Can't remove 'unknown login items'?

Question

lumenBLASTER Author

Level 1

18 points

Can't remove 'unknown login items'?

Just upgraded to 10.13 and my Login Items window in Systems Preferences is filled with 'Unknowns.'

iMac, macOS High Sierra (10.13)

Posted on Sep 26, 2017 7:05 PM

Reply

Answer 1

Best reply

mlodger

Level 1

18 points

Oct 19, 2017 1:17 PM in response to bobwen

Okay, they found the problem a couple of days ago. They know how to fix it, but as far as I know, they're not sure what caused it to happen in the first place (migration assistant is my guess).

Anyway, search out and destroy a file called backgrounditems.btm then reboot. The login panel should be cleared out. The senior advisor and I rebooted three times with a test app inserted through the normal login panel procedures and all was well. I added back my normal items and they'e still working just fine.

I'm on a new/used iMac late 2015 2.8ghz, I-5, running 10.13

Good luck.

Reply

Answer 2

Oct 19, 2017 1:54 PM in response to mlodger

Thanks @mlodger!

It looks like the path of the

backgrounditems.btm

file is here:

/Users/$your_user/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm

found via

sudo find / -name backgrounditems.btm -not -path '*TimeMachine*'.

I have just deleted the file; will post back here after a reboot.

Reply

Answer 3

Dec 9, 2017 6:08 PM in response to lumenBLASTER

I only read the first page comments but if it's helpful: these processes, usually I get them when I manage a Mac with macOS Server Profile Manager then sign in with another account not used to install the profile or a domain account. Also when a profile no longer connects with the server or network share.

In my case it's always just network folders I set up (via profile) to automount on login--becase sometimes if you eject or remount a share and don't use the same username/password combo it's deleted from Keychain and it starts asking for it on every login then other items, such as a networked iTunes Library store, fail to load when they also are set to launch at login. Profile Manager solves that. 🤓

If you've been playing around with Server or was asked randomly asked to install a profile and absentmindedly did--sometimes I'm so tired I just click OK immediately regretting not reading first--you'll find it on System Preferences.

Reply

Answer 4

Oct 6, 2017 9:49 AM in response to lumenBLASTER

I have opened up a bug with Apple about this.

https://bugreport.apple.com/web/?problemID=34857430

If you're able to, please comment on the bug report that you also have this issue!

It's currently breaking a lot of other apps:

https://github.com/electron/electron/issues/10561#issuecomment-334634029

Reply

Answer 5

John Galt

Level 10

140,718 points

Sep 26, 2017 7:52 PM in response to lumenBLASTER

Before you do anything drastic like deleting the ~/Library/Preferences/com.apple.loginitems.plist file, control-click one of the "unknown" items and select Show in Finder.

A Finder window should open with that item selected. Does it?

Reply

Answer 6

Sep 27, 2017 7:32 PM in response to John Galt

I have this same problem as well. After upgrading to High Sierra I'd say about half of my login items no longer started automatically so I went to examine Users & Groups - Login Items. To my surprise I had about two recognizable login items in the list while the other few were Unknown and looked exactly like the items in the screen shot above. Control-clicking on those items does nothing. "Show in Finder" is not displayed. Control-clicking on the two recognizable login items does bring up that option.

Deleting an item by clicking on the minus sign (after unlocking the padlock icon, of course!) doesn't delete it; the list box simply moves focus to the item above. Most mysteriously, clicking on the "Hide" checkbox causes another Unknown item to be created. After trying to resolve this a bunch of times I now have something like 40-50 Unknown entries in "Login Items".

These "new" items remain after restarting and in safe mode. There doesn't appear to be any modification to ~/Library/Preferences/com.apple.loginitems.plist or any other relevant plist file so I have no idea where these changes are being stored. In fact com.apple.loginitems.plist does not appear to have been modified on my system for some time so it would be the same file that existed prior to the upgrade.

Any ideas?

Reply

Answer 7

John Galt

Level 10

140,718 points

Sep 26, 2017 9:06 PM in response to lumenBLASTER

Two suggestions: if you are using any non-Apple "anti-virus" or "cleaning" products, anything at all in that broad category of useless garbage, uninstall it in strict accordance with its instructions. To cite one example, the "Avast" product was known to create an Admin-level User for purposes known only to it, and which was probably rendered inert by SIP. The manifestation of that was a zombie Login Item such as you describe, but as far as I know, only one.

Also, if that Mac is bound to an Active Directory, a number of "unknown" Login Items will appear. The solution is to un-bind the Mac from that AD.

Reply

Answer 8

lumenBLASTER Author

Level 1

18 points

Sep 26, 2017 9:16 PM in response to John Galt

Hi thanks for the reply. I am not using any cleaning or anti virus products. I do not think this issue is affecting performance. But it is an irritant when trying to add and remove login items as I have to scroll through dozens of unknown entries to enable or disable what I need.

Reply

Answer 9

John Galt

Level 10

140,718 points

Sep 26, 2017 9:33 PM in response to lumenBLASTER

Unfortunately I don't have an explanation for the presence of those "unknowns". If you are willing to try deleting the ~/Library/Preferences/com.apple.loginitems.plist file, do that. It will also remove your desired Login Items, but not the programs themselves, which simply have to be added again with the [+] button.

Don't do anything without a backup.

Reply

Answer 10

Sep 27, 2017 7:31 PM in response to John Galt

I went ahead and deleted the plist file and it had absolutely no effect on this issue. Furthermore, all of my startup items that had been listed in Login Items still loaded at startup and, as I mentioned previously, the plist file does not appear to have been modified for a number of weeks. It is as if ~/Library/Preferences/com.apple.loginitems.plist is no longer being used in High Sierra and the entries are now being stored somewhere else. If true, perhaps the migration process was the culprit. Is there any way to examine the preferences pane more closely to see what Apple is doing here?

Reply

Answer 11

Sep 28, 2017 7:00 PM in response to John Galt

I don't have Spotify and besides that thread makes no sense. The original poster is saying that since Spotify no longer works on their machine any other issues must be related?

I've submitted a bug report to Apple. Guess I just have to be patient.

Reply

Answer 12

Oct 2, 2017 12:18 PM in response to John Galt

I’m running into this exact same issue. So far I’ve been unable to resolve it by deleting the login items plist file, restarting in safe mode, etc. I don’t have any antivirus, spotify, or active-directory stuff in the mix. As another unfortunate side effect, Slack now crashes on launch with the crash report mentioning login-item related calls.

Right clicking on login item entries to do ‘Show in Finder’ works for valid login items but no menu pops up for these ‘Unknown’ ones.

If anyone from Apple is listening, I see this printed in Console.app when trying to press the [-] button on one of these entries:

default

12:02:49.082003 -0700

com.apple.preferences.users.remoteservice

### Error:18446744073709551581 File:/BuildRoot/Library/Caches/com.apple.xbs/Sources/AccountsPref/AccountsPref- 285/LoginItem.m Line:68

This is on 10.13 (17A365)

This first started happening for me after I went through this process to try and get Android File Transfer to stop auto-launching when I connect an android phone (perhaps it can be used as a repro case): http://monkeyhybrid.com/2013/12/stop-android-file-transfer-application-auto-star ting-on-os-x/

Anyone please holler if you find a solution for this; it’s sort of rendered my machine dead-in-the-water since I rely on Slack for work :-/

Reply

Answer 13

Oct 11, 2017 8:24 AM in response to eric from san francisco

I believe the problem is even more serious than it would initially appear, leading to a number of applications crashing on launch. It appears to happen in the part of the applications' code that deals with the "Start at Login" setting. The system LSSharedFileListItemResolve call returns a null URL even though it also returns a status code indicating success. The applications' code appears to assume it would be non-null and passes it as the first parameter CFEqual, which leads to a crash. This appears to have worked reliably from 10.6-10.12 but something has definitely changed in 10.13 which may be affecting System Preferences as well. I opened a bug a while ago and hopefully they will correct this in a future update. I don't believe there's a workaround for System Preferences but there is for the application crashes.

