hour||jeykota||7/31/12 2:44 AM|
LITTLE SNITCH + GOOGLE CHROME = KSFETCH ISSUES. So Entering the following code into your terminal will make it CHECK ONCE A WEEK rather than every few hours:
defaults write com.google.Keystone.Agent checkInterval 604800
If you want it to check for updates every month (30 days), just replace the number of seconds to: 2592000
I got rid of the callback entirely by changing the permissions on the root /library/google/googlesoftwareupdate folder to 'No Access', but this makes that Chrome doesn't keep me logged in to sites after quitting where I said to remember me. Not a big problem, but you should know that.
I hope this helps you all getting rid of the annoying popups with Little Snitch and VirusBarrierX6.
|Re: Four calls by ksfetch each hour||surfaces||8/2/12 10:59 AM|
The terminal command that jeykota posted has worked for me for many weeks. Use it, it works, and it is a piece of cake to execute. Copy> Open Terminal> Paste> Press Enter> DONE
|Re: Four calls by ksfetch each hour||sunstorm||8/2/12 11:47 AM|
Yes it works perfect! TXS!
|Re: Four calls by ksfetch each hour||Epsilonindie||8/2/12 12:28 PM|
Does anyone know if that works also for Firefox? I don't have Google Chrome installed and am hesitant about introducing a wrong command in my terminal.
|Re: Four calls by ksfetch each hour||worldpoop||8/2/12 1:16 PM|
Not sure what you mean by "also works for Firefox?"Does anyone know if that works also for Firefox? I don't have Google Chrome installed and am hesitant about introducing a wrong command in my terminal.
The Google updater agent runs independent of any browser, whether Chrome or Firefox or Safari or whatever. The hellspawn keystone thingie is its own devil baby. It was put there by Google software -- almost anything Google makes is culpable, like Picassa, not just Chrome -- where it endlessly copies evil robot monsters into ever changing temp directories, a raging fire you cannot stamp out. Is that too dramatic? It's like a grease fire -- big gulps of flaming grease lobbed out from wack-a-mole holes -- so ever don't throw water on it or the fire sauce will splash everywhere and crisp everyone to ash flakes! Silver bullets AND wooden stakes are required to kill it. What you are doing with this command is very simple: You are changing one value that is housed within a preference file hidden inside of Mac system file folders. The preference file is called "com.google.Keystone.Agent" and it guides how the evil robot monsters behave. (If you try to delete this preference file, in all likelihood it will come back -- and deleting or locking files has the potential to mess up your system. But changing this one value in one tiny preference file is really extremely safe and Google seems to endorse it.)
The "defaults write" is writing a new higher value into "com.google.Keystone.Agent" -- that's all it's doing -- in this case, to deploy the evil robot monster every 604800 seconds, which once every week, instead of once every several minutes.
All you have to do is copy and paste that command into Terminal and hit enter. That's it. It will tell you if there was a problem.
You can modify the value to "0" instead of "604800", and then it will never run again. BUT -- warning -- the problem with that is, if Google EVER finally remedies the evil monster robot scourge, it will be in an automatic update that you get through this evil robot monster. So you do well to let it run every once in a while. Every week it will wake up and then keep banging its head against your applications filter or firewall until you let it through the door. That's much less painful than having it f-up your computer several times an hour while you're doing some important video conference or whatever. (Ugh!! Google!)
If 604800 seconds is one week, than you can halve or double it etc. to shorten or lengthen the interval. Perhaps you want it to run only once a month? Or you are eager for that elusive update that will finally tame the evil robots (...or you just want to keep your other Google software such as Chrome up to date as possible)? Then you can run it once every day or couple of days. Again, keep in mind, when it runs, it will keep hopping into new temp directories and bash its head against the filters of any number of security applications, noisily, until you let it through once. (It is either really bad or really evil programming, or both.) Then it will be quiet again until the next run.
Here is a great primer on the "defaults write" command. You don't have to try to understand it really, but in a quick skim it provides an easy and helpful orientation.
Just copy and paste the defaults write line quoted above in green inside terminal. Done right you won't hurt anything at all, and you can always revert back in one stroke (which the linked article tells you how to -- but there is no reason to really).
|Re: Four calls by ksfetch each hour||Nortonius||8/2/12 2:36 PM|
lol 'evil robot monsters'! Very good, I like it! I can't believe how long this has been going on...
|Re: Four calls by ksfetch each hour||seishin||8/2/12 2:51 PM|
I think if Google ever intended to fix it, they would have acknowledged there was a problem. I have to feel this was done intentionally.
|Re: Four calls by ksfetch each hour||Nortonius||8/3/12 5:34 AM|
...and I have to feel that you're right about that. I contacted Intego (VirusBarrier) about this issue early on, and they just said to contact Google, which is how I ended up here: maybe it's time that they contact Google. It's certainly well past time Google contacted Intego and all the rest, to sort this out with them. I might contact Intego again, and point them here. Anyway, maybe Google should add 'and don't be arrogant, lazy sods' to their motto, not that they seem to remember having a motto these days...
