Uninstall confer app

macos high-sierra

I'm new to mac os and Apple products in general, this is my first experience with it. While using my macbook pro for the first time, I saw that I have a "Confer" app which I didn't install, I tried to remove it but it fails because it's running.

I tried killing it from terminal with kill -9 and kill -15 but it just get a new pid. I also found the plist file but I cannot edit it to disable from restarting. Using launchctl to unload it has no result either.

My questions are: how did this end up in my machine? what is it and how can I remove it.

UPDATE:

Scooping around I found that the package is actually com.carbonblack.defense. Following @francis-from-responsebase instructions the associated files with that package are:

pkgutil --verbose --only-files --files com.carbonblack.defense
 Files from 'com.carbonblack.defense' on '/':
    Confer.app/ConferPerf.app/Contents/Frameworks/libpython2.7.dylib
    Confer.app/ConferPerf.app/Contents/Info.plist
    Confer.app/ConferPerf.app/Contents/MacOS/ConferPerf
    Confer.app/ConferPerf.app/Contents/MacOS/perf_info
    Confer.app/ConferPerf.app/Contents/MacOS/python
    Confer.app/ConferPerf.app/Contents/MacOS/rtt_info
    Confer.app/ConferPerf.app/Contents/PkgInfo
    Confer.app/ConferPerf.app/Contents/Resources/ConferPerf.py
    Confer.app/ConferPerf.app/Contents/Resources/__boot__.py
    Confer.app/ConferPerf.app/Contents/Resources/__error__.sh
    Confer.app/ConferPerf.app/Contents/Resources/common.pyc
    Confer.app/ConferPerf.app/Contents/Resources/include/python2.7/pyconfig.h
    Confer.app/ConferPerf.app/Contents/Resources/iotop_runner.pyc
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/MacOS.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/Nav.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_AE.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_Ctl.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_Dlg.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_Evt.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_File.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_Menu.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_Qd.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_Res.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_Win.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_codecs_cn.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_codecs_hk.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_codecs_iso2022.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_codecs_jp.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_codecs_kr.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_codecs_tw.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_collections.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_ctypes.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_functools.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_hashlib.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_heapq.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_io.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_json.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_locale.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_multibytecodec.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_random.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_scproxy.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_socket.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_ssl.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/_struct.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/array.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/binascii.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/bz2.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/cPickle.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/cStringIO.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/datetime.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/fcntl.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/gestalt.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/grp.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/itertools.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/math.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/operator.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/parser.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/pyexpat.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/resource.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/select.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/strop.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/termios.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/time.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/unicodedata.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/lib-dynload/zlib.so
    Confer.app/ConferPerf.app/Contents/Resources/lib/python2.7/site-packages.zip
    Confer.app/ConferPerf.app/Contents/Resources/nettop_runner.pyc
    Confer.app/ConferPerf.app/Contents/Resources/perf_info.py
    Confer.app/ConferPerf.app/Contents/Resources/perf_info.pyc
    Confer.app/ConferPerf.app/Contents/Resources/performance_data.pyc
    Confer.app/ConferPerf.app/Contents/Resources/process_data.pyc
    Confer.app/ConferPerf.app/Contents/Resources/round_trip_time.pyc
    Confer.app/ConferPerf.app/Contents/Resources/rtt_info.py
    Confer.app/ConferPerf.app/Contents/Resources/rtt_info.pyc
    Confer.app/ConferPerf.app/Contents/Resources/setup_perf.pyc
    Confer.app/ConferPerf.app/Contents/Resources/site.pyc
    Confer.app/ConferPerf.app/Contents/Resources/top_runner.pyc
    Confer.app/ConferPerf.app/Contents/_CodeSignature/CodeResources
    Confer.app/Contents/Info.plist
    Confer.app/Contents/MacOS/CbDefense
    Confer.app/Contents/MacOS/UnInstaller
    Confer.app/Contents/MacOS/UpgradeHelper
    Confer.app/Contents/MacOS/repmgr
    Confer.app/Contents/PkgInfo
    Confer.app/Contents/Resources/Base.lproj/MainMenu.nib
    Confer.app/Contents/Resources/CBD_Large_Logo120dpi.png
    Confer.app/Contents/Resources/CBD_Large_Logo144dpi.png
    Confer.app/Contents/Resources/CBD_Large_Logo192dpi.png
    Confer.app/Contents/Resources/CBD_Large_Logo96dpi.png
    Confer.app/Contents/Resources/CBD_Small_Logo120dpi.png
    Confer.app/Contents/Resources/CBD_Small_Logo144dpi.png
    Confer.app/Contents/Resources/CBD_Small_Logo192dpi.png
    Confer.app/Contents/Resources/CBD_Small_Logo96dpi.png
    Confer.app/Contents/Resources/Info.plist
    Confer.app/Contents/Resources/Raleway-Bold.ttf
    Confer.app/Contents/Resources/Raleway-Light.ttf
    Confer.app/Contents/Resources/Raleway-Medium.ttf
    Confer.app/Contents/Resources/Raleway-SemiBold.ttf
    Confer.app/Contents/Resources/about.css
    Confer.app/Contents/Resources/about.html
    Confer.app/Contents/Resources/cbd.icns
    Confer.app/Contents/Resources/cbd_dock_square.icns
    Confer.app/Contents/Resources/cbd_grey.icns
    Confer.app/Contents/Resources/common.css
    Confer.app/Contents/Resources/popup.css
    Confer.app/Contents/Resources/popup.html
    Confer.app/Contents/Resources/toggler.css
    Confer.app/Contents/Resources/ui-dialog.html
    Confer.app/Contents/Resources/ui-dialog_main.css
    Confer.app/Contents/Resources/ui_logic.tis
    Confer.app/Contents/Resources/vlist.tis
    Confer.app/Contents/Resources/vlist_threats.css
    Confer.app/Contents/Resources/wnd_chrome.css
    Confer.app/Contents/_CodeSignature/CodeResources
    Confer.app/cfg_reg.ini
    Confer.app/cloud.pem
    Confer.app/confer.ini
    Confer.app/db_whi
    Confer.app/eula.txt
    Confer.app/licenses.txt
    Confer.app/uninstall
    Confer.app/version
    Confer.app/yara.rule

