Want to highlight a helpful answer? Upvote!

Did someone help you, or did an answer or User Tip resolve your issue? Upvote by selecting the upvote arrow. Your feedback helps others! Learn more about when to upvote >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Have I been hacked?

Dear All


Am a little in shock as I think someone has been in my laptop. Yesterday (Sat) afternoon I decided I would look for any live coverage of the Sri Lanka vs England game at Lords. With a simple Google search ('cricket sri lanka test live') I found www.webcric.com which had some poor quality, but OK live video, apparently coming from a channel 4 (there was a '4' logo in the corner of the screen, but Channel 4 UK were not covering the game, as far as I know). However, when I first followed the link from Google, a window popped up asking if I wanted to download 'MacKeeper', with a 'Yes or Cancel' dialog, which I perhaps stupidly clicked on (I clicked 'Cancel'). Nothing obviously untoward happened and I was taken to the webcric site where I watched a few minutes of cricket before the tea break and then, I think, paused/stopped it and went off to do something else for a while. I subsequently came back and visited a couple of other sites later in the evening and then left the computer sleeping overnight.


This morning I woke the computer and checked email. I then decided I needed to find a site I had seen yesterday and so, unusually, opened up the History in Safari and found 10 pages which I do not remember visiting (beginning 'guideforamsterdam.com' in ). These appear in sequence directly after my visit to webcric and the MacKeeper link, and before the next site I visited (Facebook, for my sins). Interestingly, there are also two other obscure links either side of the webcric link, which also have unusual formats ('bit.ly/fQSWvl' and 'd3.zedo.com/jsc etc.'). I have not followed these latter two links, but all of the other unexpected links, which are listed as having 'no title', take you to the guideforamsterdam.com site, except for the final one ('www.chill.net/search etc') which takes me to my account on Amazon where a search for 'club red hat' appears to have been done?!


Needless to say, this is very unnerving. I have checked with the rest of my household and no-one admits to using my computer. More to the point, I have a passworded screen saver that kicks in quite quickly, so I doubt this is the nefarious activity of my kids!


So I am uncertain what to do next. I have turned my Airport off for the time being, but obviously I will have to turn it on again to send this email and clearly I need the internet. So, in addition to warning you all about such sites, I am hoping I can get some advice. What is the most effective thing for me to do, particularly to get rid of the possibility that I now have a program on board that may be able to monitor my activities (record password keystrokes for example)? Thoughts I had are:


1) I assume that simply changing the password either on my laptop, or on my home network, will essentially be ineffective. If indeed a program has been downloaded, it's here and already on the wrong side of my passwords and firewalls (there is, by the way, no obvious signs of downloads in the Safari Download window, but I don't suppose that means much).


2) On the other hand, I could do something radical, like create a new user for myself and transfer across my essential docs and delete the rest. But that may not be enough.


3) Spend some money and get my Sophos anti-virus software up to date. But will that find whatever it is that's doing this?


4) Most radical, wipe the hard disk and do a restore from Time Machine (last back up two days ago; my applications are not included in the backup).


5) I am being completely neurotic?


Any help/advice gratefully received. In the meantime I'm going be working offline and not accessing my bank!!


Andy

Macbook, Mac OS X (10.5.6)

Posted on Jun 5, 2011 7:16 AM

Reply
17 replies

Jun 5, 2011 7:57 AM in response to lavernes-mom

Thanks. Am pretty sure this is not MacDefender as nothing was obviously installed, which does seem to be the case with MacD and its ilk (found this a bit earlier today). Am in the process of scanning with latest McAfee, which my work supplies, but there's 210 GB to scan so will update in the morning! Would be nice if there was a direct route thru which you could tell Apple about these things?!

Jun 5, 2011 7:53 AM in response to afurley

A good place to start would be here with Apples directions for removing MacDefender (which has gone under a number of different names) http://support.apple.com/kb/HT4650


Also read here about information about viruses and malware. http://www.reedcorner.net/guides/macvirus/


Since you already have Sophos installed you might want to update it. But if you don't plan on using it, you could just get rid of it. If it isn't updated it isn't helping, and might be causing problems. A search on this forum will give you information about it as well.