|Re: Four calls by ksfetch each hour||dcbrock1||8/3/12 7:39 AM|
Nortonius: Could you post the way to kill ksfetch in language that the general reader -- who is not entirely computer literate -- can understand? I have Intego VirusBarrier and the notifications about ksfetch are driving me crazy. Thanks in advance for your help.
|Re: Four calls by ksfetch each hour||Nortonius||8/3/12 11:21 AM|
Well I can try! Forgive this little preamble, but I can claim no credit, as I originally came here in search of answers myself, and have only followed where others have led. The most recent post to really nail it is that by worldpoop on 2 August, who, like others, explained how to 'control' ksfetch. There is another method of dealing with the issue, which I adopted, and that's to remove all Google software from your computer. That may seem drastic, but it's been weeks now, and I haven't felt I'm missing anything – I suppose that depends on the individual. It does mean, though, that I haven't tried the method described by worldpoop, so I can only hope that I've got the following right. By the way, you do know that you should always back up your computer to another drive before you fiddle with its brain?! Time Machine is your friend...
The 'control ksfetch' method:
1. First things first: you know how to Copy and Paste? My mum doesn't, but I'm going to assume you do! Copy this:
(If you really don't know: click and hold the mouse button down just to the right of that text, move the mouse pointer to the left over that text, then let go of the mouse button just to the left of it – that text, and be careful that only that text, should now appear in a block of colour, meaning it's 'highlighted'. Open the 'Edit' menu in the menu bar across the top of your screen, and click on 'Copy'; for now, just remember that to Paste, you open the Edit menu and click on 'Paste'. If you're not using a mouse, I'd bet cash money you know how to Copy and Paste!)
2. Go to your 'Applications' folder: this should be in your Dock, near the Trash – if it is, click on it once and a menu will appear with items listed alphabetically. Look for a folder called 'Utilities'; place your mouse pointer over that folder and another menu will appear, including an item called 'Terminal': click once on Terminal. You should now see 'Terminal' to the right of the Apple logo in the menu bar across the top of your display, and a little window showing mostly gibberish. So far so good: if for some reason the Applications folder isn't in your dock, or if you simply prefer, click on 'Finder' in the dock and a Finder window will appear, with a sidebar down the left side listing items such as 'Desktop', 'Macintosh HD' and 'Applications'. The next bit is easiest if your Finder window is in 'column view'. If you don't have that set already, you can get it from one of the buttons across the top of the Finder window: ignoring the coloured buttons at top left, you have, from the left, a button with a 'left/back' arrow, a button with a 'right/forward' arrow, a button with four little squares, a button with four horizontal lines, then a button with a block of three vertical columns: if that button isn't dark already, click it now. Now go back to the sidebar at left and click once on Applications. Now there should be a column immediately right of the sidebar showing an alphabetical list of applications: scroll that list until you see the folder 'Utilities', click on it once, and a new, similar column should appear immediately to the right: scroll that until you see 'Terminal' and double click on it.
3. When you see 'Terminal' next to the Apple logo, and have a little window of gibberish to look at, just Paste (open the Edit menu, click on 'Paste'), then hit the 'Return' key on your keyboard. Now you can quit Terminal, and ksfetch should only bother you once a week, instead of many times daily: the point is that the text you pasted ends with the number '604800', which is the number of seconds in a week. If you wanted, you might multiply that number by four, giving you '2419200', and paste that instead: it's the number of seconds in four weeks, so that's how often ksfetch would bother you. Another option would be to change that number to '0', in which case ksfetch would never bother you again – but then your Google software would never update itself.
So, that's the 'control ksfetch' method – sorry if it's a bit long-winded, but I wanted to explain as much as possible, I can only hope it's clear! If you want the 'remove all Google software' method instead or as well, I could have a go at that too... Hope that helps.
|Re: Four calls by ksfetch each hour||dcbrock1||8/3/12 11:27 AM|
That is so incredibly helpful. Thanks so much!
|Re: Four calls by ksfetch each hour||Nortonius||8/3/12 2:13 PM|
I only hope that I've got that right, and that it works for you! Let us know if it does. And, if anyone spots an actual mistake in my version of the 'method-I-haven't-tried', I hope they'll set us straight! Cheers.
|Re: Four calls by ksfetch each hour||Dris222||8/4/12 9:32 PM|
This bug is incredibly annoying. Seems to come back when you reboot. I am going to write to the Little Snitch Team to see if they can modify their app to cope with the scenario caused by ksfetch. However the real issue is Google's. I hope someone from Google reads this because they should fix their code to stop this problem. While what they are doing by creating a temp applications is legal - it must be driving all apple users that use little snitch nuts. Particularly those that do not have the nous to resolve the issue.
