New information:

I've realized that what I'm looking for are finder plugins (I should have realized that sooner), even though the parent PID is launchd. I still can't figure out where finder plugins are stored.

Some of the process names are:

Seafile FinderSync
Dropbox Finder Extension
Box Sync Finder Extension

Original post:

I'm going nuts trying to figure out how some processes are being automatically launched. The parent process is launchd (PID 1), but I can't find reference to them in any of the usual locations:


I have also checked out cron:

crontab -l
sudo crontab -l

And ~/Library/Preferences/com.apple.loginitems.plist is empty.

  • 2
    Please add the automatically launched "processes" in question in your question.
    – klanomath
    Commented Jun 12, 2017 at 19:20

2 Answers 2


The Finder extensions you are looking for are stored within their parent application bundles.

For example the Dropbox extension (called garcon.appex) is stored within the Dropbox application bundle at /Applications/Dropbox.app/Contents/PlugIns/garcon.appex (assuming Dropbox is installed to your default Applications folder).

If you open Activity Viewer, select Finder, click on the Information icon and select the "Open Files and Ports" tab you can see everything that is loaded into the Finder process. Including for example the Dropbox extension...

Screenshot of Dropbox application extension loaded into Finder

If the goal is just to disable application extensions you don't want to be loaded you can do this through the System Preferences pane called "Extensions". Or you can delete the parent applications, which will also delete the extensions.

Screenshot of Extension preference pane showing Finder app extension


You could try running EtreCheck on your Mac. It's a diagnostic tool that, amongst other things, will list all the kernel extensions, launch agents, launch daemons, user login items, internet plugins, Safari extensions, etc.

This might find something that you've missed.

Just as an example of the type of output you'll get, here is a partial entry from a scan of my MacBook Pro. It shows that I've removed applications but forgotten to remove the plist files that are still attempting to launch them.

Partial output from EtreCheck scan

  • Nice tool. I'll certainly use it in the future, but it didn't find what I needed.
    – SArcher
    Commented Jun 13, 2017 at 17:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .