Secret way to launch Agent in Mac?

Question

Level 1

47 points

Secret way to launch Agent in Mac?

This VOX player has it's continuously running VOX Agent. It is running under the user, and is protected, so it reboots immediately after killed.

Problem is that VOX Agent doesn't appear to have any plist in usual Launch Agents or Launch Demons locations. Not in the user, not in the system directories.

"Launchctl list" shows this process (com.coppertino.VOXAgent).

"Launchctl remove" kills the agent and it does not reboot, but after restart it comes back again.

Question: are there any secret launch locations in Mac OS, except:

~/Library/LaunchAgents

/Library/LaunchAgents/

/Library/LaunchDaemons

/Library/StartupItems

/System/Library/LaunchAgents/

/System/Library/LaunchDaemons

Thanks.

MacBook Pro with Retina display, macOS High Sierra (10.13), null

Posted on May 17, 2018 12:27 AM

Reply

Answer 1

Best reply

etresoft

Level 8

46,200 points

May 17, 2018 4:52 AM in response to ron App

Hello ron App,

According to this recent EtreCheck report: Kernel Panic, cannot locate the problem

Vox player is using a Service Management Login Item. This is essentially a modern launch agent. There is no way to control or unload it outside of the owning app itself. You would have to delete the entire app.

Reply