Introduction⌗

I accidentally noticed a background service without an icon in the Login Items management section of System Settings, as shown below:

System Login Items

The TNT item in the image above is a rather strange background service item. After some searching, I discovered it’s an organization.

Cleanup⌗

The common directories for macOS service configuration files are as follows:

System Login Items⌗

  • /Library/LaunchAgents
  • ~/Library/LaunchAgents
  • /System/Library/LaunchAgents

Background Service Items⌗

  • /Library/LaunchDaemons: User background service items
  • /System/Library/LaunchDaemons: System background service items

After thorough inspection, I couldn’t find any TNT-related plist configuration files. Then I saw some people online mentioning SMAppService and sfltool.

sudo sfltool dumpbtm

========================
 Records for UID 501 : B19E0E71-C33B-4262-B5CF-2C377D61330A
========================

 ServiceManagement migrated: true
 SharedFileList migrated: true

 Items:

 #1:
                 UUID: A93EB8AA-E850-4397-BEED-1F211F58E2F9
                 Name: CleanMyMac X Menu
       Developer Name: TNT - why join the navy if you can be a pirate
                 Type: app (0x2)
          Disposition: [disabled, allowed, visible, not notified] (2)
           Identifier: identifier "com.macpaw.CleanMyMac4.Menu" and certificate root = H"ac9832a814595d054047a2768d0bc7ea87e8486f"
                  URL: file:///Applications/CleanMyMac%20X.app/Contents/Library/LoginItems/CleanMyMac%20X%20Menu.app/
           Generation: 0
    Bundle Identifier: com.macpaw.CleanMyMac4.Menu

 #2:
                 UUID: F965419E-CC17-4EEA-8C4B-5994E20AC5BF
                 Name: CleanMyMac X HealthMonitor
       Developer Name: TNT - why join the navy if you can be a pirate
                 Type: login item (0x4)
          Disposition: [enabled, disallowed, visible, notified] (9)
           Identifier: identifier "com.macpaw.CleanMyMac4.HealthMonitor" and certificate root = H"ac9832a814595d054047a2768d0bc7ea87e8486f"
                  URL: Contents/Library/LoginItems/CleanMyMac%20X%20HealthMonitor.app
           Generation: 6
    Bundle Identifier: com.macpaw.CleanMyMac4.HealthMonitor
    Parent Identifier: identifier "com.macpaw.CleanMyMac4.Menu" and certificate root = H"ac9832a814595d054047a2768d0bc7ea87e8486f"
 #4:
                 UUID: 0BEF0D2C-623C-4D56-B50F-E7DB6498C24F
                 Name: Microsoft AutoUpdate
       Developer Name: Microsoft AutoUpdate
      Team Identifier: UBF8T346G9
                 Type: curated legacy agent (0x90008)
          Disposition: [enabled, allowed, visible, notified] (11)
           Identifier: com.microsoft.update.agent
                  URL: file:///Library/LaunchAgents/com.microsoft.update.agent.plist
      Executable Path: /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant
           Generation: 1
    Assoc. Bundle IDs: [com.microsoft.autoupdate2 ]
    Parent Identifier: Microsoft AutoUpdate

This command outputs registration information related to system login items and background services, allowing you to find the corresponding plist files and delete them!

I hope this is helpful, Happy hacking…