I believe that I have a keylogger or some sort of spyware installed on my mac, please help!

I would say deleting the .plist file to at least prevent the agent from running but I suspect it will recreate it. I don't have experience with Keylogging software on Mac but on Windows they can be extremely hard to remove.

Since you are a regular user and not very technically savvy, I would recommend backing up your photos, videos, documents and other things you require and then wiping the disk clean and reinstalling OS X.

You don't know what other malicious software is installed on this machine. Better have a clean one.

Important Edit: As Linc says, Lawyer up!

Most important edit: I hope you're not doing all of this typing on the same machine.

Yeah, as usual these things can be used for good or bad.

Parents, Security sensitive corporate environments, Gov agencies, Law enforcement...

If the guy is caught he's gonna be in loads of trouble. He probably bought this on Credit Card so should be pretty **** easy to trace back.

Linc offered some good advice - I would call the police immediately. They should be able to make a case against the jerk. I'd go to the police first -- even before contacting a lawyer.

Clinton

That should be determined by a qualified forensic investigator, not by random strangers on a public message board. This is a serious matter.

I don't know how to determine who installed the spyware.

I am having a similar problem. All of the devices in my life have been attacked. passwrods all stolen, accounts impersonated etc.

I used the directed code below (mentioned above) and have been given error messages:

sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix)|edu\.mit|org\.(amavis|apache|cups|isc|ntp|postfi x|x)/{print $3}'

WARNING: Improper use of the sudo command could lead to data loss

or the deletion of important system files. Please double-check your

typing when using sudo. Type "man sudo" for more information.

entire machine has been wiped- three times- and still having issues. post is on the imac forum.

I went through the steps. What should I be looking for after each step?

I don't want to bother you but I think I have the same problem. Would you check the output of the procedure you suggested?

I have followed the steps Linc posted for detecting keylogger spyware on my Mac. Here are the responses I receive from each step. Could you please tell me if I have any keylogger ware on my Mac?

Step 1:

kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}'

Response:

com.markspace.driver.RemoteNDIS (438)

Step 2:

sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix)|edu\.mit|org\.(amavis|apache|cups|isc|ntp|postfi x|x)/{print $3}'

Response:

org.samba.smbd

org.samba.nmbd

com.sierrawireless.SierraReset.plist

Step 3:

launchctl list | sed 1d | awk '!/0x|com\.apple|edu\.mit|org\.(x|openbsd)/{print $3}'

Response:

com.hp.launchurlagent

Step 4:

ls -1A /e*/mach* {,/}L*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/Bu,P*P,Priv,Qu,Scripti,Servi,Spo,Sta} * L*/Fonts 2> /dev/null

Response:

Library/Address Book Plug-Ins:

1. SkypeABDialer.bundle
2. SkypeABSMS.bundle

/Library/Components:

/Library/Frameworks:

.DS_Store

Adobe AIR.framework

1. HPDeviceModel.framework
2. HPPml.framework
3. HPServicesInterface.framework
4. HPSmartPrint.framework
5. HPSmartX.framework
6. MacFUSE.framework
7. MissingSyncWM.framework
8. MissingSyncWMShared.framework
9. Snapfish.framework

/Library/Input Methods:

/Library/Internet Plug-Ins:

AmazonMP3DownloaderPlugin.plugin

Flash Player.plugin

JavaPluginCocoa.bundle

NP-PPC-Dir-Shockwave

OfficeLiveBrowserPlugin.plugin

Quartz Composer.webplugin

QuickTime Plugin.plugin

QuickTime Plugin.webplugin

VerifiedDownloadPlugin.plugin

1. ebldetect.bundle
2. flashplayer.xpt
3. iPhotoPhotocast.plugin
4. nsIQTScriptablePlugin.xpt

/Library/Keyboard Layouts:

/Library/LaunchAgents:

1. com.hp.launchurlagent.plist
2. com.sony.ReaderLibrary.RunReaderLibrary.plist

/Library/LaunchDaemons:

