Finder Plugins (was Launchd Configuration Puzzle)

Question

New information:

I've realized that what I'm looking for are finder plugins (I should have realized that sooner), even though the parent PID is launchd. I still can't figure out where finder plugins are stored.

Some of the process names are:

Seafile FinderSync
Dropbox Finder Extension
Box Sync Finder Extension

---

Original post:

I'm going nuts trying to figure out how some processes are being automatically launched. The parent process is launchd (PID 1), but I can't find reference to them in any of the usual locations:

~/Library/LaunchAgents
/System/Library/LaunchAgents
/System/Library/LaunchDaemons
/System/Library/StartupItems
/Library/LaunchAgents
/Library/LaunchDaemons
/Library/StartupItems

I have also checked out cron:

/usr/lib/cron/tabs
crontab -l
sudo crontab -l

And ~/Library/Preferences/com.apple.loginitems.plist is empty.

Answer 1

The Finder extensions you are looking for are stored within their parent application bundles.

For example the Dropbox extension (called garcon.appex) is stored within the Dropbox application bundle at /Applications/Dropbox.app/Contents/PlugIns/garcon.appex (assuming Dropbox is installed to your default Applications folder).

If you open Activity Viewer, select Finder, click on the Information icon and select the "Open Files and Ports" tab you can see everything that is loaded into the Finder process. Including for example the Dropbox extension...

If the goal is just to disable application extensions you don't want to be loaded you can do this through the System Preferences pane called "Extensions". Or you can delete the parent applications, which will also delete the extensions.

Answer 2

You could try running EtreCheck on your Mac. It's a diagnostic tool that, amongst other things, will list all the kernel extensions, launch agents, launch daemons, user login items, internet plugins, Safari extensions, etc.

This might find something that you've missed.

Just as an example of the type of output you'll get, here is a partial entry from a scan of my MacBook Pro. It shows that I've removed applications but forgotten to remove the plist files that are still attempting to launch them.