Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

keylogger

Hi,

I am worried that I have accidentally installed spyware/keylogger on my Macbook Pro (I updated Flash but wasn't paying attention so I am worried it wasn't legit). What is the best way to find out or clean the computer?

MacBook

Posted on Jun 10, 2020 8:51 AM

Reply
Question marked as Best reply

Posted on Jun 10, 2020 11:27 AM

Installing a keylogger requires intentionally bypassing several layers of security by supplying your Mac's Admin credentials. It's understandable to become concerned about having installed something malicious, but it's just not that easy to install a keylogger. It's even harder to definitively conclude the absence of one, so don't go about searching for a product or utility that claims such ability. Installing something of that nature is 100% certain to compound whatever problems might exist.


Let's assume you did that. Start by inspecting the contents of three folders, as described below. Start with the following folder:


~/Library/LaunchAgents


To open that folder, copy the entire line above and paste it in the Finder's Go menu > Go to Folder... field. Make it look like this:



... and click the Go button.


A Finder window will open. Make sure all its file names are readable by selecting View > as List or other selection that shows that folder's complete contents. Then, take a screenshot of that Finder window.



Often, there is nothing in that Launch Agents folder so don't be surprised to find it empty.


In the same manner as the above, navigate to this next folder:


/Library/LaunchDaemons


The Finder's Go menu > Go to Folder... field should look like this:



... and click the Go button once again.


Once again ensure all its files and their names are readable and capture a screenshot.


Then, repeat that exercise with the following folder:


/Library/LaunchAgents


Notice its pathname is different than the other two. The Finder's Go menu > Go to Folder... field should look like this:



In the end, you will have captured the contents of the following three separate folders:


~/Library/LaunchAgents

/Library/LaunchDaemons

/Library/LaunchAgents


All three will be saved to your Mac's Desktop with names "Screen Shot... " followed by the date and time they were captured. Please be sure to include or otherwise indicate the name of the folder that corresponds to each screenshot, so that you and I can keep track of which ones they are.


Post the entire contents of all three windows, one at a time, using the "picture" icon that appears below your reply text:


1 reply
Question marked as Best reply

Jun 10, 2020 11:27 AM in response to Sleepy100

Installing a keylogger requires intentionally bypassing several layers of security by supplying your Mac's Admin credentials. It's understandable to become concerned about having installed something malicious, but it's just not that easy to install a keylogger. It's even harder to definitively conclude the absence of one, so don't go about searching for a product or utility that claims such ability. Installing something of that nature is 100% certain to compound whatever problems might exist.


Let's assume you did that. Start by inspecting the contents of three folders, as described below. Start with the following folder:


~/Library/LaunchAgents


To open that folder, copy the entire line above and paste it in the Finder's Go menu > Go to Folder... field. Make it look like this:



... and click the Go button.


A Finder window will open. Make sure all its file names are readable by selecting View > as List or other selection that shows that folder's complete contents. Then, take a screenshot of that Finder window.



Often, there is nothing in that Launch Agents folder so don't be surprised to find it empty.


In the same manner as the above, navigate to this next folder:


/Library/LaunchDaemons


The Finder's Go menu > Go to Folder... field should look like this:



... and click the Go button once again.


Once again ensure all its files and their names are readable and capture a screenshot.


Then, repeat that exercise with the following folder:


/Library/LaunchAgents


Notice its pathname is different than the other two. The Finder's Go menu > Go to Folder... field should look like this:



In the end, you will have captured the contents of the following three separate folders:


~/Library/LaunchAgents

/Library/LaunchDaemons

/Library/LaunchAgents


All three will be saved to your Mac's Desktop with names "Screen Shot... " followed by the date and time they were captured. Please be sure to include or otherwise indicate the name of the folder that corresponds to each screenshot, so that you and I can keep track of which ones they are.


Post the entire contents of all three windows, one at a time, using the "picture" icon that appears below your reply text:


keylogger

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.