Reply

Answer 14

bobwen

Level 1

4 points

Oct 11, 2017 7:46 PM in response to RedmondGuy

RedmondGuy wrote:

I believe the problem is even more serious than it would initially appear, leading to a number of applications crashing on launch. It appears to happen in the part of the applications' code that deals with the "Start at Login" setting. The system LSSharedFileListItemResolve call returns a null URL even though it also returns a status code indicating success. The applications' code appears to assume it would be non-null and passes it as the first parameter CFEqual, which leads to a crash. This appears to have worked reliably from 10.6-10.12 but something has definitely changed in 10.13 which may be affecting System Preferences as well. I opened a bug a while ago and hopefully they will correct this in a future update. I don't believe there's a workaround for System Preferences but there is for the application crashes.

Sir, i think i get same problem as you describe! 😠

Here is the crash log of my chrome(after the 'unknown login items' appeared):

------------------------------------(***)--------------------------------------

Process: Google Chrome [1171]

Path: /opt/homebrew-cask/*/Google Chrome.app/Contents/MacOS/Google Chrome

Identifier: com.google.Chrome

Version: 61.0.3163.100 (3163.100)

Code Type: X86-64 (Native)

Parent Process: ??? [1]

Responsible: Google Chrome [1171]

User ID: 501

Date/Time: 2017-10-10 20:03:53.821 +0800

OS Version: Mac OS X 10.13 (17A405)

Report Version: 12

Anonymous UUID: 68A755D8-1272-F175-ACF4-BC2CB8B8C5A1

Time Awake Since Boot: 1100 seconds

System Integrity Protection: enabled

Crashed Thread: 29 TaskSchedulerBackgroundBlockingWorker2

Exception Type: EXC_BAD_INSTRUCTION (SIGILL)

Exception Codes: 0x0000000000000001, 0x0000000000000000

Application Specific Information:

*** CFEqual() called with NULL first argument ***

Thread 0:: CrBrowserMain Dispatch queue: com.apple.main-thread

0 libobjc.A.dylib 0x00007fff658beeb2 objc_msgSend + 50

1 com.apple.AppKit 0x00007fff3ce1d699 NSViewHierarchyNoteGeometryInWindowDidChange + 160

2 com.apple.AppKit 0x00007fff3c553913 -[NSView _invalidateFocus] + 63

3 com.apple.AppKit 0x00007fff3c598e8b -[NSView setFrameOrigin:] + 758

4 com.apple.AppKit 0x00007fff3c5a995c -[NSView setFrame:] + 341

5 com.apple.AppKit 0x00007fff3c8a9380 -[NSViewAnimation setCurrentProgress:] + 2065

6 com.apple.AppKit 0x00007fff3c97fbc0 __55-[NSAnimation(NSInternal) _advanceTimeWithDisplayLink:]_block_invoke + 31

7 com.apple.AppKit 0x00007fff3c695e9c NSPerformVisuallyAtomicChange + 146

8 com.apple.AppKit 0x00007fff3c725f72 -[NSAnimation(NSInternal) _advanceTimeWithDisplayLink:] + 199

9 com.apple.AppKit 0x00007fff3c725e18 -[NSScreenDisplayLink _fire] + 298

10 com.apple.CoreFoundation 0x00007fff3ef5dcd4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20

11 com.apple.CoreFoundation 0x00007fff3ef5d947 __CFRunLoopDoTimer + 1095

12 com.apple.CoreFoundation 0x00007fff3ef5d44a __CFRunLoopDoTimers + 346

13 com.apple.CoreFoundation 0x00007fff3ef54a4b __CFRunLoopRun + 2427

14 com.apple.CoreFoundation 0x00007fff3ef53e43 CFRunLoopRunSpecific + 483

15 com.apple.HIToolbox 0x00007fff3e273866 RunCurrentEventLoopInMode + 286

16 com.apple.HIToolbox 0x00007fff3e2735d6 ReceiveNextEventCommon + 613

17 com.apple.HIToolbox 0x00007fff3e273354 _BlockUntilNextEventMatchingListInModeWithFilter + 64

