Possible Duplicate:
What is the task “java” (parent process “launchd”) doing on MacOS X?

When I open up my activity monitor, I have three (currently sometimes less or more) processes called "java" taking up on average 1.6% CPU each with 35 threads each. I've read flashback runs through java, could this possibly be it? There are no other applications running other than activity monitor. Thanks


3 Answers 3


Depending on whether you run OS X Lion or Snow Leopard, download these updates if you haven't:

These will automatically remove all variants of the Flashback malware on your Mac. If that worked, hooray, nothing to worry about.

If that didn't stop the processes, you have several options. You could, first of all, disable Java altogether by opening Applications/Utilities/Java Preferences.app and deselecting all versions of the Java VM. In my experience, you often won't need Java anyway.

If you don't want to do that, you can try to narrow down which process called the Java processes. Open up a terminal and enter:

ps auwwx | grep java | grep -v grep

If there's anything listed, check the corresponding user and the command line (in the last column). Do you notice anything unusual?

From that command line, you should be able to identify the source of these processes. Then, it's just a matter of either uninstalling that particular program or letting it run (in case it's any vital process you just forgot about).

  • Sorry forgot to update this, after downloading the java update you linked the processes no longer show up. Now I would like to know more about the repercussions of disabling Java before I do so (since @rich recommended it) if you know an online resource that'd be great. I use eclipse and build Java programs for school if I disable it can I easily reenable (I assume by reselecting the version of the JVM)? Thanks for your help
    – Steve
    May 20, 2012 at 5:33
  • Exactly. You can just enable them again if you need them. There are no repercussions from disabling Java apart from the inconvenience that you won't be able to run Java applets in your browser (well, who does that anyway), and maybe some cross-compiled software won't work. Or generally, software that uses Java in some way (Cyberduck comes to mind).
    – slhck
    May 20, 2012 at 13:47

An update to what @slhck wrote...

Java is the vector, not the payload. Meaning it gets in through java, but it doesn't live there. Think of java as the door, but when it breaks in, it rummages through your bedroom drawers, it doesn't wait in the doorway. The hole in java is how they get in, but once they get in, they download a binary and the binary is the actual malware. From what I saw, it drops things into your system to override your browser settings and some read/write routines.

As @shlck says, disable java, you don't need it. Java's had a lot of attacks recently, and not worth having on your system. If for some reason your system thinks you need java, it will prompt you to download it.

As far as why java is running, it could be a valid background process. My HP printer sets up a Tomcat application server to configure the printer settings, this is java. It's conceivable that other hardware on your system does the same thing - has a webapp for settings.

  • All very true, and thanks for the edit on the answer.
    – slhck
    May 18, 2012 at 21:55


  1. Use one browser with JAVA enabled or exception -based use on trusted domains ?!?
    • Consider an addon to enable JAVA with trusted sites by manual enable only, not prompted.
  2. Use your favorite browser with JAVA disabled by default.
  3. While your at it, create a non-admin OS account for normal use and only use admin account ONLY if rarely needed.
  4. It is just simple cheap security to operate with less risk for benefits that are few. Disable the prompted popup to enable Java, if possible.

Not the answer you're looking for? Browse other questions tagged .