This discussion is locked
elgrego
Level 1 (10 points)

Q: how does Brother LOGINserver, etc. auto-load at login?

I want to find out how Brother's LOGINserver, NETserver, and USBserver are launching automatically whenever a user logs in (so as to stop them). I have seen other solutions on the forums which involve deleting those applications, but that's a Mickey Mouse solution to me. I want to know how to fix it by undoing whatever was done to make them start up automatically in the first place. I'm picky, I know. Really, though, I'd like to know how to do it just to know more about how the whole system works.

A new set of the processes launches with each user login - it's not that there's one set for the whole system.

I tried looking in Login Items in System Preferences, as well as cron, /Library/StartupItems, and launchdb, but I couldn't find anything relevant (and with launchdb I just got lost). I even tried looking through the shell scripts in the installer, but I couldn't decipher them enough to figure it out.

I have been trying to get the answer from Brother's support people, but they've been useless. Their latest communication to me insists that those apps are a part of OS X and that I'd have to ask Apple. (Never mind the fact that the software has the "Brother" logo all over it.) Whether older versions of them are included in OS X or not, I don't know, but I do know that they didn't used to start up automatically. That only started happening after I used Brother's installer, so it has to be something that the Brother installer changed. (I have an 8660DN, which is why I used the installer in the first place.)

Any gurus out there who can tell me how I might find out what is launching these things automatically?

PowerBook G3 (Pismo 400), Mac Mini 1.33 GHz, Mac OS X (10.5.4)

Posted on Aug 30, 2008 2:35 PM

by orangekay,Solvedanswer
orangekay orangekay
Level 5 (4,085 points)
A:
No should ever touch this file, but Brother clearly didn't get that memo, so here's hoping a suitable default will be regenerated in its absence.

The simplest thing to try would be to move /Library/Preferences/com.apple.loginitems.plist to the desktop and restart. If nothing bad happens, trash it.

Posted on Sep 10, 2008 2:10 PM

Close
elgrego

Q: how does Brother LOGINserver, etc. auto-load at login?

  • All replies
  • Helpful answers

Page 1 Next

  • by SillyWilly,

    SillyWilly SillyWilly Aug 31, 2008 2:11 AM in response to elgrego
    Level 1 (90 points)
    Aug 31, 2008 2:11 AM in response to elgrego
    You've looked in all the places I can think of. If Brother's been really naughty you could also try /System/Library/StartupItens

  • by elgrego,

    elgrego elgrego Sep 1, 2008 10:25 PM in response to SillyWilly
    Level 1 (10 points)
    Sep 1, 2008 10:25 PM in response to SillyWilly
    I just looked there in Terminal, and there's nothing in the folder. However, I did figure out that it has something to do with launchd. If you type

    launchctl list

    in the Terminal (assuming you have this situation), in the list that shows up, you'll see the following items:

    {quote}
    .ControlCenter
    \[0x0-0x96096].com.brother.utility.USBserver
    \[0x0-0x97097].com.brother.utility.NETserver
    \[0x0-0x92092].com.brother.LOGINserver
    {quote}

    The numbers between the brackets may be different on your system.

    I was able to successfully remove them from the list, and I thought I had solved the problem, but to test it, I logged one of my accounts out and logged it back in, and the problem still exists. ControlCenter launches automatically (despite having turned that off in its preferences), as well as the other three. I saw via launchctl that they had also been re-added to the list.

    I have yet to figure out what is causing those items to be re-added to launchd's list or how to kill this thing completely. Again, if anyone knows how this might be happening, please chime in!

  • by orangekay,Helpful

    orangekay orangekay Sep 1, 2008 11:38 PM in response to elgrego
    Level 5 (4,085 points)
    Sep 1, 2008 11:38 PM in response to elgrego
    Run this

    http://www.khiltd.com/Downloads/ConsultantsCanary.tar.gz

    When it's done look through the report for Launch Agents, Startup Items and Login Items from Brother, locate them based on the paths provided and delete those files.

