adrianfulop wrote:
Yeah, your sarcasm can be felt even without the <sarcasm> tag here.
Do tell me though, how can a LaunchDaemon add a NEW entry to the login list, expect for the one it was already adding?
The Login list or the background items list--they are different, though located in the same place.
Either way, the app likely updated itself as it was allowed to do by installing it with elevated privileges. That update (to the updater in this case) triggered a change in the Login Items or the Background items (possibly both). Based on this and other posts, it appears they changed their signing certificate as that is what is displayed in the Background items list (not the name of a program which seems to be confusing a lot of people).
The key point here is we have a NEW entry, which was not there before.
If it was updated, it is a NEW item. If the signing certificate changed, it is definitely a "new" item to macOS.
Nobody can answer the question of "What is a Goolag LLC Login Item?" because that name is not an item. It is the name registered with the signing certificate. To answer the related question, "What is the app associated with the Goolag LLC login item," we would have to install that software on our Macs. Or, we can suggest ways you can determine for yourself such as looking at what is in LaunchAgents and LaunchDaemons or using a tool like EtreCheck which will show you what you have installed and what app is related to it.
To the second question I refer to the answer to the first. If we don't install it, we can't tell you what it does.
The third question goes directly to your question about giving your password to Goolag. By using your admin password to elevate the privileges of the installer, you grant that app permission to do just about whatever it wants. It appears it has decided to update itself and in the process of the update, altered the signing certificate for the app which generated a "new" item.
