Launch agents and launch daemons are loaded by macOS at startup, but do not appear in the "Login Items" list.
When you started the Mac in Safe Mode, the screen didn't go black because whatever-it-is that causes the video failure wasn't loaded. You will need to find the offending software, and delete it.
Since OS 10.4 Tiger, Apple has given developers another mechanism for launching items automatically: launch daemons and agents that are controlled by the launchd process. This provides more flexibility for developers but it is less transparent to users.
Instead of opening apps directly, launchd loads specially-formatted .plist documents that specify what should launch and under what circumstances. Sometimes these launch items run constantly in the background, sometimes they run at scheduled intervals, and sometimes they run as needed—for example, in response to an event such as a change in a certain file or folder—and then quit.
The .plist files that launchd uses can occupy any of five folders, and their location determines when the items load and with what privileges:
Items in /Library/LaunchDaemons and /System/Library/LaunchDaemons load when your Mac starts up, and run as the root user.
Items in /Library/LaunchAgents and /System/Library/LaunchAgents load when any user logs in, and run as that user.
Items in /Users/your-username/Library/LaunchAgents load only when that particular user logs in, and run as that user.
Don’t change System files: Of those five folders, the two located in the /System folder (/System/Library/LaunchDaemons and /System/Library/LaunchAgents) are for components included as part of macOS, and you should resist the temptation to remove or alter them—they’re essential to keep your Mac running correctly.
- Modify others as you like: Feel free to browse through the files in the other folders to see what’s there. You can modify them—for instance, to disable them or to change how often they run—but before you do, you should understand a few things about how they work.
When you start your Mac or log in, the launch items in the relevant folders are loaded (that is, registered with the system) unless they have a Disabled flag set. Thereafter, their instructions will be carried out until you restart, even if you drag the launch item to the Trash. To see a list of all the currently loaded launch items on your Mac, open Terminal (in /Applications/Utilities) and type launchctl list and then press Return.
If you want to stop a launch item from running without your having to restart, open Terminal and type launchctl unload followed by a space and the full path to the launch item. An easy way to add an item’s full path is to drag it to the Terminal window) For example, take this command:
launchctl unload ~/Library/LaunchAgents/com.apple.FolderActions.enabled.plist
It unloads the launch agent that enables AppleScript folder actions. Repeat the command with load instead of unload to turn it back on.
Because most launch items run on a schedule or on demand, and because any of them could be disabled, the fact that something is present in one folder doesn’t necessarily mean the process it governs is currently running. To see what’s running at the moment, open Activity Monitor—but bear in mind that the name of a given process as shown in Activity Monitor might not resemble the name of the .plist file that tells macOS to launch it.
Other explanations for mystery processes
Although these methods are the most common ways to launch apps automatically in macOS, they aren’t the only ones. If you have a mystery process that you can’t track down in any of these places, it could also be one of these:
Kernel extensions: Kernel extensions, or kexts, live in /System/Library/Extensions and load at startup. They provide low-level features such as processing audio and adding support for peripherals. Most kexts on your Mac are part of macOS. The safest way to remove a third-party kext is to run an uninstaller provided by the developer.
Crons: Cron is a Unix scheduling utility built into macOS. It’s more-or-less not used anymore in favor of launchd, but you never know what might be lingering on a Mac that has gone through a lot of updates or is running old software.
Login scripts: Login scripts, like startup items, were used in older versions of macOS but are now deprecated.