I updated from Ventura to Sonoma and, as expected, experienced a problem. My expertise is very limited, but If anyone has suggestions, I'll be grateful.
I found this process consistently hogging 35% CPU. accessoryupdaterd
The user owner is listed as _accessoryupc
It's persistent. Activity Monitor kills it but it's a daemon and returns in seconds.
I've tried everything I know with no luck, including days of searches, online terminal unload suggestions, multiple calls to Apple, uninstalling a reinstalling apps that might be associated, and as some have suggested it's associated with Bluetooth, forgot all Bluetooth accessories and restarted, checked if it might be malware, all with no luck. It seems to be a protected process.
It launches in Safe mode, BUT ONLY LAUNCHES IN ANY MODE WHEN LOGGED IN TO MY USER ACCOUNT.
Via Apple support, I created a second user account where the process does NOT launch. While neither myself or Apple could find a way to stop the process, Apple suggested a full OS reinstall but warned that the problem might simply reoccur from Time Machine user records. Not a very promising task. And I desperately don't want to manually rebuild the entire system around a new user account.
So I'm hoping that I can find the triggering culprit in my user data and stop it there, but any suggestions would be appreciated.
The protected process is called by an alias located here:
/System/Library/PrivateFrameworks/MobileAssetUpdater.framework/MobileAssetUpdater
It calls a protected plist script here:
/System/Library/LaunchDaemons/com.apple.accessoryupdaterd.plist
Which launches the protected exec process located here:
/System/Library/PrivateFrameworks/MobileAccessoryUpdater.framework/Support/accessoryupdaterd
Here's the plist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>EnablePressuredExit</key>
<true/>
<key>GroupName</key>
<string>_accessoryupdater</string>
<key>Label</key>
<string>com.apple.accessoryupdaterd</string>
<key>MachServices</key>
<dict>
<key>com.apple.MobileAccessoryUpdater</key>
<true/>
<key>com.apple.MobileAccessoryUpdater.defaultClient</key>
<true/>
<key>com.apple.accessoryupdater.launchauhelper</key>
<true/>
<key>com.apple.accessoryupdater.observer</key>
<true/>
<key>com.apple.accessoryupdater.uarp</key>
<true/>
<key>com.apple.accessoryupdater.uarp.launchagentlistener</key>
<true/>
<key>com.apple.accessoryupdater.uarp.standaloneCommandListener</key>
<true/>
</dict>
<key>ProcessType</key>
<string>Adaptive</string>
<key>ProgramArguments</key>
<array>
<string>/System/Library/PrivateFrameworks/MobileAccessoryUpdater.framework/Support/accessoryupdaterd</string>
<string>120</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>UserName</key>
<string>_accessoryupdater</string>
</dict>
</plist>
I found this process consistently hogging 35% CPU. accessoryupdaterd
The user owner is listed as _accessoryupc
It's persistent. Activity Monitor kills it but it's a daemon and returns in seconds.
I've tried everything I know with no luck, including days of searches, online terminal unload suggestions, multiple calls to Apple, uninstalling a reinstalling apps that might be associated, and as some have suggested it's associated with Bluetooth, forgot all Bluetooth accessories and restarted, checked if it might be malware, all with no luck. It seems to be a protected process.
It launches in Safe mode, BUT ONLY LAUNCHES IN ANY MODE WHEN LOGGED IN TO MY USER ACCOUNT.
Via Apple support, I created a second user account where the process does NOT launch. While neither myself or Apple could find a way to stop the process, Apple suggested a full OS reinstall but warned that the problem might simply reoccur from Time Machine user records. Not a very promising task. And I desperately don't want to manually rebuild the entire system around a new user account.
So I'm hoping that I can find the triggering culprit in my user data and stop it there, but any suggestions would be appreciated.
The protected process is called by an alias located here:
/System/Library/PrivateFrameworks/MobileAssetUpdater.framework/MobileAssetUpdater
It calls a protected plist script here:
/System/Library/LaunchDaemons/com.apple.accessoryupdaterd.plist
Which launches the protected exec process located here:
/System/Library/PrivateFrameworks/MobileAccessoryUpdater.framework/Support/accessoryupdaterd
Here's the plist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>EnablePressuredExit</key>
<true/>
<key>GroupName</key>
<string>_accessoryupdater</string>
<key>Label</key>
<string>com.apple.accessoryupdaterd</string>
<key>MachServices</key>
<dict>
<key>com.apple.MobileAccessoryUpdater</key>
<true/>
<key>com.apple.MobileAccessoryUpdater.defaultClient</key>
<true/>
<key>com.apple.accessoryupdater.launchauhelper</key>
<true/>
<key>com.apple.accessoryupdater.observer</key>
<true/>
<key>com.apple.accessoryupdater.uarp</key>
<true/>
<key>com.apple.accessoryupdater.uarp.launchagentlistener</key>
<true/>
<key>com.apple.accessoryupdater.uarp.standaloneCommandListener</key>
<true/>
</dict>
<key>ProcessType</key>
<string>Adaptive</string>
<key>ProgramArguments</key>
<array>
<string>/System/Library/PrivateFrameworks/MobileAccessoryUpdater.framework/Support/accessoryupdaterd</string>
<string>120</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>UserName</key>
<string>_accessoryupdater</string>
</dict>
</plist>