"Flash Player Auto Update Daemon" is not optimized for your Mac

A disturbing dialog just popped up on my iMac.

But... but... I don't have Flash Player on my system. Has a trojan installed the notoriously insecure Flash Player?

This isn't the first time I've seen this dialog since upgrading to Mojave. The last time I inadvertently dismissed the dialog before capturing its content. This time I quickly grabbed a screenshot and decided to do a brute-force search, using find from / .

The search was fruitless, but it did reveal another mystery: several directories into which find could not traverse, even when run via sudo. My extended-attribute skills are rusty, and I could not figure out how to gain read access to directories like /Library/Application Support/com.apple.TCC. *sigh*

Given its unprompted appearance I assumed the warning dialog was triggered by a periodic daemon. So a recursive grep through the system LaunchAgents and LaunchDaemons was next on the list.

That was unsuccessful. Search again from the parent directory:

$ cd /System/Library
$ grep -rli 'Flash Player Auto Update Daemon' .

In contrast to find and its "Operation not permitted" warnings, grep issued a series of "No such file or directory" warnings. Intermixed with the warnings was one hit: ./CoreServices/CoreServicesUIAgent.app/Contents/Resources/ThirtyTwoBitDisplayNames.plist

$ plutil -p ./CoreServices/CoreServicesUIAgent.app/Contents/Resources/ThirtyTwoBitDisplayNames.plist | less
...
      "names" => {
        ...
            "fpsaud" => "Flash Player Auto Update Daemon"

Just as a guess, the "names" list maps from actual executable/app names to the names which are presented to the user to describe apps that are "not optimized for your Mac".

$ cd /
$ find . -name fpsaud
...
/Library/Application\ Support/Adobe/Flash Player Install Manager/fpsaud

In the early 2000s I had Flash installed on an earlier Mac, from which I'd migrated to my current iMac. Once the trickle of Flash security warnings grew into a stream I decided to get rid of Flash and, ultimately, all Adobe software products. But I hadn't been thorough. /Applications might be Adobe-free, but /Library/Application\ Support had both an Adobe/ directory and a long-since-forgotten Adobe_save/. In both directory trees, no file was newer than 2011.

rm -rf Adobe/ Adobe_save/ took care of the immediate problem, but where was the LaunchAgent or LaunchServices entry that was trying to launch fpsaud?

The short answer is that I don't know.

In ~/Library/LaunchAgents/ I still have a com.adobe.ARM.925793fb327152fd34795896fa1fb9ffa268b2a852256fe56609efa3.plist, but it references a non-existent /Applications/Adobe Reader 9/. (I wonder whether it is filling my increasingly inscrutable console log with complaints about a missing application?)

My launchctl skills are rusty, too. How do you stop and remove a service? Why are 'list' and 'unload' now listed as "legacy" subcommands? What are their replacements?

$ launchctl list | grep -i adobe
...
-   78  com.adobe.ARM.925793fb327152fd34795896fa1fb9ffa268b2a852256fe56609efa3
$ sudo launchctl list | grep -i adobe
-   78  com.adobe.fpsaud

After much banging around, a combination of legacy and non-legacy subcommands may have done the trick:

$ launchctl unload com.adobe.ARM.925793fb327152fd34795896fa1fb9ffa268b2a852256fe56609efa3
$ launchctl remove com.adobe.ARM.925793fb327152fd34795896fa1fb9ffa268b2a852256fe56609efa3
$ sudo launchctl print system/com.adobe.fpsaud
    ... a ton of info, but no description of what file originally held this service description
$ sudo launchctl disable system/com.adobe.fpsaud
$ sudo launchctl remove com.adobe.fpsaud

Following execution of these commands I no longer see fpsaud or com.adobe.ARM in any launchctl list.

To Be Continued (?)

I'll update this post if the warning dialog reappears, but for now I think everything is sorted.