  • by elgrego,

    elgrego elgrego Sep 4, 2008 2:17 PM in response to orangekay
    Level 1 (10 points)
    Sep 4, 2008 2:17 PM in response to orangekay
    I ran it, but unfortunately, it didn't show anything from Brother. It showed launch agents and daemons related to Little Snitch, and the startup item for Sleepwatcher, but nothing from Brother. No login items, either. I ran it both as an administrator and using sudo.

    Another strange quirk I've noticed. I have two accounts on my system - an administrator and a regular account that I use for watching videos. On the administrator account, the Brother Control Center no longer pops up, but LOGINserver, NETserver, and USBserver still start up automatically. On the regular account, the Brother Control Center starts up automatically on login (as do the others), but the Control Center won't pay attention when I tell it to not start up automatically. As soon as I close the preference window and open it again, the option is checked again. Strange.

    This is so frustrating. Could it be that Brother is using one of the older methods of starting up processes as well as launchd? Like RC or cron or something? What is the matter with these guys that they make the changes that they make to your system so difficult to track down?

  • by elgrego,

    elgrego elgrego Sep 10, 2008 9:49 AM in response to elgrego
    Level 1 (10 points)
    Sep 10, 2008 9:49 AM in response to elgrego
    bump

  • by orangekay,

    orangekay orangekay Sep 10, 2008 9:54 AM in response to elgrego
    Level 5 (4,085 points)
    Sep 10, 2008 9:54 AM in response to elgrego
    If it didn't find them then Brother is either spoofing the bundle IDs and version information or it isn't supplying them at all. Were there any entries with question marks in them?

    Is the installer you used available to the public?

  • by elgrego,

    elgrego elgrego Sep 10, 2008 11:57 AM in response to orangekay
    Level 1 (10 points)
    Sep 10, 2008 11:57 AM in response to orangekay
    I didn't see anything with a question mark next to it. I just ran it again to check. Here are the results:

    Consultant's Canary Report:
    Wed Sep 10 11:40 AM
    Mini: ~
    greg $ sudo python "/Applications/3rd Party Apps/Utilities/Consultant's Canary.app/Contents/Resources/Scripts/cc.pyo"
    Password:

    KHI Consultant's Canary Report v2.7.8

    Model Name......................................... Mac mini
    Model Identifier............................... PowerMac10,2
    Processor Name............................. PowerPC G4 (1.2)
    Processor Speed.................................... 1.33 GHz
    Number Of CPUs............................................ 1
    L2 Cache (per CPU)................................... 512 KB
    Memory................................................. 1 GB
    Bus Speed........................................... 167 MHz
    Boot ROM Version.................................... 4.9.4f0
    Serial Number................................... xxxxxxxxxxx
    System Version....................... Mac OS X 10.5.4 (9E17)
    Kernel Version................................. Darwin 9.4.0
    Boot Volume..................................... Mac mini HD
    Boot Mode............................................ Normal
    Computer Name.......................................... Mini
    User Name....................... System Administrator (root)
    Time since boot................................ 3 days 15:15

    ---

    Login Items

    /Applications/Stickies.app
    /Users/greg/Documents/Lists
    /Applications/Utilities/Activity Monitor.app

    ---

    Overly Privileged Processes

    /Library/Little Snitch/lsd
    /Applications/Utilities/Activity Monitor.app/Contents/Resources/pmTool

    ---

    Foreign System Augmentations


    Address Book Plug-Ins

    /Users/greg/Library/Address Book Plug-Ins
    FS Name: Bundle ID:
    BTGoogleDirections.bundle com.briantoth.addressbook.btgoogledirections
    BTGoogleEarth.bundle com.briantoth.addressbook.BTGoogleEarth
    BTGoogleMaps.bundle com.briantoth.addressbook.btgooglemaps
    BTGooglePreferences.bundle com.briantoth.addressbook.btgooglepreferences

