January 22

I have a .dmg that, without my wanting it to, mounts whenever I restart. Finder→Get Info doesn't show a checkbox like "always mount me". What's going on? Can I do anything to stop it, other than deleting the file? (I don't mind deleting it, it's nothing I care about, but I want to know.) —Tamfang (talk) 08:31, 22 January 2019 (UTC)[reply]

There are a handful of other ways that a disk image can automatically mount at boot: have you ever accidentally configured an autofs or automountfs file? (Check for the existence of an autofs configuration file in the special system folder /etc/ ). Or, is there an entry for this .dmg file in /etc/fstab ? Or, have you ever configured a "login item"? In the user interface for System Preferences, check the User Accounts panel, sub-section "login items", and see if any script is configured to run at login time.

If nothing turns up, there are a handful (!) of other more obscure ways such automatic file system behaviors can be configured, and we can probably start eliminating them in order of likelihood.

Some of these behaviors are benign and are intended to be a convenience for the user; but it's unfortunately a poorly-documented part of the installation process. In particular, some developer tools (like brew) set up such automatic behaviors on purpose. If you let us know what the disk image is, it might hint at how we can get rid of it.

Nimur (talk) 16:58, 22 January 2019 (UTC)[reply]

Thanks for responding. It's from foobar2000. No, there's nothing in /etc/fstab* or /etc/autofs*; and I wouldn't have used something like brew when the app itself is on the dmg. —Tamfang (talk) 17:35, 22 January 2019 (UTC)[reply]

You may be able to use the command line command lsof to list open files, put the output through a grep to find the mounted item. there are likely more than 1000 open files. When you find the process, that is using this (perhaps just cd'd to it) you can figure out what to change for that process. Graeme Bartlett (talk) 03:12, 23 January 2019 (UTC)[reply]

lsof shows:

   COMMAND    PID  USER   FD      TYPE             DEVICE    SIZE/OFF        NODE NAME
   diskimage  621 anton    3r      REG                1,4     3860640 12887088828 /Users/anton/Downloads/dmg/foobar2000-v2.1.21.dmg

Now I do have "restore windows on restart" (or whatever it's called) turned on, but that shouldn't cause diskimage to restore the dmg after I've ejected it, one would think. —Tamfang (talk) 22:54, 23 January 2019 (UTC)[reply]

This persons seemed to have a possibly similar problem [1]. No solutions there, and you already checked LoginItems (and I assume that mentioned here is the same [2], but did you check the various /StartupItems? Also macjack probably has a point that you may be able to work out from the console log what's going on. I also wonder if [3] and [4] may be related. Incidentally, I assume there's no chance you ran malware and not the proper Foobar [5]? Nil Einne (talk) 07:49, 24 January 2019 (UTC)[reply]

Another possibility is a launch job, which would be evidenced by a .plist file in one of the locations: /System/Library/LaunchDaemons or /System/Library/LaunchAgents, or in the user home directory.

Yet another possibility is a shell profile (e.g. in ~/.bash_profile) that loads the disk image at shell login.

As soon as I get a clean and disposable Macintosh instance, I'll try to reproduce this bug and see if I can find out what's really going on here. If it's truly problematic, I'll even squawk a bug report at the Foobar2000 developers. There are dozens of other esoteric places this type of behavior can hide... and if this software is hiding its behaviors in an "unapproved" macOS fashion, that in itself constitutes malware and needs to be removed or corrected - even if it causes no other harm at all.

Nimur (talk) 17:00, 24 January 2019 (UTC)[reply]

I can not reproduce the problem on macOS Mojave after downloading and running foobar2000-v2.1.27 from foobar.org/mac.

Do you recall any other installation operation or configuration you may have performed?

Nimur (talk) 19:08, 24 January 2019 (UTC)[reply]

Fixed links/closing above. Nil Einne (talk) 00:08, 26 January 2019 (UTC)[reply]