However there is enough comment out there that they can learn that it is a Google problem and that is poor press for Google.
|Re: Four calls by ksfetch each hour||stamfordman||8/5/12 4:46 AM|
I can't get rid of it all - not with the Terminal command or with Little Snitch settings - it's still popping up twice in quick succession about every hour. I've stopped using Chrome anyway as Safari now seems to have leapfrogged it in speed - can it be eradicated by getting rid of all Google stuff and how to do this?
|Re: Four calls by ksfetch each hour||TomMcIn||8/5/12 7:59 AM|
You could try asking Google help, including the reason, but they are so conceited, dense and slow that will likely be a waste of time. Appcleaner - from Download AppCleaner for free from the developer - and described in http://osxdaily.com/2012/02/15/delete-applications-mac-os-x-appcleaner/ has removed problem applications for me. It claims to remove all related files.
The main culprit in all this seems to be the Google / GoogleSoftwareUpdate folders that are created in both the System and User Library s. I came across the problem using TCPBlock that lets me know when a program like ksfetch is trying to access the Internet from my system.
|Re: Four calls by ksfetch each hour||dcbrock1||8/5/12 8:32 AM|
The copy/paste into Terminal has worked so far! No ksfetch call warnings setting Intego Virus Barrier off since running the command.
|Re: Four calls by ksfetch each hour||Nortonius||8/5/12 9:47 AM|
@ dcbrock1: Thanks for letting me/us know that worked for you – a relief for us both...!
@ stamfordman: Yes, delete folders as TomMcIn says, called 'GoogleSoftwareUpdate', and be sure to delete all Google applications, or any of them will soon re-instate the deleted folders! Apart from Google Chrome and Google Earth there's Google voice and video (which I would swear I never installed, I've certainly never used it, and yet there it was on my own iMac, so look out for it!) and Picasa, there may be others I don't know about...? You might want to look at this, too:
|Re: Four calls by ksfetch each hour||seishin||8/5/12 10:40 AM|
After deleting all Google programs, make sure no Google product is set to launch upon startup (found in System Preferences).
|Re: Four calls by ksfetch each hour||rupps||8/8/12 5:52 PM|
maybe it's a little late, I've been also very upset by Google's virus stealth techniques with ksfetch, changing the name of the exzecutable and driving my firewall crazy.
I've managed to block it, it's pretty easy.
Every other thing I've tried has failed.
|Re: Four calls by ksfetch each hour||flyabout||8/17/12 1:52 AM|
Go to /Library/Google/ and copy it to your desktop. delete GoogleSoftwareUpdate, Lock it and replace it with your old one.
|Re: Four calls by ksfetch each hour||Epsilonindie||8/18/12 7:17 AM|
Hi, thank you. Unfortunately it has not worked out and I keep having 2 consecutive messages from ksfetch every 15 minutes... It's driving me mad!!! I hate it!!!! I suddenly hate Google very much indeed: consecutively 2 times every 15 minutes, every day
|Re: Four calls by ksfetch each hour||worldpoop||8/18/12 1:29 PM|
Hi folks, if you're using the
defaults write com.google.Keystone.Agent checkInterval 2500000
method (simply entered into terminal, which delays the check to only once every 2,500,000 seconds, which is once a month -- or change to "0" for never, although if Google ever deigns to fix this, you'll want the update), then keep in mind that you STILL have to "satisfy" the LAST call or it will keep screaming every few minutes! This "defaults" method in IMHO is the best "solution". So let the one call through your filter or firewall to check and finish its update, then this effing virus will shut the poop up for two and a half million seconds -- one month -- until the next check... of course executed sneakily from some new temporary directory. Each month (or whatever you set the interval to) you need to say "yes" to it: to click it through your application filter or firewall just once (well, actually, twice in rapid succession) in order for this to work.
It's a heck of a lot better than every two minutes. And this is the only workaround apparently that the cocky Google royalty "supports", reluctantly, to "opt-out" of what they pretend is in all of our "best interests". (Imagine any other third-party software behaving this way!) I choose the "approved" method instead of deleting or locking files and folders or whatever, to avoid any unintended consequences down the road of mucking with system files, installs or permission changes (which may not stick after updates or routine system tasks.)
|Re: Four calls by ksfetch each hour||capracan||11/25/12 1:43 PM|
Hi, i follow the "erase alle google products"-Idea...I use now SRWareIRO (Chrome Clone) looks like Chrome and its okay for me, no ksfetch-Message. The Idea to change some Google-Folders to "no access" or something, dosn´t work on a Mac (OSX 10.6.8), for me. So i Backup nessaccary Files like Links and so on and delete alle Google-Products (Googl Earth, Chrome) and now its quiet.
delete, google, files, mac, win, ksfetch, erase, maleware, chrome, earth,
Try this for Win7:
Search "Google" and/or "Software" and/or "Update"....kill Folders and Files, if u not sure don´t kill.
Make alle Files Visible:
1. Open Terminal:
defaults write com.apple.finder AppleShowAllFiles TRUE;killall Finder
3. type to make it reverse:
defaults write com.apple.finder AppleShowAllFiles FALSE;killall Finder
4. The finder restart to activate it.
After Point 2, don´t forget to search google files and Products
Last Way kill your PC on Win/Mac: