Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

4 points

Almost positive I've got a keylogger...

I'm almost positive I've got a hacker, but I really don't know what to do about it. Hopefully someone here will be able help me. My ex-girlfriend's psychotic ex-boyfriend's hobby is hacking me. He doesn't live near me, so he's never been near my router or anything. However, the reason I know he's hacked me in some way is that he's been on my Facebook and Myspace before, blocked me out of an email address, and has been known to send her my conversations with other people on AIM and MSN Messenger just to be annoying. I know this is illegal and everything, but he lives over 1000 miles away and I really would rather just get rid of anything that's on my computer and protect myself in the future.

Unfortunately, I really don't know much about this stuff. I know that viruses and keyloggers are rare and everything, but that just has to be it. I've changed MSN accounts multiple times and I've changed my Facebook password and email multiple times. I tried RootKit Hunter, but the only warnings it comes up with are things that people on other boards have addressed and shown to be a mistake in the program. So... what can I do to find this and get rid of it?

I'm using a 2006 MacBook with Snow Leopard.

MacBook, Mac OS X (10.6.4)

Posted on Jun 20, 2010 12:19 AM

39 replies

WZZZ

Level 6

13,226 points

Jun 20, 2010 12:02 PM in response to thomas_r.

Thomas, paranoid is a very loaded word, and using it makes having a calm discussion about this subject difficult.

I don't think cookies can hurt me, and I never suggested that. You are loading what I have said with unwarranted assumptions.

I just prefer as much privacy (which we seem to have different definitions of) as I can get, whether it's about personal information or not.

There is much more on the subject, especially tracking cookies, but why don't we let it go at that?

KJK555

Level 4

2,900 points

Jun 20, 2010 12:08 PM in response to Wormbog

Spy buddy only works on windows. Also if no one has had physical access to your machine, it is
highly unlikely they installed anything of the sort.

Here is a free app that can help you build nice passwords:
http://www.apple.com/downloads/macosx/networking_security/passwordbuilder.html

"Rekey" everything you got and your problems will most likely go away.

Jun 20, 2010 12:16 PM in response to Wormbog

I agree that it is as a last resort, altho unlike Windoze, it can be done in a few hours and also opens up the opportunity to fine tune, lock down and clone. Providing you with a back up that is safe to restore should the proverbial hit the fan.

Wormbog Author

Level 1

4 points

Jun 20, 2010 1:08 PM in response to Wormbog

For some reason the Password Builder download page isn't working... I'll definitely use that as soon as it starts working though. Oh, and does anyone know of a program I can use to encrypt the outgoing data on my messengers?

The hatter

Level 9

60,990 points

Jun 20, 2010 1:17 PM in response to Wormbog

You may actually be fine and better off with just NoScript.

The extension helps users encrypt their traffic to a small, but growing number of high profile sites, by forcing full-session HTTPS connections'

*EFF releases new HTTPS Everywhere Firefox extension*
http://www.zdnet.com/blog/security/the-eff-releases-new-https-everywhere-firefox -extension/6738

But comes out concluding HTTPS Everyway Extension probably isn't the way to go.

KJK555

Level 4

2,900 points

Jun 20, 2010 1:53 PM in response to Wormbog

Here is a good link to Password Builder:
http://azlist.info/kj/mac/utilities/Password_Builder.zip

I save everything like a pack rat. 🙂
It looks like it has become hard to find and the developers page has been taken down,
so I found it in my archives and posted it on my server for you.

Enjoy!

Wormbog Author

Level 1

4 points

Jun 20, 2010 2:03 PM in response to KJK555

Great, thanks KJK.

Hatter, Umm... should I download that thing or not? Right after the link it says that it might be better not to use it.

thomas_r.

Level 7

31,989 points

Jun 20, 2010 2:04 PM in response to WZZZ

The word "paranoid" may be loaded, but when it comes to desires for Google not to know that the browser on a particular unidentified machine has visited eBay, MapQuest and Apple, then I think it's accurate. If you choose to accept cookies from ad banner providers, they still can't gather any more info than that. They can't identify you specifically - the only thing they know is that your browser has their cookie - and they can't get any information you've provided to other sites. All they can do is track that you've been to particular sites that had their ads, and that information is only useful for marketing.

Web sites use cookies to make your visits smoother and easier. They are not malicious, they contain no code (and thus cannot transmit viruses as some appear to believe) and much effort has been put into modern browsers to ensure that cookie data is carefully controlled and kept secure. You are totally in control without the need for software to remove "tracking cookies." Ultimately, you're better off worrying about things with more real-world relevance, like what the guy in the lawn service van across the street is learning about your habits or letting the local post office know exactly when you're going to be out of town so they can hold your mail.

Wormbog Author

Level 1

4 points

Jun 21, 2010 6:09 AM in response to thomas_r.

Alright, well you guys have certainly convinced me that I'm not dealing with a keylogger. In fact, the guy practically told me it wasn't. He texted me(using my ex's number from the verizon website-- they should really take that feature down...) and told me that he has a hack connected to my facebook, and one connected to my email. I know that this is sort of off topic, but this seems to be what I'm dealing with. So... is this possible? Is it possible to just have something connected to my facebook that tells him my log-in info? Any idea what sort of a hack this could possibly be? I downloaded the password making program and used it for everything, so now everything I have on the internet has a long elaborate password. But if he really does have hacks in my email and facebook, I don't think those will do any good..

M4R4G4T0

Level 1

10 points

Jun 21, 2010 6:41 AM in response to Wormbog

Sincerely, your Mac is the last thing I'd be suspicious about. I'd really recommend changing those passwords to really strong passwords.

And I mean 9+ digits, among uppercase/lowercase letters, numbers and special symbols. Think of something meaninful to you and change it to "S0meth1ngM3@ningful!?", for example. OK, that was a huge password, but just to give you an idea.

Good luck!

KJK555

Level 4

2,900 points

Jun 21, 2010 12:07 PM in response to Wormbog

"He texted me ... and told me that he has a hack connected to my facebook,
and one connected to my email"

Hmm... So he admits involvement in a federal crime in an email to you...

He better hope you have mercy on him and the old girlfriend.

Wormbog Author

Level 1

4 points

Jun 21, 2010 1:00 PM in response to KJK555

I have changed every password I have into extremely long mixes of numbers, letters, and symbols. None of them even make sense. I just saved them in text edit.

Well, he does it behind her number. She hates him just as much as I do. It's not them against me. He's just doing this to stir things up. That's why he uses her number. So if I went to the police it would be traced back to her. Eventually though, I'm sure I'll snap and get the law involved. But I'd really rather figure this out without that. If he lived within 500 miles of me I'd just beat the leaving S * out of him cause he's a scrawny little wuss. But that's beside the point...

Does anyone have any idea what could be "connected" to my facebook or email? I changed my privacy settings to where I'll know if my facebook signs on anywhere else, but still... I mean... should I just delete my facebook for a while and just make a new one in a few weeks/months? I'd really prefer not to, if there's a way to figure out what he did. I thought maybe he had just guessed a password a while back and linked an email to it, but I there were no linked emails. Despite all this, I'd be willing to delete it if that's the only way.

M4R4G4T0

Level 1

10 points

Jun 21, 2010 1:06 PM in response to Wormbog

Well, in the worst case you could try changing your sensitive information again using another computer, then not entering it on your Mac for a while, just to see what happens and then decide if you better back-up all of your important stuff and reinstall your Mac OS.

Wormbog Author

Level 1

4 points

Jun 21, 2010 6:34 PM in response to M4R4G4T0

So you don't think there's really anything he could have connected to my facebook/email? I just don't understand what it could be. I've checked everything and can't find any signs of other emails being linked to any of my emails or my facebook. I've heard of people doing that.

M4R4G4T0

Level 1

10 points

Jun 21, 2010 8:00 PM in response to Wormbog

Facebook does have those so-called applets indeed, but I'm not sure even an "evil" applet could do anything with your password. You could check for installed applets and remove anything suspicious, just to be safe.

It's also advised to check your Google account for secret questions, phone numbers and alternative e-mail addresses that aren't yours.

Cheers!

Almost positive I've got a keylogger...