    Automator Actions

    /Users/greg/Library/Automator
    FS Name: Bundle ID:
    Add Google Analytics.action com.echoone.Automator.AddGoogleAnalytics

    Contextual Menu Items

    /Library/Contextual Menu Items
    FS Name: Bundle ID:
    WSContextMenu.plugin com.fribi.WSContextMenu

    /Users/greg/Library/Contextual Menu Items
    FS Name: Bundle ID:
    DesktopPictureCM.plugin com.azinesoftware.DesktopPictureCM
    FinderIconCM.plugin com.pixture.FinderIconCM
    Google Notifier Quick Add CM Plugin.plugin com.google.GoogleNotifierQuickAddCMPlugin
    ScanWithClamXav.plugin uk.co.markallan.clamxav.ScanWithClamXav

    Frameworks

    /Library/Frameworks
    FS Name: Bundle ID:
    DivX Toolkit.framework com.divx.divxtoolkit

    Input Managers

    /Library/InputManagers
    FS Name: Bundle ID:
    Inquisitor org.xlife.InquisitorLoader
    SIMBL net.culater.SIMBL

    Internet/Safari Plug-Ins

    /Library/Internet Plug-Ins
    FS Name: Bundle ID:
    ContentUploaderPlugin.plugin com.divx.DivXContentUploadPlugin
    Disabled com.adobe.acrobat.pdfviewer
    DivXBrowserPlugin.plugin com.divx.DivXBrowserPlugin
    Flash Player.plugin com.macromedia.Flash Player.plugin
    Flip4Mac WMV Plugin.plugin net.telestream.wmv.plugin
    Flip4Mac WMV Plugin.webplugin net.telestream.wmv.webplugin
    RealPlayer Plugin.plugin com.RealNetworks.RealPlayerPlugin
    VLC Plugin.plugin com.netscape.vlc

    iPhoto Plug-Ins

    /Applications/iPhoto.app/Contents/PlugIns
    FS Name: Bundle ID:
    PicasaWebAlbums.iPhotoExporter com.google.maciphotoexporter

    Kernel Extensions

    /System/Library/Extensions
    FS Name: Bundle ID:
    EPSONUSBPrintClass.kext com.epson.print.kext.USBPrintClass
    EyeTVAfaTechHidBlock.kext com.elgato.driver.DontMatchAfaTech
    EyeTVCinergy450AudioBlock.kext com.elgato.driver.DontMatchCinergy450
    EyeTVCinergyXSAudioBlock.kext com.elgato.driver.DontMatchCinergyXS
    EyeTVClassicDontSeize.kext com.elgato.eyetv.ClassicNotSeizeDriver
    EyeTVEmpiaAudioBlock.kext com.elgato.driver.DontMatchEmpia
    EyeTVVoyagerAudioBlock.kext com.elgato.driver.DontMatchVoyager
    LittleSnitch.kext at.obdev.nke.LittleSnitch

    Launchd Jobs

    /Library/LaunchAgents
    FS Name: Bundle ID:
    at.obdev.LittleSnitchNetworkMonitor.plist at.obdev.LittleSnitchNetworkMonitor
    at.obdev.LittleSnitchUIAgent.plist at.obdev.LittleSnitchUIAgent

    /Library/LaunchDaemons
    FS Name: Bundle ID:
    at.obdev.littlesnitchd.plist at.obdev.littlesnitchd

    System Preferences Plug-Ins

    /Library/PreferencePanes
    FS Name: Bundle ID:
    DivX.prefPane com.divx.divxprefs
    Flip4Mac WMV.prefPane net.telestream.wmv.prefpane
    WinShortcutterPrefs.prefPane com.fribi.WinShortcutter

    /Users/eyetv/Library/PreferencePanes
    FS Name: Bundle ID:
    Perian.prefPane org.perian.PerianPane

    /Users/greg/Library/PreferencePanes
    FS Name: Bundle ID:
    ASM.prefPane de.vercruesse.cocoa.asmpref
    Perian.prefPane org.perian.PerianPane
    Stoplight.prefPane com.fluoridatedcode.stoplightpane

    QuickLook Plug-Ins

    /Users/greg/Library/QuickLook
    FS Name: Bundle ID:
    HetimaWebThumbnail.qlgenerator jp.hetima.webthumbnailquicklookgenerator
    HetimaWebThumbnail.qlgenerator jp.hetima.webthumbnailquicklookgenerator

    /Applications/3rd Party Apps/Skim.app/Contents/Library/QuickLook
    FS Name: Bundle ID:
    Skim.qlgenerator net.sourceforge.skim-app.quicklookgenerator
    Skim.qlgenerator net.sourceforge.skim-app.quicklookgenerator

    /Users/greg/Library/QuickLook
    FS Name: Bundle ID:
    HetimaWebThumbnail.qlgenerator jp.hetima.webthumbnailquicklookgenerator

    /Library/QuickLook
    FS Name: Bundle ID:
    QuickLookEyeTV.qlgenerator com.elgato.eyetv.quicklookgenerator
    QuickLookEyeTV.qlgenerator com.elgato.eyetv.quicklookgenerator

    QuickTime Plug-Ins

    /Library/QuickTime
    FS Name: Bundle ID:
    DivX Decoder.component com.DivXInc.DivXDecoder
    DivX Encoder.component com.DivXInc.DivXCodec
    EyeTV MPEG Support.component com.elgato.mpegsupport
    Flip4Mac WMV Advanced.component net.telestream.wmv.advanced
    Flip4Mac WMV Export.component net.telestream.wmv.export
    Flip4Mac WMV Import.component net.telestream.wmv.import
    XviD_Codec v0.5.1.component ch.rafz.naegeli.christoph.xvid_codec

    /Users/eyetv/Library/QuickTime
    FS Name: Bundle ID:
    AC3MovieImport.component com.cod3r.ac3movieimport
    Perian.component org.perian.Perian

    /Users/greg/Library/QuickTime
    FS Name: Bundle ID:
    AC3MovieImport.component com.cod3r.ac3movieimport
    Perian.component org.perian.Perian

    Screen Savers

    /Users/eyetv/Library/Screen Savers
    FS Name: Bundle ID:
    Ciao.saver com.lorenb.ciao

    /Users/greg/Library/Screen Savers
    FS Name: Bundle ID:
    BasicBlack.saver de.monkeybreadsoftware.screensavers.BasicBlack
    BigClock.saver com.enigmarelle.bigclock
    Ciao.saver com.lorenb.ciao
    Dog.saver org.joostmarkerink.flashsaver
    QuartzClocks.saver com.cskent.quartzclocksscreensaver
    Red Pill.saver com.ath0.redpill

    Cocoa Application Services

    /Users/greg/Library/Services
    FS Name: Bundle ID:
    TidyService.service com.ahtenindustries.TidyService
    WordService.service org.grunenberg.WordService

    Startup Items

    /Library/StartupItems
    FS Name: Bundle ID:
    SleepWatcher SleepWatcher

    Dashboard Widgets

    /Users/greg/Library/Widgets
    FS Name: Bundle ID:
    Blindtext.wdgt com.rihs.widget.blindtext
    Cicero.wdgt com.rahji.loremipsum
    craigslist 1.1.4.wdgt nz.net.stanton.craig.widget.craigslist
    Gas.wdgt com.andrethegiant.widget.gas
    Gmail.wdgt com.google.widgets.gmail.GmailWidget
    HTML - Checkpoint 2.2.wdgt de.dirkeinecke.widget.Checkpoint2.2
    HTML - ColorBurn.wdgt com.firewheeldesign.colorburn
    HTML - ColourMod.wdgt net.teevio.widget.ColourMod
    HTML - CSS Tags.wdgt com.PatrickPatoray.TagsCSS
    HTML - CSS Typography Calculator.wdgt com.attila.widget.CSS-Typography-Calculator
    HTML - Entities.wdgt com.remy.widget.Entities
    HTML - Tags.wdgt com.PatrickPatoray.TagsHTML
    HTML - Tidy.wdgt com.PatrickPatoray.HTMLTidy
    iCal Events.wdgt com.benkazez.widget.icalevents
    Sleep Display.wdgt com.kdh.widget.Sleep Display
    The Weather Channel.wdgt com.theweatherchannel.dashboardwidgetr