18 com.apple.AppKit 0x00007fff3c5709f7 _DPSNextEvent + 2085

19 com.apple.AppKit 0x00007fff3cd05d98 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 3044

20 com.google.Chrome.framework 0x00000001082f3ea0 0x106c49000 + 23768736

21 com.google.Chrome.framework 0x00000001086fdc2a 0x106c49000 + 28003370

22 com.google.Chrome.framework 0x00000001082f3de4 0x106c49000 + 23768548

23 com.apple.AppKit 0x00007fff3c7a2fcb -[NSApplication _doModalLoop:peek:] + 476

24 com.apple.AppKit 0x00007fff3c987c83 __35-[NSApplication runModalForWindow:]_block_invoke_2 + 64

25 com.apple.AppKit 0x00007fff3c987c30 __35-[NSApplication runModalForWindow:]_block_invoke + 75

26 com.apple.AppKit 0x00007fff3ce3506c _NSTryRunModal + 100

27 com.apple.AppKit 0x00007fff3c7a0a5d -[NSApplication runModalForWindow:] + 133

28 com.apple.AppKit 0x00007fff3c975e93 __19-[NSAlert runModal]_block_invoke_2 + 158

29 com.apple.AppKit 0x00007fff3c975de2 __19-[NSAlert runModal]_block_invoke + 75

30 com.apple.AppKit 0x00007fff3ce3506c _NSTryRunModal + 100

31 com.apple.AppKit 0x00007fff3c815659 -[NSAlert runModal] + 124

32 com.apple.AppKit 0x00007fff3c840cf1 __55-[NSPersistentUIRestorer promptToIgnorePersistentState]_block_invoke + 937

33 com.apple.AppKit 0x00007fff3c84090d -[NSApplication _suppressFinishLaunchingFromEventHandlersWhilePerformingBlock:] + 25

34 com.apple.AppKit 0x00007fff3c8408bf -[NSPersistentUIRestorer promptToIgnorePersistentState] + 241

35 com.apple.AppKit 0x00007fff3c575b81 -[NSApplication _reopenWindowsAsNecessaryIncludingRestorableState:completionHandler:] + 183

36 com.apple.AppKit 0x00007fff3c57599e -[NSApplication(NSAppleEventHandling) _handleAEOpenEvent:] + 549

37 com.apple.AppKit 0x00007fff3c5755e1 -[NSApplication(NSAppleEventHandling) _handleCoreEvent:withReplyEvent:] + 690

38 com.apple.Foundation 0x00007fff41028be4 -[NSAppleEventManager dispatchRawAppleEvent:withRawReply:handlerRefCon:] + 287

39 com.apple.Foundation 0x00007fff41028a62 _NSAppleEventManagerGenericHandler + 102

40 com.apple.AE 0x00007fff40017e20 aeDispatchAppleEvent(AEDesc const*, AEDesc*, unsigned int, unsigned char*) + 1788

41 com.apple.AE 0x00007fff400176c7 dispatchEventAndSendReply(AEDesc const*, AEDesc*) + 41

42 com.apple.AE 0x00007fff400175b5 aeProcessAppleEvent + 383

43 com.apple.HIToolbox 0x00007fff3e282f60 AEProcessAppleEvent + 55

44 com.apple.AppKit 0x00007fff3c570cb6 _DPSNextEvent + 2788

45 com.apple.AppKit 0x00007fff3cd05d98 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 3044

46 com.google.Chrome.framework 0x00000001082f3ea0 0x106c49000 + 23768736

47 com.google.Chrome.framework 0x00000001086fdc2a 0x106c49000 + 28003370

48 com.google.Chrome.framework 0x00000001082f3de4 0x106c49000 + 23768548

49 com.apple.AppKit 0x00007fff3c565805 -[NSApplication run] + 764

50 com.google.Chrome.framework 0x000000010870e2ae 0x106c49000 + 28070574

51 com.google.Chrome.framework 0x000000010870ccac 0x106c49000 + 28064940

52 com.google.Chrome.framework 0x000000010872fb53 0x106c49000 + 28207955

53 com.google.Chrome.framework 0x00000001082f9d46 0x106c49000 + 23792966

54 com.google.Chrome.framework 0x0000000107234e14 0x106c49000 + 6209044

55 com.google.Chrome.framework 0x00000001072374d2 0x106c49000 + 6218962

56 com.google.Chrome.framework 0x0000000107230e9c 0x106c49000 + 6192796

57 com.google.Chrome.framework 0x00000001082b05d0 0x106c49000 + 23492048

58 com.google.Chrome.framework 0x0000000109bd3be4 0x106c49000 + 49851364

59 com.google.Chrome.framework 0x00000001082afbb4 0x106c49000 + 23489460

60 com.google.Chrome.framework 0x0000000106c4ccb8 ChromeMain + 168

61 com.google.Chrome 0x0000000101477dd4 main + 404

62 libdyld.dylib 0x00007fff664bb145 start + 1

Thread 1:: Dispatch queue: NSPersistentUI I/O

0 libsystem_kernel.dylib 0x00007fff6660b5f2 __unlink + 10

1 libsystem_kernel.dylib 0x00007fff666082e0 unlink + 11

2 com.apple.CoreFoundation 0x00007fff3efe0b9b _CFDeleteFile + 75

3 com.apple.CoreFoundation 0x00007fff3efe0b10 CFURLDestroyResource + 288

4 com.apple.AppKit 0x00007fff3cee401e -[NSPersistentUIFileManager tryCreatingPersistentStateDirectoryForURL:] + 540

5 com.apple.AppKit 0x00007fff3cee260e -[NSPersistentUIFileManager _refreshStateDirectoryIfNecessary] + 83

6 com.apple.AppKit 0x00007fff3cee4480 ___NSPersistentUIDispatchQueueAsync_block_invoke + 28

7 libdispatch.dylib 0x00007fff664897a2 _dispatch_call_block_and_release + 12

8 libdispatch.dylib 0x00007fff66481f64 _dispatch_client_callout + 8

9 libdispatch.dylib 0x00007fff6649642b _dispatch_queue_serial_drain + 635

10 libdispatch.dylib 0x00007fff6648930e _dispatch_queue_invoke + 373

11 libdispatch.dylib 0x00007fff66497117 _dispatch_root_queue_drain_deferred_wlh + 332

12 libdispatch.dylib 0x00007fff6649aef0 _dispatch_workloop_worker_thread + 880

13 libsystem_pthread.dylib 0x00007fff66745033 _pthread_wqthread + 980

14 libsystem_pthread.dylib 0x00007fff66744c4d start_wqthread + 13

Thread 2:

0 libsystem_pthread.dylib 0x00007fff66744c40 start_wqthread + 0

1 libdispatch.dylib 0x00007fff6648c8e0 _dispatch_async_redirect_invoke + 703

Thread 3:

0 libsystem_kernel.dylib 0x00007fff66601e76 mach_msg_trap + 10

1 libsystem_kernel.dylib 0x00007fff66601390 mach_msg + 60

2 com.google.Chrome.framework 0x000000010b00535e 0x106c49000 + 71025502

3 com.google.Chrome.framework 0x000000010b005604 0x106c49000 + 71026180

4 com.google.Chrome.framework 0x000000010b001528 0x106c49000 + 71009576

5 libsystem_pthread.dylib 0x00007fff667456c1 _pthread_body + 340

6 libsystem_pthread.dylib 0x00007fff6674556d _pthread_start + 377

7 libsystem_pthread.dylib 0x00007fff66744c5d thread_start + 13

Thread 4:

0 libsystem_kernel.dylib 0x00007fff6660b6da __workq_kernreturn + 10

1 libsystem_pthread.dylib 0x00007fff6674526f _pthread_wqthread + 1552

2 libsystem_pthread.dylib 0x00007fff66744c4d start_wqthread + 13

Thread 5:

