The Apple Support Community will permanently close on November 20, 2026. Starting today, the site will no longer accept new posts and is available in a read-only state.
You can continue to find trusted guidance and support on the official Apple Support site.
We want to thank the community members who have contributed their time and expertise to help others with their Apple products.
The Apple Support Community will permanently close on November 20, 2026. Starting today, the site will no longer accept new posts and is available in a read-only state.
You can continue to find trusted guidance and support on the official Apple Support site.
We want to thank the community members who have contributed their time and expertise to help others with their Apple products.
Is there a way to tell which .plis files in launch agent and daemons folders are trojans or malicious script?
Usually the plist file will be named after the bundle identifier of the application, but you can also just look in the file to see what application is being run.
Do any of these look suspicious to you:
file://localhost/System/Library/LaunchDaemons/edu.mit.Kerberos.kadmind.plist
file://localhost/System/Library/LaunchDaemons/edu.mit.Kerberos.krb5kdc.plist
file://localhost/System/Library/LaunchDaemons/exec.plist
file://localhost/System/Library/LaunchDaemons/finger.plist
file://localhost/System/Library/LaunchDaemons/ftp.plist
file://localhost/System/Library/LaunchDaemons/login.plist
file://localhost/System/Library/LaunchDaemons/nmbd.plist
file://localhost/System/Library/LaunchDaemons/ntalk.plist
file://localhost/System/Library/LaunchDaemons/org.amavis.amavisd_cleanup.plist
file://localhost/System/Library/LaunchDaemons/org.amavis.amavisd.plist
file://localhost/System/Library/LaunchDaemons/org.apache.httpd.plist
file://localhost/System/Library/LaunchDaemons/org.cups.cups-lpd.plist
file://localhost/System/Library/LaunchDaemons/org.cups.cupsd.plist
file://localhost/System/Library/LaunchDaemons/org.isc.named.plist
file://localhost/System/Library/LaunchDaemons/org.net-snmp.snmpd.plist
file://localhost/System/Library/LaunchDaemons/org.ntp.ntpd.plist
file://localhost/System/Library/LaunchDaemons/org.postfix.master.plist
file://localhost/System/Library/LaunchDaemons/org.samba.winbindd.plist
file://localhost/System/Library/LaunchDaemons/org.x.privileged_startx.plist
file://localhost/System/Library/LaunchDaemons/shell.plist
file://localhost/System/Library/LaunchDaemons/smbd.plist
file://localhost/System/Library/LaunchDaemons/ssh.plist
file://localhost/System/Library/LaunchDaemons/telnet.plist
file://localhost/System/Library/LaunchDaemons/tftp.plist
Not really, but items in the /System/Library/ folder are part of the system - nothing should be messing with or putting items there. Anything installed by you should have been installed in the /Library or ~/Library folders.
Thanks dude!!
Deleting .plist files
