How to open LaunchAgents folder on Mac and check for malicious software?

macos tips
1

I want to delete a launch agent from an old app but don’t know where this folder is. Please, somebody, explain how to get to the LaunchAgents folder on Mac.

Also, can I delete the launch agent on my Mac? Is it possible that this folder may contain malware?

I’d appreciate it if someone could explain what this folder is, and how to get to it and check for malware.

2

The LaunchAgents folder on a Mac is a directory where items that run automatically when you log in are saved. These small programs or scripts can access the user interface and display information. For example, if there’s a calendar agent, it can check your calendar account for events and notify you when the event begins.

There are three types of LaunchAgents folder on your Mac:

  • /Library/LaunchAgents: agents for all user accounts
  • ~/Library/LaunchAgents: agents for a specific user account
  • /System/Library/LaunchAgents: agents for macOS only, protected by SIP.

To get to the LaunchAgents folder on Mac, you can take the following steps:

  1. Open a Finder window.
  2. Click Go > Go to Folder in the menu bar.
  3. Copy and paste the proper folder path, e.g., ~/Library/LaunchAgents and hit Enter.

There, you’ll find the .plist preference files of processes that work in the background when you log in. They define the agents’ behavior, controlling what they should do, when they should start, and other aspects needed for execution.

Typically, the agents are for automatically launching apps or scripts when a user logs in, running periodic tasks, or background processes.

You can delete the agents from apps you no longer use or intend to uninstall by removing the corresponding .plist files in the LaunchAgents folder. Just remember to research the item before you delete it. If you remove an important file for an app you run regularly, you might experience performance issues and have to reinstall it.

Note: You should not delete files in /System/Library/LaunchAgents.

3

If your browser redirects you to adware sites or alter your default homepage without your permission, there may be malware snaked into your Mac and you should definitely remove the suspicious ones from the user LaunchAgents folder. However, if your Mac doesn’t have strange behaviors, it’s still good to be cautious and monitor the folders, as they are open to both legitimate and illegitimate apps.

To do this, take the steps below:

  1. Press Command-Space and type “Script Editor.”
  2. Open the app, click Script Editor > Settings/Preferences> General > Show Script menu in menu bar.
  3. Tap the Scrip menu icon on your desktop’s top-right menu bar.
  4. Select Folder Actions > Enable Folder Actions > Attach Script to Folder.
  5. In the pop-up dialog, choose “add - new item alert” and click OK.
  6. Select the LaunchAgents folder and click Choose.
  7. Repeat the steps for another LaunchAgents folder.
  8. Open Finder, then navigate to ~/Library/LaunchAgents.
  9. Right-click on the LaunchAgents folder.
  10. Choose Services > Folder Actions Setup to bind the new item alert script to each folder.

From now on, an alert will pop up when a new item is added to your LaunchAgents folder, enabling you to spot any illegitimate process immediately.