How do I resolve 'PT.updd' malware warning on my Mac mini?

I followed all the instructions in the warning, but it persisted. I tried booting the MacBook in safe mode, but the warning didn’t vanish. I discovered that there was still one file on my MacBook:

• PT.updd,
• located in the folder ~/Library/PrivilegedHelperTools/.

Deleting this file resolved the warning. I hope this helps others facing the same issue.

Even by removing that single process, you may have more in your Launch Folders consuming resources. The locations to look are here and note the "~" character in the first 2 and without it in the last one. With Finder on screen, choose Go > Go to Folder, and paste these location there and look for files called Popcorn Time(or PT):

~/Library/LaunchAgents

~/Library/LaunchDaemons

/Library/LaunchAgents

To remove remnant files that just wasting storage space, then look in these locations:

• ~/Library/Application Support/

You may have a folder here called PopcornTime

• ~/Library/Caches/

You may have a folder here called PopcornTime

• ~/Library/Saved Application State/

You may have a file here called se.popcorn-time.PopcornTime.savedState

• ~/Library/Preferences/

You may have 2 files called com.time4popcorn.Popcorn Time.plist and com.popcorntime.PopcornTime.plist

If you get a message that the file/folder cannot be deleted because it is in use, then you will need to start up in Safe Mode first.

Open Activity monitor, search "pt", it should display the pt.updd process, double click to open it, click the arrow next to the path, and then move that file to trash

Restart the computer

Found some solutions here https://www.reddit.com/r/mac/comments/5hhup5/found_suspicious_selfdeleting_file_ptupdd/, this one https://www.reddit.com/r/mac/comments/5hhup5/comment/mlx0ar7/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button worked perfectly for me

CasperLeo wrote:

Open Activity monitor, search "pt", it should display the pt.updd process, double click to open it, click the arrow next to the path, and then move that file to trash

Restart the computer

If there is a PT.updd.plist around, whatever variant of the Popcorn Time app process was just exited can still get restarted (and that restart will fail). App removals don’t always clean up plists.

Restarting the Mac in Safe Mode will prevent the app startup, more easily allowing the plist deletion to work.

Then removing the rest of whichever variant of the Popcorn Time app this might involve is another discussion.

I followed all the instructions in the warning, but it persisted. I tried booting the MacBook in safe mode, but the warning didn’t vanish. I discovered that there was still one file on my MacBook:

• PT.updd,
• located in the folder ~/Library/PrivilegedHelperTools/.

Deleting this file resolved the warning. I hope this helps others facing the same issue.

I've removed all files I could find in the suggested folders, but I don't have a folder called ~/Library/PrivilegedHelperTools/. I've also tried searching pt and other variations of the file names in Activity Monitor but nothing appears. Can't find the PT.updd file or get rid of the malware notification. Anyone know any other solutions?

I did all of this but the warning hasn't gone away. Also, I do not have a folder named ~/Library/PrivilegedHelperTools/.

Also sharing how this started for me (incase it can help think of a solution) – I recently bought a new macbook. Data between my old and new mac was synced. I opened Spotify for the first time on this new mac today and was asked to install Rosetta to continue. Because it is an application by Apple, I allowed it. However, right after, I started getting this malware warning. Any idea what else I could do to make this go away?

Please read About those "<app> will damage your computer" messages - Apple Community. There may be other files in addition to “PT.updd” that require removal.

Related: How do I remove the 'malware blocked' pop-up on my MacBook Air

yes, i need help!

This was super helpful, thank you. The warning for popcorn time randomly popped up today and was super confused.

Thanks!! this worked like a charm

This worked for me! thank you!