Very ggod tip, thank you for this. One question, is this a system wide change, or user specific?

Thanks

Probably not the right place to post this, but...

When I right-click on StartupItems folder and choose Attach Folder Action, nothing happens. I have to go to the Folder Actions Setup app and click the "+" button to choose a folder to add an action to. MacOS 10.4.5

It can be applied to ANY folder you want to watch. The example is targetting the /Library/StartupItems folder, but you could just as easily attach it to ~/Library/StartupItems (if it exists).

If you want to protect against the recent trojan, also apply it to your ~/Library/InputManagers folder and /Library/InputManagers. If those folders don't exist, create them first.

FYI, the tilde "~" indicates your home folder in Unix speak, while paths starting with just a slash "/" are paths beginning from the root of your system.

Nice but there are more ways than that to make items start with start up.
You need also to monitor your ~/library/loginwindow.plist, and maybe
also /library/preferences/com.apple.loginwindow.plist
and the same file in the ~library/preferences.

HP sticks a start up item in one of those last 2, I've forgotten which, and
it took me a LONG time to find out where it was.

Quote

madgunde wrote:
It can be applied to ANY folder you want to watch.

Sorry, I'll be more specific...it was the action, not the folder I was asking about...if I put a watch on the /library/Input Managers folder, would this flag up a change to whoever was logged in (system wide), or do I have to login and configure the action for each user to get it to do that (user specific)?

Quote

Guest wrote:

Quote

madgunde wrote:
It can be applied to ANY folder you want to watch.

Sorry, I'll be more specific...it was the action, not the folder I was asking about...if I put a watch on the /library/Input Managers folder, would this flag up a change to whoever was logged in (system wide), or do I have to login and configure the action for each user to get it to do that (user specific)?

There is a startup items folder for each user, so you'd have to monitor each one.

Quote

gslusher wrote:

Quote

Guest wrote:

Quote

madgunde wrote:
It can be applied to ANY folder you want to watch.

Sorry, I'll be more specific...it was the action, not the folder I was asking about...if I put a watch on the /library/Input Managers folder, would this flag up a change to whoever was logged in (system wide), or do I have to login and configure the action for each user to get it to do that (user specific)?

There is a startup items folder for each user, so you'd have to monitor each one.

?

OK, I guess that could still be seen as ambiguous, so I'll try to be more specific...if I, logged in as me, put a watch on the [root] /library/Input Managers folder would this show an alert to whoever happened to be logged in at the time something changed in this folder, or would I need to get each of the users separately to put their own watch on this same folder?