macOS: Check Your LaunchAgents for Malicious Software

If you’ve gotten some malware installed on your Mac—if, for example, you’re seeing bad pop-ups within your browser or you note that you’ve got one of the not-helpful-or-necessary “cleanup” apps installed—then a good first step to get stuff fixed is to download Malwarebytes and run a scan. Then you should check your browser by looking at its installed extensions, for example. Rebooting your Mac is often a helpful step to take, too, as doing so can sometimes flush the baddies out.

But another thing you could try is looking at what’s in your Mac’s root-level LaunchAgents folder. This folder contains items that run automatically when you log in to any user account on your Mac, and it’s a typical place for nefarious apps to stick files, as doing so could mean that their software will launch whenever you log in. Not good. So if you’d like to see your own LaunchAgents folder, start by clicking on your Desktop or on the blue smiley face in your Dock to be sure Finder is your active application, then choose Go > Computer or press Shift-Command-C.

Then double-click (or just click, if your Finder is in column view) on your Mac’s drive, typically dubbed Macintosh HD…

…and you’ll see your top-level folders.

Double-click on “Library,” then, and you’ll find the folder labeled “LaunchAgents.”

Another way to do this same thing is to use Finder’s “Go to Folder” command, accessible from the “Go” menu or by pressing Shift-Command-G.

When you see the “Go to Folder” dialog box appear, type in “/Library/LaunchAgents,” like so:

If you then click the “Go” button, it’ll take you to the same location as my steps above.

Now, here’s an important caveat. Within this LaunchAgents folder is likely a bunch of stuff, most of which you do not want to mess with. If you don’t know what something is, do a web search to find out before you get rid of it! If you remove something important, you might have to reinstall software to fix what you’ve done. Filenames here typically begin with “com” followed by the developer’s company (e.g., “com.google” or “com.apple”), so it’s fairly easy to suss out what’s useful or needed and what’s not. For example, I know my list above contains only legitimate items; all of those things are linked with software I use. If you find something associated with an application you’re trying to get rid of, though, just select it and press Command-Delete or drag it to the trash icon in your Dock. You’ll then have to enter your administrator password to confirm that you know what you’re doing…

…because as I mentioned, removing items from this folder can be problematic if you do the wrong thing. So be careful.

In any case, while I’ve found Malwarebytes to be an invaluable tool for getting rid of unwanted software, this LaunchAgents folder is a place where bits of crap can be left behind, so it’s good to check it if you’re having symptoms like the ones I mentioned above. Or just for the heck of it. And if you want to be thorough, you could also look at your user-level LaunchAgents folder, which you can get to by way of selecting the aforementioned “Go to Folder” menu item and typing or pasting in the following:

~/Library/LaunchAgents

Like this:

I’ve found that it’s less common for the yucky stuff to store files there, but hey, it’s always good to check what your Mac may be opening automatically, right? Even if it’s user-level as opposed to system-level. Bad Things are still Bad Things even if they only affect one user on your Mac.