1. com.sierrawireless.SWoCTool.plist
2. com.sierrawireless.SierraReset.plist

/Library/PreferencePanes:

Flash Player.prefPane

/Library/QuickLook:

1. GBQLGenerator.qlgenerator
2. iWork.qlgenerator

/Library/QuickTime:

AppleIntermediateCodec.component

AppleMPEG2Codec.component

/Library/Spotlight:

1. AppleWorks.mdimporter
2. GBSpotlightImporter.mdimporter

Microsoft Office.mdimporter

1. iWeb.mdimporter
2. iWork.mdimporter

/Library/StartupItems:

HP IO

HP Trap Monitor

MissingSyncListener

/etc/mach_init.d:

dashboardadvisoryd.plist

/etc/mach_init_per_login_session.d:

/etc/mach_init_per_user.d:

Library/Address Book Plug-Ins:

Library/Fonts:

Library/Input Methods:

.localized

Library/Internet Plug-Ins:

.DS_Store

BrowserPlus_2.9.8.plugin

KickStartPlugIn64.plugin

fbplugin_1_0_1.plugin

fbplugin_1_0_3.plugin

Library/Keyboard Layouts:

Library/LaunchAgents:

Library/PreferencePanes:

BrowserPlusPrefs.prefPane

Step 5:

osascript -e 'tell application "System Events" to get name of every login item' 2> /dev/null

Response:

iTunesHelper, AirPort Base Station Agent, Reader Library Launcher

Dear Linc:

Can you please let me know if you think I have a keylogger or spyware on my mac? I followed your steps but I am not sure how to interpret the results.

Actually, the first time I ran the steps i followed them too literally and after my password did not work I "skipped the next step," which I took to mean Step 3, and pasted the code for Step 4 and then thought better of it, closed the terminal, re-read your steps, re-opened the terminal, and did it right the second time, but I hope I did not screw it up in doing so.

Thank you in advance for your help, and thank you for the steps in the first place!

Lisa

Last login: Fri Jan 11 21:34:04 on console

L1:~ myname$ kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}'

L1:~ myname$ sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix)|edu\.mit|org\.(amavis|apache|cups|isc|ntp|postfi x|x)/{print $3}'

WARNING: Improper use of the sudo command could lead to data loss

or the deletion of important system files. Please double-check your

typing when using sudo. Type "man sudo" for more information.

To proceed, enter your password, or type Ctrl-C to abort.

Password:

Sorry, try again.

Password:

Sorry, try again.

Password:

Sorry, try again.

sudo: 3 incorrect password attempts

L1:~ myname$ ls -1A /e*/mach* {,/}L*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/Bu,P*P,Priv,Qu,Scripti,Servi,Spo,Sta} * L*/Fonts 2> /dev/null

/Library/Components:

/Library/Extensions:

/Library/Frameworks:

AEProfiling.framework

AERegistration.framework

Adobe AIR.framework

AudioMixEngine.framework

NyxAudioAnalysis.framework

PluginManager.framework

TSLicense.framework

iTunesLibrary.framework

/Library/Input Methods:

/Library/Internet Plug-Ins:

AdobePDFViewer.plugin

AdobePDFViewerNPAPI.plugin

Flash Player.plugin

Flip4Mac WMV Plugin.plugin

JavaAppletPlugin.plugin

Quartz Composer.webplugin

QuickTime Plugin.plugin

SharePointBrowserPlugin.plugin

SharePointWebKitPlugin.webplugin

Silverlight.plugin

flashplayer.xpt

googletalkbrowserplugin.plugin

npgtpo3dautoplugin.plugin

nsIQTScriptablePlugin.xpt

/Library/Keyboard Layouts:

/Library/LaunchAgents:

com.adobe.AAM.Updater-1.0.plist

com.google.keystone.agent.plist

/Library/LaunchDaemons:

com.adobe.SwitchBoard.plist

com.adobe.fpsaud.plist

com.apple.remotepairtool.plist

com.google.keystone.daemon.plist

com.microsoft.office.licensing.helper.plist

/Library/PreferencePanes:

