How to find and remove a LaunchAgent which has no .plist

My macOS (v11.2.1) has a number of undesirable LaunchAgents loading with the system, which bloat it. Some of them I was able to successfully remove (just by finding their .plist.) However, for some others I can't simply identify how they're loading during boot, because they have no identifiable .plist.

This post will specifically target VoxAgent (launched by the Vox music player, www.vox.rocks), but this annoyance also happens with other apps too (CleanMyMac X, Hazel...)

I'm able to terminate the service using launchctl remove com.coppertino.VOXAgent, but every time the system boots the service is launched again (even if I don't launch Vox player). What I really want is get rid of such LaunchAgent once and for all, and that's why I need your kind help.

After a fresh reboot, these are the steps I took so far:

(1)

I ran launchctl list on Terminal, which output was:

PID Status  Label
855 0   com.coppertino.VOXAgent

(2)

I checked the following folders for the presence of any .plist:

~/Library/LaunchAgents
/Library/LaunchAgents
/Library/LaunchDaemons
/System/Library/LaunchAgents
/System/Library/LaunchDaemons

No .plist related to com.coppertino.VOXAgent was found there.

(3)

On Terminal I ran launchctl blame gui/$(id-u)/com.coppertino.VOXAgent, which returned:
semaphore

(4)

On Terminal I ran launchctl dumpstate | grep -A4 " = {" | grep -B 3 -A 3 -E "active count = [1-9]" which returned (showing only the contents related to VoxAgent):

com.apple.xpc.launchd.domain.pid.om.coppertino.VOXAgent.640 = {
    type = process
    handle = 640
    active count = 33
    on-demand count = 1
--
    security context = {
--

and

com.coppertino.VOXAgent = {
    active count = 4
    copy count = 0
    one shot = 0
    path = (submitted by otherbsd.426)
--
--
        runatload = 0
--

(5)

When trying to uninstall Vox using AppCleaner, here's a snapshot of the list of the files associated with this software:

https://i.stack.imgur.com/dxPeT.png


So, what I find surprising is that VoxAgent, as well as some other pesky unidentifiable LaunchAgents (CleanMyMacX, Hazel...), doesn't show the real path to the .plist, but only path = (submitted by otherbsd.426). And this is why I'm having such a hard time to prevent this VoxAgent to load with macOS.

Other infos that might be helpful (output from Terminal):

id
uid=501(a) gid=20(staff) groups=20(staff),12(everyone),61(localaccounts),79(_appserverusr),80(admin),81(_appserveradm),98(_lpadmin),703(com.apple.sharepoint.group.3),702(com.apple.sharepoint.group.2),33(_appstore),100(_lpoperator),204(_developer),250(_analyticsusers),395(com.apple.access_ftp),398(com.apple.access_screensharing),399(com.apple.access_ssh),400(com.apple.access_remote_ae),704(com.apple.sharepoint.group.4),701(com.apple.sharepoint.group.1)
launchctl version                                                                                                           
Darwin Bootstrapper Version 7.0.0: Mon Dec 21 20:06:28 PST 2020; root:libxpc_executables-2038.80.3~7/launchd/RELEASE_X86_64

In addition to the steps above, I have already checked the 'Users & Groups > Login Items' as well as 'Extensions' in the System Preferences. Nothing there either which might invoke VoxAgent.

I'm sure there are lots of other people out there having the same trouble. I reviewed many posts here in StackOverflow, but could not find a solution yet.

Thank you in advance for any tips!


Solution 1:

I also have the same problem in another app. These are what I found:

Secret way to launch Agent in Mac? - Apple Community

Adding Login Items - Apple Developer Archive

According to the above, there are two ways to add a login item: using the Service Management framework, and using a shared file list. The login items added using Service Management framework can only be deleted by the application itself.

I also want to know if there is a way to disable them because they are so annoying. If there is a way, please also let me know.

At the moment, I am using another startup script to kill the startup items. This can solve the problem, but I don't think it's a good idea.