0 libsystem_kernel.dylib 0x00007fff6660b6da __workq_kernreturn + 10

1 libsystem_pthread.dylib 0x00007fff6674506a _pthread_wqthread + 1035

2 libsystem_pthread.dylib 0x00007fff66744c4d start_wqthread + 13

Thread 6:: NetworkConfigWatcher

0 libsystem_kernel.dylib 0x00007fff66601e76 mach_msg_trap + 10

1 libsystem_kernel.dylib 0x00007fff66601390 mach_msg + 60

2 com.apple.CoreFoundation 0x00007fff3ef55475 __CFRunLoopServiceMachPort + 341

3 com.apple.CoreFoundation 0x00007fff3ef547c7 __CFRunLoopRun + 1783

4 com.apple.CoreFoundation 0x00007fff3ef53e43 CFRunLoopRunSpecific + 483

5 com.apple.Foundation 0x00007fff410003f6 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 277

6 com.google.Chrome.framework 0x000000010870e0fe 0x106c49000 + 28070142

7 com.google.Chrome.framework 0x000000010870ccac 0x106c49000 + 28064940

8 com.google.Chrome.framework 0x000000010872fb53 0x106c49000 + 28207955

9 com.google.Chrome.framework 0x0000000108760629 0x106c49000 + 28407337

10 com.google.Chrome.framework 0x000000010875aa67 0x106c49000 + 28383847

11 libsystem_pthread.dylib 0x00007fff667456c1 _pthread_body + 340

12 libsystem_pthread.dylib 0x00007fff6674556d _pthread_start + 377

13 libsystem_pthread.dylib 0x00007fff66744c5d thread_start + 13

Thread 7:: DnsConfigService

0 libsystem_kernel.dylib 0x00007fff6660c03a kevent + 10

1 com.google.Chrome.framework 0x000000010879b3d9 0x106c49000 + 28648409

2 com.google.Chrome.framework 0x0000000108798dfd 0x106c49000 + 28638717

3 com.google.Chrome.framework 0x000000010870cb0f 0x106c49000 + 28064527

4 com.google.Chrome.framework 0x000000010872fb53 0x106c49000 + 28207955

5 com.google.Chrome.framework 0x0000000108760629 0x106c49000 + 28407337

6 com.google.Chrome.framework 0x000000010875aa67 0x106c49000 + 28383847

7 libsystem_pthread.dylib 0x00007fff667456c1 _pthread_body + 340

8 libsystem_pthread.dylib 0x00007fff6674556d _pthread_start + 377

9 libsystem_pthread.dylib 0x00007fff66744c5d thread_start + 13

Thread 8:: CrShutdownDetector

0 libsystem_kernel.dylib 0x00007fff6660c592 read + 10

1 com.google.Chrome.framework 0x000000010799230f 0x106c49000 + 13931279

2 com.google.Chrome.framework 0x000000010875aa67 0x106c49000 + 28383847

3 libsystem_pthread.dylib 0x00007fff667456c1 _pthread_body + 340

4 libsystem_pthread.dylib 0x00007fff6674556d _pthread_start + 377

5 libsystem_pthread.dylib 0x00007fff66744c5d thread_start + 13

Thread 9:: WorkerPool/31747

0 libsystem_kernel.dylib 0x00007fff6660ae7e __psynch_cvwait + 10

1 libsystem_pthread.dylib 0x00007fff6674669b _pthread_cond_wait + 789

2 com.google.Chrome.framework 0x00000001087425ab 0x106c49000 + 28284331

3 com.google.Chrome.framework 0x0000000108762966 0x106c49000 + 28416358

4 com.google.Chrome.framework 0x0000000108762df8 0x106c49000 + 28417528

5 com.google.Chrome.framework 0x000000010875aa67 0x106c49000 + 28383847

6 libsystem_pthread.dylib 0x00007fff667456c1 _pthread_body + 340

7 libsystem_pthread.dylib 0x00007fff6674556d _pthread_start + 377

8 libsystem_pthread.dylib 0x00007fff66744c5d thread_start + 13

Thread 10:: WorkerPool/32003