Flash Player.prefPane

Flip4Mac WMV.prefPane

/Library/PrivilegedHelperTools:

com.microsoft.office.licensing.helper

/Library/QuickLook:

iWork.qlgenerator

/Library/QuickTime:

AppleIntermediateCodec.component

AppleMPEG2Codec.component

Flip4Mac WMV Advanced.component

Flip4Mac WMV Export.component

Flip4Mac WMV Import.component

/Library/ScriptingAdditions:

/Library/Spotlight:

Microsoft Office.mdimporter

iWork.mdimporter

/Library/StartupItems:

/etc/mach_init.d:

/etc/mach_init_per_login_session.d:

/etc/mach_init_per_user.d:

com.adobe.SwitchBoard.monitor.plist

Library/Address Book Plug-Ins:

SkypeABDialer.bundle

SkypeABSMS.bundle

Library/Fonts:

Library/Input Methods:

.localized

Library/Internet Plug-Ins:

Library/Keyboard Layouts:

Library/LaunchAgents:

com.adobe.ARM.202f4087f2bbde52e3ac2df389f53a4f123223c9cc56a8fd83a6f7ae.plist

com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.D426CCF7-7BE4-4E03-8A20-5CC 59986AF40.plist

Library/Mail/Bundles:

SpamSieve.mailbundle

Library/PreferencePanes:

L1:~ myname$

Last login: Fri Jan 11 22:04:25 on ttys000

L1:~ myname$ kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}'

L1:~ myname$

L1:~ myname$ kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}'

L1:~ myname$

L1:~ myname$ sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix)|edu\.mit|org\.(amavis|apache|cups|isc|ntp|postfi x|x)/{print $3}'

WARNING: Improper use of the sudo command could lead to data loss

or the deletion of important system files. Please double-check your

typing when using sudo. Type "man sudo" for more information.

To proceed, enter your password, or type Ctrl-C to abort.

Password:

com.microsoft.office.licensing.helper

com.google.keystone.daemon

com.adobe.SwitchBoard

com.adobe.fpsaud

L1:~ myname$ launchctl list | sed 1d | awk '!/0x|com\.apple|edu\.mit|org\.(x|openbsd)/{print $3}'

com.google.keystone.system.agent

com.adobe.ARM.202f4087f2bbde52e3ac2df389f53a4f123223c9cc56a8fd83a6f7ae

L1:~ myname$ ls -1A /e*/mach* {,/}L*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/Bu,P*P,Priv,Qu,Scripti,Servi,Spo,Sta} * L*/Fonts 2> /dev/null

/Library/Components:

/Library/Extensions:

/Library/Frameworks:

AEProfiling.framework

AERegistration.framework

Adobe AIR.framework

AudioMixEngine.framework

NyxAudioAnalysis.framework

PluginManager.framework

TSLicense.framework

iTunesLibrary.framework

/Library/Input Methods:

/Library/Internet Plug-Ins:

AdobePDFViewer.plugin

AdobePDFViewerNPAPI.plugin

Flash Player.plugin

Flip4Mac WMV Plugin.plugin

JavaAppletPlugin.plugin

Quartz Composer.webplugin

QuickTime Plugin.plugin

SharePointBrowserPlugin.plugin

SharePointWebKitPlugin.webplugin

Silverlight.plugin

flashplayer.xpt

googletalkbrowserplugin.plugin

npgtpo3dautoplugin.plugin

nsIQTScriptablePlugin.xpt

/Library/Keyboard Layouts:

/Library/LaunchAgents:

com.adobe.AAM.Updater-1.0.plist

com.google.keystone.agent.plist

/Library/LaunchDaemons:

com.adobe.SwitchBoard.plist

com.adobe.fpsaud.plist

com.apple.remotepairtool.plist

com.google.keystone.daemon.plist

com.microsoft.office.licensing.helper.plist

/Library/PreferencePanes:

