My related questions:
How to delete hidden login iterms from backgrounditems.btm?
A launchd job without plist file, how does that work and how to find what job triggers it?
Even though the above questions are related, but they are not the same to this question.
I am running MacOS Big Sur.
I found out there were many apps downloaded online will auto start themselves somehow. I am having really a hard time to trace how they auto started.
Take an example,
com.xunlei.Thunder.ThunderHelper is always started automatically after the system starts.
So far, I found out there were two things which are related to this process autostart.
One is from launchd job (no .plist file):
$ launchctl list | grep -i thunder 405 0 com.xunlei.Thunder.ThunderHelper $ launchctl print gui/$(id -u)/com.xunlei.Thunder.ThunderHelper ... path = (submitted by otherbsd.330) program identifier = com.xunlei.Thunder.ThunderHelper parent bundle identifier = com.xunlei.Thunder ...
One is a hidden login iterm from
$HOME/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm file. NOTE: this login iterm is NOT shown in System Preferences. I found it by using a python script mentioned in my another question in detail
python3 ./bgiparser.py -f backgrounditems.btm -c.
I do NOT find anything related to
thunder process in the following directories:
/Library/StartupItems /System/Library/StartupItems ~/Library/LaunchAgents/ /Library/LaunchAgents /Library/LaunchDaemons /System/Library/LaunchAgents /System/Library/LaunchDaemons
I don’t start
thunder app by myself.
NOW, in order to stop it auto starts, I did the following
launchctl stop com.xunlei.Thunder.ThunderHelper launchctl remove com.xunlei.Thunder.ThunderHelper kill -9 405 rm "$HOME/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm"
Note again, I don’t start thunder app by myself.
Now, I shutdown the MacOS system and unplug the power cable, plug the power cabe, start MacOS system.
Magically, the thunder helper app starts it automatically again. It created a running launchd job again. It created a hidden login iterm again in a new
I am very confused and how does it do this?
If I open the app manually and then it creates laucnhd job and login iterm, I am fine with it. BUT I don’t start the app at all. I have removed the login iterm file. I have stopped its related process.
Can anyone help me finding how this program auto starts itself?
Thank you very much.