    End of Report

    Consultant's Canary Copyright © 2008 KHI Ltd. Co., LLC
    Unauthorized distribution is prohibited
    http://www.khiltd.com


    (Sorry the formatting died. I don't know how to force it to look the way it originally did in Terminal.)

    Yes, the installer is publicly available. It's located here:

    http://welcome.solutions.brother.com/bsc/public/us/us/en/dlf/downloadindex.html?reg=us&c=us&lang=en&prod=mfc8660dnus&type2=-1&os=81&flang=English&dlid=

    It's the one in the section called "Scanner Driver":

    http://welcome.solutions.brother.com/bsc/public/us/us/en/dlf/dlf/000000/003200/d lf003207.html?reg=us&c=us&lang=en&prod=mfc8660dn_us&type2=1&os=81&flang=4&dlid=d lf003207

    If you can figure out what it's doing to cause this nonsense via the installer scripts, my hat's off to you.

  • by orangekay,Helpful

    orangekay orangekay Sep 10, 2008 12:21 PM in response to elgrego
    Level 5 (4,085 points)
    Sep 10, 2008 12:21 PM in response to elgrego
    Well this is frightening. Look to see if this file exists:

    /private/etc/machinit_peruser.d/BRLaunch.plist

    You can get there by hitting command-shift-G in a Finder window and entering "/etc" for the path.

    If not, then that's good.

    Their installer script calls out to a compiled binary named "LoginItem" (which I assume executes with escalated privileges) so I can't tell exactly what it does without running it. Judging by what I've seen it looks like somebody named "ysawada" wrote some kind of private login item munging garbage rather than using the public APIs they were supposed to so.

    The utilities it launches seem to live in /Library/Printers/Brother/Utilities and I imagine that deleting them should at least address the symptom.

    I'm going to setup a sandbox to run it in and see what exactly it writes where, but in the meantime you might want to look at /Library/Preferences/com.apple.loginitems.plist and see if it's done anything unsavory in there.

  • by elgrego,

    elgrego elgrego Sep 10, 2008 1:42 PM in response to orangekay
    Level 1 (10 points)
    Sep 10, 2008 1:42 PM in response to orangekay
    Thankfully, there is no BRLaunch.plist. I checked in both the Finder and the Terminal (in case it had the invisible bit set).

    I checked /Library/Preferences/com.apple.loginitems.plist as you suggested, and it does have something unsavory in it!


    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    <key>privilegedlist</key>
    <dict>
    <key>Controller</key>
    <string>CustomListItems</string>
    <key>CustomListItems</key>
    <array>
    <dict>
    <key>Alias</key>
    <data>
    AAAAAADaAAMAAQAAw2T2IQAASCsAAAAAACXlsQAl5bIA
    AMKJeHIAAAAACSD//gAAAAAAAAAA/////wABABQAJeWx
    AAKrAwACpusAAGHfAAAAHAAOACAADwBMAE8ARwBJAE4A
    cwBlAHIAdgBlAHIALgBhAHAAcAAPABgACwBNAGEAYwAg
    AG0AaQBuAGkAIABIAEQAEgA5TGlicmFyeS9QcmludGVy
    cy9Ccm90aGVyL1V0aWxpdGllcy9TZXJ2ZXIvTE9HSU5z
    ZXJ2ZXIuYXBwAAATAAEvAP//AAA=
    </data>
    <key>CustomItemProperties</key>
    <dict>
    <key>com.apple.loginitem.legacyprefs</key>
    <dict>
    <key>Hide</key>
    <false/>
    <key>Path</key>
    <string>/Library/Printers/Brother/Utilities/Server/LOGINserver.app</string>
    </dict>
    </dict>
    <key>Icon</key>
    <data>
    SW1nUgAAABwAAAAAU1lTTAAAABAAAAAAQVBQTA==
    </data>
    <key>Name</key>
    <string>LOGINserver</string>
    </dict>
    </array>
    </dict>
    </dict>
    </plist>


