Seeing which processes are running
- From the Terminal, using
- Run Applications » Utilities » Activity Monitor and select All Processes. You can also exit them from there.
Automatically starting processes
- Those that are selected to Open at Login in the Dock
- Those in System Preferences » Accounts » Login Items (actually, these include the ones from 1.)
- The login hook for
loginwindow described here, read current value with
defaults read com.apple.loginwindow LoginHook
- Some of those specified as part of a
launchd script (or otherwise managed by
launchd). List all with
sudo launchctl list. See
man launchctl for details.
launchd lists, you can see their definition files in the
LaunchDaemons subdirectories of your system's
/System/Library (you probably shouldn't touch these)
/Library/ (usually for all users)
/Users/yourname/Library (your own programs)
In the latter two libraries, check for anything suspicious. It's usually XML, so you can open and read them.
The problem here is, that you can run a single process that launches tons of others upon a certain condition, e.g.
cron on OS X exists but is deactivated by default. Specify
@reboot for a job, and it will be launched by
cron upon system start.
Something similar applies to your shell configuration files
.bash_profile etc., that can launch processes in the background as soon as you open Terminal.