How to get rid of an iSpy warning

My father, of all people, wrote me with an alarming problem:

When I turn on the computer, this message comes up. I’ve searched to find it and can’t locate it on the computer. What is it, and how do I stop it from showing up?

Fortunately, this isn’t previously unknown malware that’s made its way into his computer. iSpy is the kernel extension associated with Espionage 2, a folder-encryption software package. TaoEffect, the developer of the software, warned its users years ago that version 2 was incompatible with Mavericks, and released version 3.

However, it appears that error messages, such as that my dad saw, started popping up only in El Capitan for some people, who don’t recall ever having installed the original app. The company offers detailed instructions if you’re trying to recover data encrypted with Espionage 2, but also has advice on removing lingering version 2 components.

Here’s a quick summary for those with this problem. You may be prompted to enter an administrative password when deleting files noted below.

1. In the Finder, hold down Option, click the Go menu, and select Library.

2. In the folder that appears, delete these files (not all may be present).

/Library/iSpy /Library/LaunchDaemons/com.taoeffect.ispyd.plist /Library/LaunchDaemons/com.taoeffect.Espionage.plist /Library/PrivilegedHelperTools/com.taoeffect.Espionage

1. Press Command-Shift-G and in the Go To the Folder dialog, enter /System/Library/Extensions.

2. Delete the file named iSpy.kext.

3. Finally, press Command-Shift-G and in the Go To the Folder dialog, enter ~/Library

4. In the LaunchDaemons folder in the Library folder, delete either or both of these files, if present.

/Library/LaunchDaemons/com.taoeffect.ispyd.plist /Library/LaunchDaemons/com.taoeffect.Espionage.plist

1. In the PrivilegedHelperTools folder in the Library folder, delete com.taoeffect.Espionage if that file is present.

2. Restart OS X as you would normally.

While I didn’t have Espionage 2 installed, my father confirms this process got rid of the dialog for him.

Ask Mac 911

We’re always looking for problems to solve! Email yours to mac911@macworld.com including screen captures as appropriate. Mac 911 cannot reply to email with troubleshooting advice nor can we publish answers to every question.