How to figure out how a process auto started itself after login?
Solution 1:
This is not actually scary - it is intended, well defined and documented behavior.
Applications on macOS can come with a helper application that is run in the background. The helper app is stored within the application bundle of the main app and managed through the Service Management framework.
When you add an app to a macOS computer, the system will look into the application bundle to determine how this app relates to the system. In particular things such as:
- which types of files can this program open
- which icon should be displayed
- does this program require a background helper application
As you can install applications in any folder on a Mac, this detection and inspection happens everywhere. In particular, you do not have to install apps in the /Applications folder. It does not involve the system "searching the entire hard drive", as application bundles are already specially marked. When an application bundle is added to the file system (or moved around), the system knows about it and keeps note of the above mentioned information.
Registering helper applications by including them in the application bundle is actually the recommended method for apps that are sandboxed (i.e. for example coming from the Mac App Store), as these apps are not allowed themselves to create files outside the sandbox.
If the application does not itself include an option to disable the helper application, it is because the app developer has decided that their application cannot function with the helper. The correct way to uninstall the helper application is to uninstall the main app.
In order to manually inactivate the login item, the least "aggressive" method is to change the Info.plist file inside the application bundle. Using the Property List Editor find the key SMLoginItemSetEnabled and change the associated boolean value to false.
You could also be more aggressive and manually delete the contents of the <app>.bundle/Contents/Library/LoginItems folder.
In any case, you risk the app itself not working - and you will have to be wary of application updates that reverse this change.