    Also, based on what you said about "LoginItem", I executed "locate LoginItem", which found a copy of it in /Library/Receipts/BrotherTWAIN.pkg/Contents/Resources/

    Using the commands list embedded in the executable, I executed "./LoginItem print" which produced this result:

    Wed Sep 10 01:33 PM
    Mini: /Library/Receipts/BrotherTWAIN.pkg/Contents/Resources
    greg $ ./LoginItem print

    Index: 0
    Full path to App: /Library/Printers/Brother/Utilities/Server/LOGINserver.app
    Hide on launch: No
    Executable Name: LOGINserver.app



    Which would seem to correspond to the item in com.apple.loginitems.plist.

    What now? At this point I'm in over my head, so I don't want to do something incorrectly and hose something that I don't want hosed.

  • by orangekay,Solvedanswer

    orangekay orangekay Sep 10, 2008 2:10 PM in response to elgrego
    Level 5 (4,085 points)
    Sep 10, 2008 2:10 PM in response to elgrego
    Nobody should ever touch this file, but Brother clearly didn't get that memo, so here's hoping a suitable default will be regenerated in its absence.

    The simplest thing to try would be to move /Library/Preferences/com.apple.loginitems.plist to the desktop and restart. If nothing bad happens, trash it.

  • by elgrego,

    elgrego elgrego Sep 10, 2008 3:15 PM in response to orangekay
    Level 1 (10 points)
    Sep 10, 2008 3:15 PM in response to orangekay
    Sadly, that didn't fix it. I tried moving it via the Finder and restarting as well as restarting into single-user mode and moving it from there. Nothing bad happened, but the file was automatically regenerated on each restart, and it includes the entry for LOGINserver. LOGINserver, USBserver, and NETserver were all running after each restart. Something else must be running at startup to re-create that record if it's missing. Ugh.

    Any luck with running it in the sandbox?

  • by orangekay,

    orangekay orangekay Sep 10, 2008 3:27 PM in response to elgrego
    Level 5 (4,085 points)
    Sep 10, 2008 3:27 PM in response to elgrego
    If you have the LoginItem tool extracted then the syntax to undo whatever it did should be something like:

    sudo ./LoginItem global remove /Library/Printers/Brother/Utilities/Server/LOGINserver.app

    Haven't tried running it myself yet.

  • by elgrego,

    elgrego elgrego Sep 10, 2008 3:35 PM in response to orangekay
    Level 1 (10 points)
    Sep 10, 2008 3:35 PM in response to orangekay
    But wouldn't that suggest that LoginItem is running on every startup? How? From the /Library/Receipts/ folder?

    And doesn't removing com.apple.loginitems.plist do the same thing?

  • by elgrego,

    elgrego elgrego Sep 10, 2008 3:38 PM in response to orangekay
    Level 1 (10 points)
    Sep 10, 2008 3:38 PM in response to orangekay
    I just found something else: /Library/Preferences/loginwindow.plist:

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    <key>AutoLaunchedApplicationDictionary</key>
    <array>
    <dict>
    <key>Hide</key>
    <false/>
    <key>Path</key>
    <string>/Library/Printers/Brother/Utilities/Server/LOGINserver.app</string>
    </dict>
    </array>
    </dict>
    </plist>


    I'll try moving both and see if that does it.
Page 1 Next