1

I am having a hard time to figure out how those unwanted program autostarted in the system. I am running MacOS Big Sur.

Take an example, Please have a look at the following job:

$ launchctl list | grep -i thunder
405 0   com.xunlei.Thunder.ThunderHelper
$ launchctl print gui/$(id -u)/com.xunlei.Thunder.ThunderHelper
com.xunlei.Thunder.ThunderHelper = {
    active count = 4
    copy count = 0
    one shot = 0
    path = (submitted by otherbsd.330)
    state = running

    program identifier = com.xunlei.Thunder.ThunderHelper
    parent bundle identifier = com.xunlei.Thunder
    parent bundle version = 4368
    inherited environment = {
        SSH_AUTH_SOCK => /private/tmp/com.apple.launchd.ZGX7Lm6JIp/Listeners
    }

    default environment = {
        PATH => /usr/bin:/bin:/usr/sbin:/sbin
    }

    environment = {
        XPC_SERVICE_NAME => com.xunlei.Thunder.ThunderHelper
    }

    domain = com.apple.xpc.launchd.user.domain.501.100006.Aqua
    asid = 100006
    minimum runtime = 10
    exit timeout = 5
    runs = 1
    successive crashes = 0
    pid = 405
    immediate reason = semaphore
    forks = 0
    execs = 1
    initialized = 1
    trampolined = 1
    started suspended = 0
    proxy started suspended = 0
    last exit code = (never exited)

    semaphores = {
        successful exit => 0
    }

    event triggers = {
    }

    endpoints = {
        "com.xunlei.Thunder.ThunderHelper" = {
            port = 0x9a333
            active = 0
            managed = 1
            reset = 0
            hide = 0
        }
    }

    dynamic endpoints = {
        "com.xunlei.Thunder.MessageHelper" = {
            port = 0xac607
            active = 1
            managed = 0
            reset = 0
            hide = 0
        }
    }

    pid-local endpoints = {
        "com.apple.tsm.portname" = {
            port = 0xbecaf
            active = 1
            managed = 0
            reset = 0
            hide = 0
        }
        "com.apple.axserver" = {
            port = 0xbe833
            active = 1
            managed = 0
            reset = 0
            hide = 0
        }
    }

    instance-specific endpoints = {
    }

    event channels = {
    }

    sockets = {
    }

    instances = {
    }

    spawn type = interactive (4)
    jetsam priority = 3
    jetsam memory limit (active) = (unlimited)
    jetsam memory limit (inactive) = (unlimited)
    jetsamproperties category = daemon
    submitted job. ignore execute allowed
    jetsam thread limit = 32
    cpumon = default
    job state = running

    properties = {
        partial import = 0
        xpc bundle = 0
        keepalive = 0
        runatload = 0
        low priority i/o = 0
        low priority background i/o = 0
        dataless file mode = 0
        legacy timer behavior = 0
        exception handler = 0
        supports transactions = 1
        supports pressured exit = 0
        supports idle hysteresis = 0
        enter kdp before kill = 0
        wait for debugger = 0
        app = 0
        system app = 0
        creates session = 0
        inetd-compatible = 0
        inetd listener = 0
        abandon process group = 0
        event monitor = 0
        penalty box = 0
        role account = 0
        launch only once = 0
        system support = 0
        inferred program = 0
        joins gui session = 0
        joins host session = 0
        parameterized sandbox = 0
        resolve program = 1
        abandon coalition = 0
        high bits aslr = 0
        reslide shared cache = 0
        disable resliding = 0
        extension = 0
        nano allocator = 0
        no initgroups = 0
        start on fs mount = 0
        needs implicit endpoint = 0
        is copy = 0
        disallow all lookups = 0
        system service = 0
        protected by submitter = 0
        multiple instances = 0
    }
}

I am wondering how this job started automatically? How does it really work?

What does submitted by otherbsd.330 path mean here?

I don't find a plist file anywhere which is responsible for this job.

Thanks a lot.


Btw, I am not sure the following words related to this question or not. You can ignore the following words. I just want to provide more information which may help on this issue.

I asked another question regarding how to delete hidden login iterms from $HOME/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm. So far, there is no answer yet. Inside backgrounditems.btm, it has this ThunderHelper process too. Since I don't find a proper way to delete the login iterm. It's hidden and not shown in system preferences. I delete the file compeletely with command rm backgrounditems.btm, but magically, after I shutdown and restart the system, this login iterm will automatically be created again inside a new backgrounditems.btm file.

I am thinking to change this file's owner and group permission. Make root as the owner and other user only readable permission. I haven't tried this approach. Hopefully, it will work.

1

launchd jobs can be submitted directly (through launchctl, and likely through cocoa code) without using a plist file. Since I see this line:

parent bundle identifier = com.xunlei.Thunder

that suggests the application with that bundle identifier (probably 'Xunlei Thunder', a peer-to-peer networking thing) is setting up a helper app (ThunderHelper) to run independently in the background.

12
  • Thanks a lot for this reply. But how can I find who triggers this from the start? I want to prevent this happen, in order to achieve it, I need to know how it works. I am a programmer and new to MacOS (an experienced Linux user). First, I don't run thunder app by myself. Second, I have rm backgrounditems.btm which is the one contains thuner login iterm. Third, I have killed thunder process by PID. But, magically, after I shutdown and start MacOS again. The thunder login iterm will be added to a new backgrounditems.btm file. This launchd job will be auto started. How come? Thanks.
    – sgon00
    Apr 9 at 14:58
  • 1
    @sgon00: Ah... I just discovered that the situation might be more annoying than expected. See Apple documentation... Apparently an app can contain a helper app and automatically load it as a service at login. it can only be stopped if the app tells it to stop (through a preference or menu item). Check Thunder to see if this is the case; you might have to delete Thunder entirely. Apr 9 at 18:10
  • 1
    @sgon00: yeah, nice the helper app has it's own bundle id the system will always find it, if the directory is mounted at login. You could try moving Thunder to a removable drive, that you don't connect until you need it; that will keep it out of the system's view... Apr 10 at 6:23
  • 1
    @sgon00: Whenever an app is launched. the system registers it (using the bundle id). I don't know the details, though I suppose I could look on Apple's developer pages, but the idea is that if the user requests an app (by trying to open a file, running a script, or etc), the system can find the app wherever it is on disk. In this case the app itself is registering the helper as a login item, so at login the system generates an automatic request for the helper at login, which locates and launches it. Apr 10 at 15:05
  • 1
    @sgon00. if the helper is unreachable at login, the request will fail, and life will go on without it. I don't know if the system is smart enough to cancel the login request at that point, or if it will keep asking; you might have to do trial and error on that. You should read that documentation link I provided more thoroughly if you want those answers; that's the best reference I know for how the system handles daemons. Apr 10 at 15:10
0

“KnockKnock” is a free application that will help you locate all sorts of “auto-launch” processes.

Look for the "Launch Items" for launchd processes:

Launch Items

1
  • Thanks a lot for the reply. I am having it in my system too. The thunder app is not in the Launch Items in KnockKnock and it does not help me figure out how thunder helper app auto starts itself too. It does shows thunder app in Login Iterms though. But I can not really remove it. You can find more details in my another two related questions apple.stackexchange.com/questions/418423 and apple.stackexchange.com/questions/418465 . Thank you very much.
    – sgon00
    Apr 9 at 16:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .