MrHoffman wrote:
• timed isn’t altered.
Is this certain? Does the identity of the hash sequences really rule that out?
MrHoffman wrote:
• The background here about this particular situation, and about these “remote control fears”.
• What indications of compromise have been seen.
I'll just combine these.
Well, there have been several indicators over several weeks that several processes were initiated even though I hadn't initiated anything: most clearly, I guess, there were huge downloads taking over half an hour with maximum speed while I was sitting in front of the computer doing nothing, bookmarks that I had saved were deleted, and several other settings that I, let's say, turned off were turned on again, most memorably and eerily the microphone input; I think it's safe to assume that a Mac that hasn't been compromised wouldn't exhibit this behavior. As I checked my router's configuration panel several times, though, I didn't ever discern any unknown connection, and the same is for every Terminal command that shows me connections in my local network. What I find most puzzling is that this also happened when I wasn't even connected to the internet—I'd always thought there needs to be some internet connection to utilize a rootkit from afar, so is this a a positive or a negative sign?
• What sequence was used to reload macOS.
I think I did everything I could without an internet connection and only plugged in the Ethernet cable when I had to download macOS High Sierra, which then happened with my router's connection.
• If there is malware here, where it might be persisting.
Again, when I boot up and perform the rootkit tests immediately without an internet connection, there are positive results. (Even if not all of them might be correct.)
• Whether there are any particular culprits suspected, and what sort of access they might have.
• Your value as a target; what sort of financial or sensitive or classified or proprietary info access, whether directly or indirectly.
I think I basically know the culprits or at least some of those who know what's going on. As for access, I never granted them physical access, but some of them know (and knew) my Apple ID and probably could have seen my Wi-Fi connection while standing before the house. My value as target for them would be rather primitive, i.e. spying on and ridiculing me.
Regarding your link, I already do pretty much everything listed there.
I appreciate your taking time for this. Any idea how to proceed? What's most important to me isn't getting rid of the malware as soon as possible, but rather trying to find evidence against those people, even if it may be hard to find.
