Let’s talk about a Mac file called PT.updd that lots of users have recently reported as potential malware. It usually lives in /Library/PrivilegedHelperTools/ and is tied to a launch daemon at /Library/LaunchDaemons/PT.updd.plist. On the surface, it doesn’t look like much, but it’s got all the red flags. People have seen it reinstall itself after being deleted, trigger background activity, and even set off antivirus alerts when it tries to connect to sketchy domains like updpct.info.
At first, some thought it was part of legit software like Pro Tools or Proton apps, but after digging deeper, most roads led to Popcorn Time or one of its shady spin-offs. It auto-starts at login and hides behind system processes, making it tough to spot and even tougher to kill. For a lot of users, the only way out was to fully uninstall Popcorn Time and manually remove the leftovers. If it’s on your system, don’t ignore it.
How to Remove PT.updd From macOS
Below, I give you a quick guide that will hopefully allow you to remove PT.updd without too much hassle. Many users report that these exact steps helped them get rid of this malware, so I hope they work for you, too. And in case they don’t, no need to worry – there’s a more detailed removal manual available further down this page.
Remove PT.updd
- : Easy – Open Activity Monitor.
Search for pt.updd.
Double-click it and choose Quit, then Force Quit.
- : Easy – Open Finder > Go > Go to Folder….
Enter: /Library/PrivilegedHelperTools/
Locate PT.updd and move it to Trash.
- : Easy – Go to /Library/LaunchDaemons/
Delete PT.updd.plist.
- : Moderate – Open Terminal and run:
“sudo rm -rf ~/.Trash/*” (without quotes) - : Easy – Go to System Preferences > Users & Groups > Login Items.
Remove anything related to Popcorn Time or unknown entries.
- : Easy – Reboot the Mac.
- : Easy – (Optional but recommended): Manually delete the Popcorn Time app from /Applications if still installed.
If those quick removal steps didn’t solve your PT.updd issue, try the more advanced instructions provided below.
PT.updd Mac – Advanced Removal
These next steps will have you perform a thorough cleanup of your Mac in order to remove the annoying PT.updd malware. Just follow the steps and remember, in case any of them seem too complex, you can always try the recommended removal tool – SpyHunter – that you’ll find on this page.
- 1.1Open System Settings > Users & Groups.
- 1.2Click the lock icon in the bottom-left corner and type your administrator password to unlock changes.
- 1.3
Carefully review all user profiles listed. Be on the lookout for ones that seem out of place or overly generic – malware often uses names like “AdminPrefs” or “SupportUser”. - 1.4If you spot a suspicious profile, select it and click the minus (-) button to delete it.
Disable PT.updd Mac System Permissions
PT.updd may have granted itself elevated permissions, which allow it to run automatically, make system changes, or even re-install itself silently. It’s essential to strip those permissions to stop further interference.
- 2.1Navigate to System Settings > Security & Privacy > Full Disk Access.
- 2.2Scroll through the list of apps and entries with full disk privileges. If you see anything that you don’t recognize or that looks connected to PT.updd, proceed with caution.
- 2.3Right-click the suspicious entry and select Show in Finder.
- 2.4In Finder, delete the associated application or binary file.
- 2.5Return to the Full Disk Access list and click the minus (-) button to remove its permission entry.
Delete PT.updd’s Hidden Files in macOS System Folders
PT.updd typically scatters files across multiple system directories to ensure it keeps running. These components must be manually removed to fully eliminate the threat. Here are detailed instructions on where to find its various files and how to identify them.
- 3.1Start by restarting your Mac in Safe Mode:
→ Intel Macs: Shut down, press the Power button, then immediately hold Shift until the login screen appears.
→ Apple Silicon Macs: Shut down, hold the Power button until you see Startup Options, select your startup disk, then hold Shift and click Continue in Safe Mode. -
3.2Once in Safe Mode:
Open Finder, then in the top menu, select Go > Go to Folder…Visit each of the following directories one at a time:
→/Library/LaunchDaemons
→~/Library/LaunchAgents
→/Library/LaunchAgentsSwitch to List View to make browsing easier.
-
3.3Look for oddly named files—such as those made up of random characters—or names with terms like
helper,scan, orsearch.Specifically check for files with keywords like:
helper,updService,systemond,util,scan,search,techyutil,gettime,fixer,moniter,systemExtr,hlpr, etc. - 3.4Delete any files that match these patterns or seem suspicious, but be cautious not to remove essential system files. When uncertain, refer to user-reported filenames in the Apple forums or take notes for further research.
- 3.5Once you’ve cleaned these locations:
Restart your Mac normally.
If the issue persists, reboot into Safe Mode again and double-check the folders – you may have missed a stubborn leftover. - 3.6
Locking Down Your Mac from PT.updd
PT.updd is a persistent and stealthy component often linked to unauthorized installations of Popcorn Time or its shady offshoots. Left unchecked, it can silently run in the background, grant itself elevated privileges, re-spawn after removal attempts, and even trigger repeated security alerts due to suspicious network activity. What makes PT.updd particularly tricky is its ability to blend into your system using familiar-looking names and legitimate-looking locations.
But now, with the guide I provide on this page, you have the tools to perform a methodical cleanup. By removing rogue user profiles, revoking elevated permissions, and purging system folders of hidden launch agents and daemons, you can effectively eliminate PT.updd from your Mac. And if even that doesn’t work, you can always rely on SpyHunter 5 to take care of this for you.