ClamXav is a free av program which has been recommended . MacKeeper is not recommended. There is one which is not a trojan but it does advertise via popups and can trick you into installing it, so it is not advised.


laverne's mom


Message was edited by: laverne's mom

Jun 5, 2011 8:28 AM in response to afurley

Would be nice if there was a direct route thru which you could tell Apple about these things?!


There is, but there's nothing to tell. All that happened, if your description is accurate, is that you ran into some deceptive popups and redirects -- a common occurence. I don't see where you mentioned that you checked your downloads folder for any unwanted files. You should do that. You should also consider installing an ad blocker such as GlimmerBlocker, which will make the whole web-surfing experience immensely better. That's optional. No other action is called for, especially not activating the firewall.

Jun 5, 2011 8:43 AM in response to afurley

Hi Andy


I agree with Linc - just redirects & pop-up ad windows from the webcric site. Nothing you've mentioned sounds concerning unless you later opened &/or installed something which was downloaded.


The same webcric site with say the adblock extension for safari = no ads, no redirects.

Seperately -If you get an offer of a new/updated & necessary plugin or codec for watching sporting events or other content - be suspicious.

Jun 5, 2011 9:36 AM in response to andyBall_uk

"All that happened, if your description is accurate, is that you ran into some deceptive popups and redirects -- a common occurence. I don't see where you mentioned that you checked your downloads folder for any unwanted files."


Thanks guys, this is reassuring. I certainly did check extensively for downloads, indeed any files that had appeared in the last 36 hours that I couldn't explain, and there are none. It was the appearance of a search on Amazon ('club+hat+red'?!) that spooked me, especially since it appeared to be on my account pages. However, although I don't know how this works, I am reassured that you think I can have seen this due redirects, and it turns out my pop-up block was off.


But the firewall? What's wrong with having it on? I was surprised it was not on by fault, but I checked a couple of the other machin around at it looks like Off is the default state?


In any case, thanks to all.

Jun 5, 2011 9:42 AM in response to afurley

The firewall is one of those topics where it's safe to say opinions vary!


Since you have a portable computer and you might take it from place to place and link to unknown networks, having it turned on is a sensible precaution. No doubt others will give you completely contrary opinions. Read what they have to say and make your own decision.


My firewall is firmly turned ON


Bob

Jun 5, 2011 9:56 AM in response to afurley

But the firewall? What's wrong with having it on? I was surprised it was not on by fault, but I checked a couple of the other machin around at it looks like Off is the default state?


Yes, that's the default, and it should stay off in most circumstances.


The firewall does only one thing: it blocks incoming network connections to applications that you designate. The only plausible circumstance in which you might want that would be the following:


Your portable Mac is sometimes on a trusted network, at home or at work, where it provides services such as File Sharing or Printer Sharing to other trusted clients. At other times, the Mac is on an untrusted network such as a public WiFi hotspot, where you don't want others on the same network to have access to those services. Now, you could just turn the services off when you go to the hotspot, but it's a little easier to activate the firewall and set it to block all incoming connections. That will allow you to function as a wireless client, while denying access to sharing services.


What the firewall will not do is protect you from malware. It doesn't filter web traffic, and it doesn't stop your browser, or any other application, from making outgoing connections, which is what malware would do. In the unlikely event that you installed some sort of trojan that listened for incoming connections, your router would block them (unless they were coming from the local network.)

Jun 5, 2011 10:07 AM in response to Bob Lang1

Since you have a portable computer and you might take it from place to place and link to unknown networks, having it turned on is a sensible precaution.


As I wrote above, it may make sense to have it on when you're on an untrusted network, if you have services enabled. It makes no sense to have it on when you're on a network where you want to provide services. If there are any services you don't want to provide on the trusted network, disable them. No need for a firewall then.

Have I been hacked?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.