Sometimes when you notice your Mac is acting funky you may look in Console or Activity Monitor, and notice traces of applications running in the background that you thought were long since dead. You may then go to the obvious place where startup items are added: System Preferences > Users > Your User > Login Items, and you discover that they aren't there.
This is a little guide to help you find what is making those processes run and kill them.
First, for those of you who may not be as familiar with Mac/Unix conventions, I'll explain how I'll be referring to these. I'll give you file paths in the format of either ~/path/to/folder or /path/to/folder. If the ~ is in front, that means this is in your user folder (the one that shows up with a little house in the Finder sidebar) and if it doesn't have a ~ in front than the path starts from the root level of your hard drive. So, for example, there is a ~/Library folder, which is the Library folder in your User folder, and there is a /Library folder, which is the system level Library folder. There's even a /System/Library folder, which is the really low-level system Library.
First, it may be helpful to know where the items in that System Preferences panel are stored: ~/Library/Preferences/loginwindow.plist. Deleting this won't usually get you anywhere, as anything in there can just be removed from System Preferences.
The first “hidden” place to look is in ~/Library/LaunchAgents. While writing this tutorial, I found a couple of things in there that were ancient that I didn't want any more. You can just delete any items you don't want running (although use discretion, as you don't want to break anything). These are all in the format of com.apple.somethingorother, where the first two parts correspond to the domain name of the company that wrote the program, generally. So you can use this as a guide: if it starts with com.apple, you probably don't want to delete it. Also, if you have Adobe software installed, and see anything that starts with com.adobe, you probably don't want to delete that either. You get the idea.
The second “hidden” place to look is in /Library/LaunchAgents (see a pattern here?). These follow the same basic pattern as the one in the user folder, but are going to run in any user account on the computer. In fact, some things that you don't want running system wide can safely be moved from here to your user folder. If you have any input managers running that rely on SIMBL, you'll see something here for SIMBL. If you've installed any in the past but no longer use them, you will see the SIMBL agent and can delete it. I installed glims recently, which uses SIMBL and has its own file in this folder. Since I don't want glims running in all user accounts, I can move the launch agent to the ~/Library/LaunchAgents folder instead. This will require at the very least a logout and login to run it from the new location, and that assumes that Glims won't try to put itself back.
The third place is /Library/LaunchDaemons. These are very similar to the ones above, but I wouldn't recommend deleting any of them. Basically the difference is that items in LaunchDaemons are system wide (which may mean they run even if no user is logged in) and the items in LaunchAgents are user related (like glims will only run if a user is logged in, but in the default location it will run if any user is logged in).
The fourth place is /Library/StartupItems. Not as many programs use this, but some do. I just deleted a VirtualBox item from here, because I hadn't used it since the day I installed it.
If these locations don't solve your problems, you can get into the dangerous ones: /System/Library/LaunchAgents, /System/Library/LaunchDaemons, and /System/Library/StartupItems
These are ones that third party apps aren't supposed to use, so if you look at them you'll notice everything in there is likely to start with com.apple or be related to underlying Unix apps. You most likely don't want to mess with anything in these folders, but if you do see something that shouldn't be there and it corresponds to a process that is running that shouldn't be, then kill it.
March 9, 2011