Flash Player.prefPane

Flip4Mac WMV.prefPane

/Library/PrivilegedHelperTools:

com.microsoft.office.licensing.helper

/Library/QuickLook:

iWork.qlgenerator

/Library/QuickTime:

AppleIntermediateCodec.component

AppleMPEG2Codec.component

Flip4Mac WMV Advanced.component

Flip4Mac WMV Export.component

Flip4Mac WMV Import.component

/Library/ScriptingAdditions:

/Library/Spotlight:

Microsoft Office.mdimporter

iWork.mdimporter

/Library/StartupItems:

/etc/mach_init.d:

/etc/mach_init_per_login_session.d:

/etc/mach_init_per_user.d:

com.adobe.SwitchBoard.monitor.plist

Library/Address Book Plug-Ins:

SkypeABDialer.bundle

SkypeABSMS.bundle

Library/Fonts:

Library/Input Methods:

.localized

Library/Internet Plug-Ins:

Library/Keyboard Layouts:

Library/LaunchAgents:

com.adobe.ARM.202f4087f2bbde52e3ac2df389f53a4f123223c9cc56a8fd83a6f7ae.plist

com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.D426CCF7-7BE4-4E03-8A20-5CC 59986AF40.plist

Library/Mail/Bundles:

SpamSieve.mailbundle

Library/PreferencePanes:

L1:~ myname$ osascript -e 'tell application "System Events" to get name of every login item' 2> /dev/null

iTunesHelper, AdobeResourceSynchronizer

L1:~ myname$

Linc,

I need a hand too bud! My ex is "monitoring" me some how. I have done a seven pass zero, and a single pass zero before I ran this. Somehow she is still seeing me.

This was after step 4

Step 4

/Library/Components:

/Library/Extensions:

/Library/Frameworks:

AEProfiling.framework

AERegistration.framework

AudioMixEngine.framework

NyxAudioAnalysis.framework

PluginManager.framework

iTunesLibrary.framework

/Library/Input Methods:

/Library/Internet Plug-Ins:

JavaAppletPlugin.plugin

Quartz Composer.webplugin

QuickTime Plugin.plugin

nsIQTScriptablePlugin.xpt

/Library/Keyboard Layouts:

/Library/LaunchAgents:

/Library/LaunchDaemons:

/Library/PreferencePanes:

/Library/PrivilegedHelperTools:

/Library/QuickLook:

iBooksAuthor.qlgenerator

iWork.qlgenerator

/Library/QuickTime:

AppleIntermediateCodec.component

AppleMPEG2Codec.component

/Library/ScriptingAdditions:

/Library/Spotlight:

Microsoft Office.mdimporter

iBooksAuthor.mdimporter

iWork.mdimporter

/Library/StartupItems:

/etc/mach_init.d:

/etc/mach_init_per_login_session.d:

/etc/mach_init_per_user.d:

Library/Fonts:

Library/Input Methods:

.localized

Library/Internet Plug-Ins:

Library/Keyboard Layouts:

Library/LaunchAgents:

Library/PreferencePanes:

That is the only step that produced any results. Any help out would be awesome!!!

Hi Linc,

One more please? My soon to be ex knows things he could only get from accessing my Mac (or maybe my iPhone?) Since moving out I've repeatedly changed passwords to very difficult ones. If he hasn't installed anything on my Mac, could he access it from the parking lot of my apartment with his Mac? My wireless is locked, but my Mac seems to want to occasionally join some stupid unlocked LinkSys nearby. I can't figure it out, but he is pretty sophisticated with surveillence equipment like cameras in the house, recording devices, a tracking device on my vehicle, etc. He hasn't been in this apartment, though.

