If you’ve gotten some malware installed on your Mac—if, for example, you’re seeing bad pop-ups within your browser or you note that you’ve got one of the not-helpful-or-necessary “cleanup” apps installed—then a good first step to get stuff fixed is to download Malwarebytes and run a scan. Then you should check your browser by looking at its installed extensions, for example. Rebooting your Mac is often a helpful step to take, too, as doing so can sometimes flush the baddies out.

But another thing you could try is looking at what’s in your Mac’s root-level LaunchAgents folder. This folder contains items that run automatically when you log in to any user account on your Mac, and it’s a typical place for nefarious apps to stick files, as doing so could mean that their software will launch whenever you log in. Not good. So if you’d like to see your own LaunchAgents folder, start by clicking on your Desktop or on the blue smiley face in your Dock to be sure Finder is your active application, then choose Go > Computer or press Shift-Command-C.

"Go" Menu in Finder on macOS

Then double-click (or just click, if your Finder is in column view) on your Mac’s drive, typically dubbed Macintosh HD…

Macintosh HD in Finder window in macOS

…and you’ll see your top-level folders.

"Library" Folder in Finder in macOS

Double-click on “Library,” then, and you’ll find the folder labeled “LaunchAgents.”

"LaunchAgents" Folder in Finder in macOS

Another way to do this same thing is to use Finder’s “Go to Folder” command, accessible from the “Go” menu or by pressing Shift-Command-G.

"Go" Menu in Finder in macOS for going to specific locations on your Mac

When you see the “Go to Folder” dialog box appear, type in “/Library/LaunchAgents,” like so:

"Go to Folder" Box in Finder in macOS with /Library/LaunchAgents set as the location

If you then click the “Go” button, it’ll take you to the same location as my steps above.

Contents of LaunchAgents folder in macOS

Now, here’s an important caveat. Within this LaunchAgents folder is likely a bunch of stuff, most of which you do not want to mess with. If you don’t know what something is, do a web search to find out before you get rid of it! If you remove something important, you might have to reinstall software to fix what you’ve done. Filenames here typically begin with “com” followed by the developer’s company (e.g., “com.google” or “com.apple”), so it’s fairly easy to suss out what’s useful or needed and what’s not. For example, I know my list above contains only legitimate items; all of those things are linked with software I use. If you find something associated with an application you’re trying to get rid of, though, just select it and press Command-Delete or drag it to the trash icon in your Dock. You’ll then have to enter your administrator password to confirm that you know what you’re doing…

Warning Dialog Box with authentication request to remove items from LaunchAgents folder on the Mac

…because as I mentioned, removing items from this folder can be problematic if you do the wrong thing. So be careful.

In any case, while I’ve found Malwarebytes to be an invaluable tool for getting rid of unwanted software, this LaunchAgents folder is a place where bits of crap can be left behind, so it’s good to check it if you’re having symptoms like the ones I mentioned above. Or just for the heck of it. And if you want to be thorough, you could also look at your user-level LaunchAgents folder, which you can get to by way of selecting the aforementioned “Go to Folder” menu item and typing or pasting in the following:

~/Library/LaunchAgents

Like this:

"Go to Folder" Dialog Box in macOS Finder with user /Library/LaunchAgents directory set as the location

I’ve found that it’s less common for the yucky stuff to store files there, but hey, it’s always good to check what your Mac may be opening automatically, right? Even if it’s user-level as opposed to system-level. Bad Things are still Bad Things even if they only affect one user on your Mac.

Subscribe
Notify of

This site uses Akismet to reduce spam. Learn how your comment data is processed.

5 Comments
Newest
Oldest Most Voted
Inline Feedbacks
View all comments
wab95

Great tip, Melissa.

Another reason why I use VirusBarrier.

brett_x

Also, I’ve said this before here: It’s a good security measure to set up “Folder Actions” on these folders to alert you to any changes. (There are articles on the interwebs to show you how.) Once set up, you will get a notification any time one of those folders is changed. You’ll also get some visibility into how applications use / update those plists. I found that VMWare Fusion installs 2 launchDaemons every time it launches, then deletes them upon quitting (that’s not the intended use of launchDaemons.. I complained to them.. they don’t care).

Lee Dronick

Thank you! I only found one item in there com.google.keystone.agent.plist . What is that for and is it needed, I trust Google about as much as I trust Facebook and I don’t trust Zuck at all.

Lee Dronick

Thanks Valdo, I 86’d the plist