Mac newbie question: Background system processes?

I use the latest BitTorrent client software to grab the current Doctor Who episodes. Depending on where I happen to be that Saturday, I do it either on a PC or on a Mac.

I noticed on the PC that it installed a secondary product called "DNA" which is a new feature, a background streaming server based on BitTorrent technology. This is a separate feature from BitTorrent, and is unrelated to the file sharing aspects of BitTorrent. Unlike BitTorrent itself, DNA runs without my knowledge and without an icon to indicate its presence. This made me angry, so I googled around and found out how to remove it. (btdna.exe /uninstall)

Even if it hadn't had the convenient uninstall command line built in, there are a few different ways on the PC that I can detect the presence of such a thing and prevent it from running. Being a long-time PC user, I know most of these methods.

But when it comes to similar sleuthing on the Mac, I've got no idea where to start. I'm assuming, since I installed the same BitTorrent version on the Mac as I did on the PC, the Mac version must also include this background streaming service. How do I find it and exterminate it?

I asked this question a few days ago on the BitTorrent forums, hoping to get an answer that was specific to BitTorrent. But I've had no responses, and now I'm curious about the generic case. In the generic sense (i.e., for any process, not just DNA), what are the steps to determine what's running in the background, and how would you remove such a background service, on the Mac?

PS: Please, no discussions about which BitTorrent client I *should* be using instead of the one I am using. We can do that in another thread if you want.

List all the running processes:



Find the naughty process id then:



To kill it off.

Though of course you'll need to do more than that to stop the process getting run again in the future.

Yes, but that's probably a considerably longer reply. I'd be interested to see if there was anything running in the first place.

What Andy said... But from a GUI, you can run Activity Monitor. From there you can also quit or force quit processes and applications.

The most obvious places to look for evidence of such a process launching at startup is in the various locations used to store your list of start items.

The first place is Login Items:
System Preferences -> Accounts -> Your User Account -> Login Items tab

Items listed in there get launched when your user account gets logged in. Remove an item to stop it from being launched. Note that some programs also have preferences to control this, so you might want to look at the prefs for your BT client. That will also make sure the login item doesn't get auto-repaired the next time you launch the BT client.

You can also look in:
/Library/Preferences/com.apple.loginitems.plist

That's where some items that get launched for ALL users get launched at login. The file is best viewed with Property List Editor which is part of the developer tools install.

From there you can read about launchd which is now beyond the scope of my quick reply.

http://developer.apple.com/macosx/launchd.html

Bruno

I always have Activity Monitor running on every PC (pet peeve, PC is a personal computer, not Windows) machine running OS X that I use. One handy thing with it is to set the dock icon to show CPU History (under the view menu). This lets me keep an eye on the processor usage without needing something like iStat Menus.

Pet peeve: redundant noun phrases:

"I always have Activity Monitor running on every personal computer machine running OS X that I use."

Tom might have just accidentally inserted the brace one word too early. Maybe he meant "Windows machine)"

Agreed, but it's common usage to say "Mac" or "PC" to distinguish between the two platforms, the terms are even used that way in Apple's own TV ads, so you can't really fault me there.

Back to topic: Thanks very much, everyone, for the detailed and useful answers. I'll give that stuff a shot when I get back home to the Mac this evening.

Fair enough. It's what I get for going back and rewording that sentence.


The ads annoy me just as much for the same reason. Just like someone asking "So is that an iPod for the car" when talking about the empeg :-)

Historially yes, but the meanings of many words adapt over time.

Much like "Pop Music" (aka. Popular Music) now generally defines a particular genre of music, rather than something just being "popular".

Mac & PC? I consider them to be different even though I'm more than aware of the underlying meaning.

I do, however usually use the word "Wintel" to avoid any ambiguity!

Okay, the results of ps -A shows nothing in the process list that remotely resembles the BTDNA process. So I guess it wasn't installed on the Mac version after all.

Thanks for your help, everyone!

Yes, that is the original definition. But the common substitution of simply saying "PC" instead of "PC running a Microsoft OS" began when IBM named their first PC (in the original sense) the "IBM PC". IBM PC compatible machines were called "PC clones", and later also simply "PCs". Subsequently, any machine running a Microsoft OS from DOS through all the various versions of Windows has been identified as a "PC".
It's somewhat analogous to why we often call the U.S.A. "America". Because although there are many other nations in North, Central and South America; none of them has the actual word "America" in their names.

Wait. The Mac OS is all about least-privilege these days. Do I need to execute some kind of an elevation command, prior to the ps -A command, so that it will show all processes for all users and system items?

Looking at the man page:



You should be good.

Awesome, thanks!

Also, Activity Monitor, when set to "All Processes" does the same thing as ps -A.

Pretty much no harm in letting users see what the machine is running, unless someone is putting their password as a command line argument into a program that doesn't mask that out of the process listing.

Never did understand Microsoft's decision to force an elevation to see all processes in Vista. The 30+ years of UNIX users being able to see everything hasn't been a problem.

Perhaps to keep malware from searching for and then doing naughty things to other processes? I dunno how that stuff works.

Which it would need elevated privileges to do, which, if it has them, you're already screwed.

More likely so corporate spyware can remain hidden.

Ah. Good point.

What about someone who'd prefer that his wife and kids don't see that he's running MonkeyPr0nDownloader.exe in his account?

What kind of self-respecting, porn-downloading man doesn't have his own personal computer, off-limits to the wife, and should you have them, kids? Besides, if you can't share your porn with your wife and kids, you've got one messed up family.

Agree with Bruno - wives and kids should have accounts in VMs, so they can't break anything:-)

Well, it was a hypothetical, but the wife has her own non-admin account, so she can't break anything except her own account; and Charlie's motor skills aren't up to using a computer yet (he's only 7 weeks old, give him time).

"Give him time"? What kind of parents are you? You are not doing him any favours by being touchy-feely at the wrong time. Don't you realize that kids need to be given crucial life skills early enough to stay competitive in tomorrow's global workspace and knowledge economy?