Anyway, here are my results:

Last login: Tue Feb 12 21:29:11 on ttys000

myname-MacBook-Pro:~ myname$ kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}'

myname-MacBook-Pro:~ myname$ sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix)|edu\.mit|org\.(amavis|apache|cups|isc|ntp|postfi x|x)/{print $3}'

WARNING: Improper use of the sudo command could lead to data loss

or the deletion of important system files. Please double-check your

typing when using sudo. Type "man sudo" for more information.

To proceed, enter your password, or type Ctrl-C to abort.

Password:

1. com.microsoft.office.licensing.helper
2. com.google.keystone.daemon
3. com.adobe.fpsaud

myname-MacBook-Pro:~ myname$ launchctl list | sed 1d | awk '!/0x|com\.apple|edu\.mit|org\.(x|openbsd)/{print $3}'

1. com.google.keystone.system.agent
2. com.spotify.webhelper
3. com.adobe.ARM.202f4087f2bbde52e3ac2df389f53a4f123223c9cc56a8fd83a6f7ae

myname-MacBook-Pro:~ myname$ ls -1A /e*/mach* {,/}L*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/Bu,P*P,Priv,Qu,Scripti,Servi,Spo,Sta} * L*/Fonts 2> /dev/null

/Library/Components:

/Library/Extensions:

/Library/Frameworks:

1. AEProfiling.framework
2. AERegistration.framework
3. AudioMixEngine.framework
4. EWSMac.framework
5. EpsonInformationService.framework
6. NyxAudioAnalysis.framework
7. PluginManager.framework
8. TSLicense.framework
9. iTunesLibrary.framework

/Library/Input Methods:

/Library/Internet Plug-Ins:

1. AdobePDFViewer.plugin
2. AdobePDFViewerNPAPI.plugin

Flash Player.plugin

Flip4Mac WMV Plugin.plugin

JavaAppletPlugin.plugin

Quartz Composer.webplugin

QuickTime Plugin.plugin

1. SharePointBrowserPlugin.plugin
2. SharePointWebKitPlugin.webplugin
3. Silverlight.plugin
4. flashplayer.xpt
5. googletalkbrowserplugin.plugin

npgtpo3dautoplugin.plugin

nsIQTScriptablePlugin.xpt

/Library/Keyboard Layouts:

/Library/LaunchAgents:

com.google.keystone.agent.plist

/Library/LaunchDaemons:

1. com.adobe.fpsaud.plist
2. com.apple.remotepairtool.plist
3. com.google.keystone.daemon.plist
4. com.microsoft.office.licensing.helper.plist

/Library/PreferencePanes:

Flash Player.prefPane

Flip4Mac WMV.prefPane

JavaControlPanel.prefpane

/Library/PrivilegedHelperTools:

Google Drive Icon Helper

com.microsoft.office.licensing.helper

/Library/QuickLook:

iWork.qlgenerator

/Library/QuickTime:

AppleIntermediateCodec.component

AppleMPEG2Codec.component

Flip4Mac WMV Advanced.component

Flip4Mac WMV Export.component

Flip4Mac WMV Import.component

/Library/ScriptingAdditions:

/Library/Spotlight:

Microsoft Office.mdimporter

iWork.mdimporter

/Library/StartupItems:

/etc/mach_init.d:

/etc/mach_init_per_login_session.d:

/etc/mach_init_per_user.d:

Library/Address Book Plug-Ins:

1. SkypeABDialer.bundle
2. SkypeABSMS.bundle

Library/Fonts:

Library/Frameworks:

EWSMac.framework

Library/LaunchAgents:

1. com.adobe.ARM.202f4087f2bbde52e3ac2df389f53a4f123223c9cc56a8fd83a6f7ae.plist
2. com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.17702FE6-AA35-416A-8C82-FAC 5124BE8A8.plist
3. com.spotify.webhelper.plist

Library/Services:

myname-MacBook-Pro:~ myname$ sascript -e 'tell application "System Events" to get name of every login item' 2> /dev/null

myname-MacBook-Pro:~ myname$