Numerous Mac users are repeatedly encountering a bug in macOS Ventura that throws up Login Items notifications for various background app processes every.
https://www.macrumors.com/2023/02/02/macos-background-items-added-notification-bug/
Check notification previews (but this does not stop the above popup): System Settings -> Notifications -> Show Previews
Seems like you cannot disable “System Settings -> General -> Login Items“
In Finder app, select Go -> Go to Folder… from the menu bar
Put the following address into the input field and press Enter: ~/Library/LaunchAgents and then (on my Mac the next does not exist) ~/Library/LaunchDaemons
For details read the above MacRumors article.
Apps for monitoring and managing background apps, agents, etc. (LaunchDaemons, LaunchAgents, Startup items)
In Terminal app execute the following command to get list of all items:
sfltool dumpbtmBlockBlock MacOS app (free): https://objective-see.org/products/blockblock.html
Malware installs itself persistently to ensure it’s automatically (re)executed.
BlockBlock monitors common persistence locations and alerts whenever a persistent component is added.
KnockKnock MacOS app: https://objective-see.org/products/knockknock.html
KnockKnock uncovers persistently installed software in order to generically reveal such malware.
How to Remove LaunchDaemons and LaunchAgents
The public /Library/LaunchAgents and /Library/LaunchDaemons folders are vulnerable to both legitimate and illegitimate apps. A legitimate app might use them for marketing, while malicious apps can use them to steal data and infect your Mac.
For adware and malware to be successful, they must persist in every user session. To do this, malware and adware authors create malicious code and put it in the LaunchAgent or LaunchDaemon folder. Every time your Mac starts, launchd will ensure that the malicious code runs automatically. Thankfully, security apps can help protect against this.
Apple Support article on how to “Manage login items and background tasks”
https://support.apple.com/guide/deployment/manage-login-items-background-tasks-mac-depdca572563/web
In macOS 13, a new structure in the app bundle simplifies the installation of login items and associated property lists (by updating helper executables from earlier versions of macOS). This framework is used to create transparency to the user when you configure
LoginItems,LaunchAgents, andLaunchDaemonson a Mac. This framework uses theSMAppServiceobject to control helper executables that live inside an app’s main bundle. It can also be used to register and controlLoginItems,LaunchAgents, andLaunchDaemonsas helper executables for an app and it works with all types of apps, regardless of how they were installed.
Launch daemons, launch agents, and startup items are helper executables that macOS starts on behalf of the user that extend the capabilities of apps or provide additional capabilities to users. For example:
LaunchDaemoncan provide persistent background service for an appLaunchAgentcan provide auxiliary UI capabilities like menu bar extrasLoginItemcan provide the ability to automount remote directories or launch applications when the user logs in.
SMAppService (as of macOS 13)
https://developer.apple.com/documentation/servicemanagement/smappservice