Many Apple Community and Reddit users have reported a hard-to-remove macOS Sequoia error: "Malware Blocked. 'PT.updd' was not opened because it contains malware. This action did not harm your Mac." This warning makes you worry about the Mac's security.
PT.updd is a file or process linked to the open-source app PopcornTime, usually located in /Library/PrivilegedHelperTools/. Believe that you have tried removing PT.updd so as to fix the malware warning, only to find it keeps coming back.
Take it easy. After research and testing, we've summarized effective ways to permanently delete the PT.updd file and process. Consequently, helping you remove the PT.updd malware warning on your Mac.
How to remove the PT.updd malware warning on Mac
Deleting PT.updd is the most direct way to resolve the PT.updd malware warning on your Mac, but dragging it to the Trash usually isn't enough. The warning often comes back.
Why? PT.updd may still be running in the background, used by PopcornTime or a bundled app. Your Mac could also have the remaining related files. To fully remove it, you need to either force delete the file, close any related processes, or clean up leftover items.
Below, we've summarized the step-by-step ways to help you completely remove PT.updd. Just follow them carefully.
Uninstall PopcornTime
PT.updd is derived from the freeware PopcornTime or another open-source app linked to PopcornTime. Thus, if you have this type of app, uninstalling it from your Mac will fix the malware warning.
It is worth noting that the simple App removal doesn't always clean up the remnant files. You need to use an app cleaner to help you. CleanMyApp is a lightweight app uninstaller that supports uninstalling the app and deleting all its associated files, which stops hidden processes of the deleted apps from running in the background.
- Simply download, install, and open CleanMyApp from the App Store (Apple authenticated).
- Select PopcornTime and other unfamiliar apps from the list.
- Click Uninstall > Continue uninstall to permanently and completely delete them from your Mac.
Share this ingenious app uninstaller with your friends to help them thoroughly delete apps on Mac.
Run Terminal to force delete PT.updd
Although the PT.updd file is located at /Library/PrivilegedHelperTools/, many users found that the simple move to the Trash action can't delete it, as it always reminds that the PT.updd process is still running.
To resolve the continuous PT.updd malware warning on your Mac, switch to using Terminal to force delete PT.updd. We have tried this way and found it is feasible.
- Open Finder, move to the top Finder menu bar, and click Go > Go to Folder.
- Enter /Library/PrivilegedHelperTools/ to open it.
- Find the PT.updd file and keep this window open.
- Go to Launchpad > Other > Terminal.
- Enter sudo rm -rf with a space in Terminal and drag and drop the PT.updd file there.
- Press Return and enter your admin password to force delete it.
Delete the PT.updd files in the ~/Library/ & /Library/ folders
Some users report that their /Library/PrivilegedHelperTools/ doesn't have a PT.updd file. In this case, you need to check if the PT.updd related files are stored in your ~/Library/ and /Library/ folders.
- Open Finder, navigate to the top Finder menu bar, and click Go > Go to Folder.
- Enter the following path one by one and press Return to open it.
~/Library/LaunchAgents
~/Library/LaunchDaemons
~/Library/Application Support/
~/Library/Caches/
~/Library/Saved Application State/
~/Library/Preferences/
/Library/LaunchAgents - Check if each folder has a file named PopcornTime and delete it.
For example, in ~/Library/Saved Application State/, a folder called: se.popcorn-time.PopcornTime.savedState.
Note: If you get a message saying the file or folder cannot be deleted because it is in use, you need to start up in Safe Mode first and try again.
Safe Mode starts your Mac with only the essential system files and drivers while isolating all third-party software. This will stop PopcornTime or another third-party app bundled with PopcornTime from using the PT.updd file and making it undeletable.
Go tell others how to find all hidden PT.updd files on their Macs.
Fully terminate the PT.updd related process in Activity Monitor
Only if you stop the PT.updd related processes like PopcornTime from running, you'll delete PT.updd successfully later. So, go to Activity Monitor to check if there are PT.updd processes and force quit them.
- Open Launchpad > Other > Activity Monitor.
- Enter PT or PopcornTime into the search bar to find the related process.
- Select them and click the close button > Force Quit.
There's another way to fully terminate the PT.updd process in Activity Monitor:
- Search PT to find the pt.updd process.
- Double-click it to open it.
- Click the arrow next to the executable path.
- Move the file to Trash
- Select the pt.updd process and click the quit button (x), and click Force Quit.
After force-quitting the PT.updd related process, try to delete it again.
Disable PT.updd in Login Items
Removing PT.updd and its related items from Login Items prevents them from launching automatically when your Mac starts up and in the background. This step is essential to close programs running in the background on your Mac, ensuring that PT.updd doesn't run again after you remove it.
If you don't see PT.updd listed in Login Items, no worries — just move on to the next step.
- Click the Apple menu > System Settings.
- Select General > Login Items.
- Select PT.updd and its related items from the list and click the minus button (-) to remove them. In the Allow in the background section, check if there are PT.updd-related items and turn them off.
Turn off the system permissions for PT.updd-related apps
Maybe you've manually granted Full Disk Access permissions to Popcore Time or some other unverified apps containing PT.updd. Or, PT.updd force your system to grant itself the advanced permissions.
Whatever the case is, you must turn it off to stop PT.updd access, modify restricted system data, and control your Mac. That may be the cause why PT.updd can't be removed from your Mac.
- Go to Apple menu > System Settings > Privacy & Security > Full Disk Access.
- Disable the PopcornTime or other unknown third-party apps.
Our thoughts about 'PT.updd' malware warning on Mac
Obviously, the PT.updd malware warning on your Mac is caused by malware auto-linked to freeware or unknown third-party apps. We advise you not to install apps outside the App Store. Those apps are unverified by Apple, especially freeware, and can be easily infected with malware or viruses.
By the way, for safe and complete software deletion, use a professional app uninstaller. Manually uninstalling apps won't delete their leftovers, but an app uninstaller can do that.
If our post helps you remove the PT.updd malware warning on your Mac, share it with more people.