Every time you turn on your Mac, various apps and services launch automatically in the background. These macOS startup apps, often called login items, can be very useful. For example, Backblaze, Busycal, and Dropbox install background-only startup apps to perform their essential tasks for those apps.
But having too many login items can increase your Mac’s boot time and decrease its performance. A startup app can also be malicious, so removing them can be critical for maintaining your Mac’s health.
We’ll show you how to manage startup apps and catch the malicious ones on your Mac below.
How to Add Startup Apps on Your Mac
If you deal with specific apps on a daily basis, you can save yourself a click or two by making sure to run them automatically every time you log in. Open System Preferences > Users & Groups. Select your user account in the list on the left, and click Login Items.
Click the Add (+) button and, from the Finder dialog box that appears, select the app from the Applications folder and click Add.
Repeat the above steps to add more apps. If you want the app’s window to stay hidden when it launches, click the Hide checkbox next to that app.
Note: If you have administrator privileges, you can manage startup items for a different user account as well. To learn more, read our complete guide on managing user accounts on Mac.
Delete or Disable Startup Apps on Your Mac
If your Mac boots up slowly, it’s an indicator that you should remove some Mac startup programs. Open System Preferences > Users & Groups. Select your account in the list on the left, and click Login Items.
Scan the list of login items, select the app you want to remove, and click the Minus (–) button.
Or, you can even disable an app from launching on startup using the Dock. Right-click on the app, hover your pointer over Options. Then, untick the checkmark next to Open at Login.
Since developers occasionally set their apps to launch at login without your explicit permission, it makes sense to review startup apps regularly to optimize the performance of your Mac.
Temporarily Disable Startup Apps on Your Mac
You can prevent startup apps from running automatically on a temporary, per-login basis. This is useful when you need to log in quickly or troubleshoot your Mac to fix startup problems.
To do this, when you see the login window, press and hold the Shift key while you log in. Release the Shift key when you see the Dock.
If you don’t see a login window, restart your Mac, press and hold the Shift key while you see the progress bar. Then release the Shift key after the desktop appears.
Delay the Launch of Mac Startup Apps
Does your Mac have several indispensable startup items left even after you’ve cleaned up everything? You could disable them, but then it would be tiresome to launch each app manually.
Instead, Delay Start is a simple utility app that lets you spread out the timing of your launch items to reduce the load on your Mac. To get started, remove the existing login items from the list, click the Add (+) button and add the Delay Start app instead.
Launch Delay Start. Click the Add (+) button to add the apps you want to open automatically after a specific period. Enter the time (in seconds) in the Time Setting box. macOS will delay the launch of that particular app by the time set above.
Catch Malicious Startup Items on Your Mac
Whether it’s a malicious browser extension that injects ads into search results or malware that aims to steal you data, the primary goal of any malicious startup item is to run in the background for every macOS session. “Persistence” is a technique by which malware ensures that it’ll get executed by the OS on startup.
If you believe that there’s malware on your system, you can check the login items and remove the unknown app. But attackers are smart. They don’t want you to see any app that makes you suspicious so they might hide it instead. Unfortunately, Apple doesn’t expose these hidden components in the macOS interface.
Two such processes are: LaunchDaemons and LaunchAgents. They both come under launchd, which is the primary parent process responsible for managing every other processes. To learn more about them, read our guide on LaunchDaemons and Agents and their importance in macOS.
The situation gets worse when a malicious app can launch itself by including a reverse-engineered helper application. Some of the most common malware, listed by MalwareBytes, that install themselves as launch items are OSX.CookieMiner, OSX.Siggen, OSX.Mokes, and more.
Inspect Your Mac
Each user on a Mac has the following LaunchAgents folders:
/Library/LaunchAgents(for all user accounts)
~/Library/LaunchAgents(for a specific user account)
/System/Library/LaunchAgents(managed by macOS since OS X 10.11)
For LaunchDaemons folders:
/System/Library/LaunchDaemons(for native macOS processes)
/Library/LaunchDaemons(for installed third-party apps)
Except for the System folders, you must pay close attention to these folders. The .PLIST files in these folders are the code that instructs macOS on how to execute them. Delete the .PLIST files for any apps you previously uninstalled or anything that sounds suspicious.
Take Control of Your Mac’s Startup Programs
Here are a few third-party tools that put you in control of monitoring the startup apps, offering suggestions to remove them if needed.
App Cleaner & Uninstaller
The Startup Programs section lists all login items, agents, and daemons installed on your Mac. Toggle the slider to disable each item. You can also remove the LaunchAgent entirely from the system. This app is available for only $20.
Download: App Cleaner & Installer ($19.90)
This app works on the principle of “Persistence.” It lists all the installed apps and their components in a neat interface. Click Scan and pay close attention to the Launch Items section, where it lists all the agents and daemons. Each row gives detailed information about the app. It includes signed or unsigned status and scan results from VirusTotal.
Download: KnockKnock (Free)
This is a tool that allows you to start an app, a script, or run a command automatically on a schedule. It can monitor all the LaunchAgents and Daemons folders and show a notification if anything changes. It’s available for only $15.
Download: Lingon X ($14.99)
It continuously monitors the persistence location. This app runs in the background and shows you an alert whenever an app adds a persistent component to macOS.
Download: BlockBlock (Free)
A useful diagnostic utility to help you find serious problems on your Mac. When you run this tool, it collects various information and presents it to you in an easily digestible format. Etrecheck can remove annoying adware, find suspicious agents or daemons, unsigned files, and more. The app is available for $18.
Download: EtreCheck ($17.99)
Mac Boot Options and Modes
Login items allow you to manage startup apps with an easy-to-use interface. Unfortunately, malicious apps can take advantage of the hidden components in the Library folder to affect your Mac’s health.
This article has shown you where to look for these hidden items and some third-party apps that can help you remove them.
Here’s what you need to know about Mac boot options and modes if you want to troubleshoot startup and other issues.
About The Author