Stopping LaunchAgents and Daemons

If you want to stop the item for this boot simply issue an unload command to launchd via launchctl. For a permanent fix add a disabled key into the plist with value true or delete/move the file to a folder where launchd will not scan it automatically.

  • launchctl unload /System/Library/LaunchAgents/com.apple.AppStoreUpdateAgent.plist

The man page for launchctl has nice documentation for controlling jobs. As for the general defeating of CS majors, you might also consider that they edited the existing apple plists to make them do something you don't expect, so it will prove to be far easier to just reinstall the OS and migrate the user data back from a backup (paying particular note to note re-install any plist files in the /System/Library, /Library space (and perhaps also audit the ~/Library of admin users). Losing admin / root against someone that knows how to change the system is basically game over and the defense (finding and disabling) the changes is very time consuming as opposed to offense (reinstalling the system from a known good source and use configuration management tools to ensure changed files are detected).


The easiest way I've found to do this is

sudo launchctl list | grep "rough name of what you want to find"
sudo launchctl remove "label.of.the.file"

Try checking these locations:

/Users/your username/Library/LaunchAgents/

/Library/LaunchAgents/

/Library/LaunchDaemons/

/System/Library/LaunchAgents/

/System/Library/LaunchDaemons/