#22876 Fwd: Proper names showing up in login items

Created from Lead: https://artichoke.shield.syncromsp.com/leads/17805280/convert

Hi Peet, do you have any insight on this? I don't recognize those items.

Thanks,
~jb

---------- Forwarded message ---------
From: Lou Ghaddar<[email protected]>
Date: Mon, Feb 27, 2023 at 4:47 PM
Subject: Proper names showing up in login items
To: John Belobraidic <[email protected]>

Hey JB,

I am troubleshooting why my computer is having issues building the EYF apps locally. It looks like it has something to do with Bootstrap launch items. So I was looking at my launch items to try and figure this out, but I noticed there are three Proper names in my login items. Are these supposed to be there?

[embedded image][embedded image][embedded image]

*	LouGhaddar
P A R T N E R S C R E A T I V E
603 Woody Street
Missoula, Montana 59802
406 541 2263
[partnerscreative.com](http://partnerscreative.com/)

--

*	JohnBelobraidic
P A R T N E R S C R E A T I V E
603 Woody Street
Missoula, Montana 59802
406 541 2263
[partnerscreative.com](http://partnerscreative.com/)

Those are the names of the Developer accounts (personal not business) that have been used to sign items that are called by LaunchAgents, LaunchDaemons. Lou's software stack is unique and uses many apps that I don't manage. Since Apple will only reveal (with they info icon) unsigned startup items via the Login Items System Settings, your best bet is to research the developers to se who's writing or at least signing tools for your machine.

A quick Google reveals that Charles Srstka is the developer of Pacifist (good product, but since Suspicious Package is free, I've stopped using it). Vitaliy Golubenko makes Syncmate and perhaps other apps.

When PAR-2020-LG is online again I'll drop an app on it to pull a report that includes all launchd scripts and the signatures (if available) of the binaries that are called.

Peet

Nicholas Sherlock:

[Not Loaded] com.wacom.wacomtablet.plist (Nicholas Sherlock - installed 2020-04-24)

Charles Srstka:

Launchd: /Library/LaunchDaemons/com.charlessoft.pacifist.helper.plist

Launchd: /Library/LaunchDaemons/com.charlessoft.pacifist.helper.plist (Charles Srstka)

Executable: /Library/PrivilegedHelperTools/com.charlessoft.pacifist.helper

Vitaliy Golubenko:

/Library/LaunchDaemons/com.eltima.ElmediaPlayer.daemon.plist

opens /Library/Application Support/ElmediaPlayer/empdaemon which is signed by Vitaliy Golubenko

Thanks Peet! All of those look pretty legit. Thanks for easing my fears.

Lou

--
Lou Ghaddar

On March 1, 2023 at 10:05:08 AM, Artichoke Support - Peet ([email protected]) wrote:

-----

Most anything that's signed is *probably* okay.

Cheers.peet