Hidden login items can cause all kinds of problems for Mac users. An app might appear in your menu bar but not in your login items. Safari might redirect to adware sites or change its homepage without your permission. And unknown processes can drag on system resources in the background.

Unfortunately, with these types of unexpected events, removing the app from login items isn't enough to solve the problem. This is because there are hidden LaunchDaemons and LaunchAgents keeping them around, which aren't accessible through the typical macOS interface.

Here, we'll show how you can monitor and take action against these hidden LaunchDaemons and LaunchAgents to troubleshoot unique Mac problems.

Understanding the macOS Startup Routine

When you press the power button, your Mac boots up with a series of familiar events:

• You hear an audible startup sound.
• The Apple logo appears, along with the progress bar.
• You see the login screen appear when this completes (or the desktop if you have automatic login enabled).

Behind the scenes, macOS starts the launchd process. This is responsible for starting, stopping, and managing every other process, including the system and individual user accounts. The process is highly optimized and takes only a few moments.

To examine this yourself, open the Activity Monitor app, and choose View > All Processes. At the top, you'll see two main processes: kernel_task and launchd, with their process ID (PID) as 0 and 1.

This shows that launchd is the primary parent process when the system starts. It is also the last process to exit when the system shuts down.

The core responsibility of launchd is to launch other processes or jobs on a scheduled or on-demand basis. These come in two types: LaunchDaemons and LaunchAgents.

What Are LaunchDaemons and LaunchAgents?

LaunchDaemons typically run as root, meaning they work regardless of whether a user is logged in or not. They cannot display information using the graphical user interface and they affect the entire system.

For example, the locationd process detects the geographical location of the Mac, while the bluetoothd process manages Bluetooth. The list of daemons lives in the following locations:

• /System/Library/LaunchDaemons for native macOS processes
• /Library/LaunchDaemons for installed third-party apps

Mac LaunchAgents start when a user logs in. Unlike daemons, they can access the user interface and display information. For example, a calendar app can monitor the user's calendar account for events and notify you when the event occurs. The lists of agents live in the following locations:

• /Library/LaunchAgents for all user accounts
• ~/Library/LaunchAgents for a specific user account
• /System/Library/LaunchAgents for macOS only

Before you log in, launchd runs services and other components specified in .plist files from the LaunchDaemons folder. Once you've logged in, launchd will run services and components defined in .plist files from the LaunchAgents folders. Those in /System/Library are all part of macOS and protected by System Integrity Protection.

The .plist preference files follow the standard reverse domain naming system. This begins with the company name, followed by an application identifier, and ends with the property list file extension (.plist). For example, co.clario.Clario.plist is the helper file for the Clario app.

How to Catch LaunchDaemons and LaunchAgents

Unlike those in the System folder, the public LaunchDaemon and LaunchAgent folders are open to both legitimate and illegitimate apps. You can monitor these folders automatically with Folder Actions.

Open the AppleScript Editor app by searching for it in Spotlight. Click Preferences and choose General > Show Script menu in menu bar.

Click the Script Menu icon and choose Folder Actions > Enable Folder Actions. Then select Attach Script to Folder in that same menu.

A dialog box will pop up. From here, select add - new item alert.

Click OK to open a Finder window. Now select the user LaunchDaemon folder (listed above) and click Choose.

Repeat the above procedure for every LaunchAgents folder on your Mac as well.

When done, open Finder and click Go > Go to Folder or press Shift + Cmd + G to open the navigation dialog box. Type ~/Library/LaunchAgents and click Go.

Right-click the LaunchAgents folder, and choose Services > Folder Actions Setup to bind the new item alert script to each folder.

In the dialog box that pops up, you'll see the list of folders in the left column and script in the right column. If you don't see any scripts, click the plus (+) button and add new item alert.scpt.

After following these steps, macOS will show an alert popup whenever a new item is added to one of these folders, allowing you to spot any illegitimate apps that try to inject themselves into your system in the background.

Consider Monitoring These Folders With Apps

If you'd like some additional options for alerts on these folders, you can try a few third-party tools.

EtreCheck is a macOS diagnostic tool that displays the load status of third-party LaunchDaemons and LaunchAgents, among other info. When you run EtreCheck, it collects a variety of information about your Mac and presents it in an easy-to-read report. It also has additional help options when dealing with adware, suspicious daemons and agents, unsigned files, and more.

Open EtreCheck and click Scan. This will take a few minutes, and once it's done, you'll see a full summary of your computer. This includes major and minor issues, hardware specifications, software compatibility issues, the status of LaunchDaemons and LaunchAgents, and more.

The app is free for the first five reports, then requires a $17.99 in-app purchase for continued use.

Lingon X is another tool that lets you start an app, a script, or run a command automatically on a schedule. It can also monitor all LaunchDaemons and LauchAgents folders in the background and show a notification when something changes. You can see all the items graphically and adjust them as needed.

This tool is free to try, but it costs $14.99 for a full license.

How to Remove LaunchDaemons and LaunchAgents

The public /Library/LaunchAgents and /Library/LaunchDaemons folders are vulnerable to both legitimate and illegitimate apps. A legitimate app might use them for marketing, while malicious apps can use them to steal data and infect your Mac.

For adware and malware to be successful, they must persist in every user session. To do this, malware and adware authors create malicious code and put it in the LaunchAgent or LaunchDaemon folder. Every time your Mac starts, launchd will ensure that the malicious code runs automatically. Thankfully, security apps can help protect against this.

Use Mac Security Apps

The free KnockKnock app works on the principle of persistence. It lists persistently installed apps and their components in a neat interface. Click the Scan button, and KnockKnock will scan all known locations where malware might be present.

The left pane contains the categories of persistent apps, with names and a brief description. Click on any group to display the items in the right pane. For example, click Launch Items in the left pane to view all the LaunchAgents and LaunchDaemons.

Each row gives detailed information about the app. This includes signed or unsigned status, the path to the file, and antivirus scan results from VirusTotal.

BlockBlock is another free security app from Objective-See that continuously monitors persistence locations. The app runs in the background and shows you an alert whenever malware adds a persistent component to macOS.

Not every third-party .plist file is malicious, though. They could come from anywhere, including:

• Components of installed apps
• Remnants of old apps you no longer use
• Leftovers from previous macOS upgrades
• Migration Assistant leftovers
• PUPs (potentially unwanted programs), adware, and malware.

You don't want to delete any components of installed apps. However, it's perfectly safe to remove the remnants of old apps and leftovers from previous macOS upgrades (unless you want to continue using those apps).

There's no unique uninstall process for this—simply trash the .plist file and reboot your Mac. Or you can cut and paste it to your desktop to keep a copy to be on the safe side. Don't delete any items from the System LaunchAgents or System LaunchDaemons folders, as they're required for macOS to run smoothly.

Adware and PUPs are notoriously challenging to tackle. Any time you're in doubt, run the

free version of Malwarebytes and consider upgrading to Malwarebytes Premium if you need extra protection.

Stay Cautious of Launch Threats on Mac

If you follow these steps, then you'll know about new threats ahead of time and can solve any problems. Adware and PUPs are rising in popularity, with new variants of malware coming up all the time. Thankfully, macOS has plenty of ways to keep you safe.

The trick is to monitor these folders and run frequent diagnostic checks. If you're in doubt, always Google the potentially malicious process names. But if you avoid the mistakes that lead to malware on you your Mac, you shouldn't need to worry.