First thing I would determine is the CONTEXT the process is being launched in — either your user or system (root). Pull up a user shell by launching Terminal. 

launchctl list | grep -i confer

Assuming the running process’ name is Confer, this should determine if it is being launched under user context. If no output, then we need to look at the system context.

sudo -s

Type your password to initiate a root shell. 

launchctl list | grep -i Confer

If no output, then let me know — we’ll have to look at legacy startup items and verify that there is no kernel extension component. We will also need to check the verboten directories used by launchd in /System for a renegade install.

We will then hunt down the location of the file which causes Confer to launch, and then remove it from bootstrapped items and from user items launched at login. If you wish to really remove this thing properly, then we will employ the package utility to delete every darned file that it might have reported to the installer via a package receipt.

You can see a list of files confer is using while it is running by:

opensnoop -n Confer

Or 

lsof | grep -i confer

Lemme know how that all works,

F.


Confer is related to Carbon Black Protection, an enterprise security solution. It is relatively difficult to uninstall because somehow it seems to come back and haunt you. More details at https://www.jamf.com/jamf-nation/discussions/28321/script-to-remove-carbon-black-protection-from-active-computer

Related

How to activate mod_rewrite on MacOSX Lion
Is picture location info retained when I share a photo?
APFS partition disappeared after creating hybrid MBR
How to Make Bootable APFS Volume From Disk Image
How to find the source of a sound on an iPhone?
Where is the iWork shape library stored?
What's the best way to move from an HDD to an SSD on a Mac Pro?
Privacy: can a app from App Store access my Apple ID data?
Is there a way to filter or sort my iOS Apps by Account which was used to purchase them?
iTunes credit for child's account?
Is there a good syslog viewer for mac?
Why Do I Need An Admin Password To Delete Apps But Not One to Install?