Has my Mac been hacked?

Question

Level 1

0 points

Has my Mac been hacked?

My wife and I woke up this morning to find at least three Safari sessions open on the computer. The one that disturbed me the most looked like the login page to H&R Block Online taxes. I know I didn't open it before I went to bed and neither did my wife. In fact I haven't tried to log into H&R Block since I did my taxes last year.

I've noticed lately that the computer hard drive seems to be running at night. It has been doing this for several weeks. My wife purchsed and installed McAfee Internet Security at the end of December. The hardrive noise seemed to coincide with that purchase so i thought it was the real time scanning feature running at night. Now, i am not so sure.

Can anyone help me determine if someone is hijacking my Mac while were sleeping or away?

iMac (24-inch Early 2009), Mac OS X (10.5.8)

Posted on Feb 12, 2012 9:18 AM

Reply

Answer 1

Best reply

BDAqua

Level 10

239,219 points

Feb 12, 2012 9:43 AM in response to Jlan5346

Hmmm,

See if you might have this malware redirecting DNS queries...

http://macmegasite.com/node/3924

http://www.ehow.com/how_2128387_remove-osxrspluga-trojan-horse-mac.html

How to fix...

http://www.macosxhints.com/article.php?story=20071031114140862

Get MacScan...

http://www.apple.com/downloads/macosx/networking_security/macscan.html

ClamXAV, free Virus scanner...

http://www.clamxav.com/

Free Sophos...

http://www.sophos.com/products/enterprise/endpoint/security-and-control/mac/

Get Little Snitch, stops/alerts outgoing stuff...

http://www.obdev.at/products/littlesnitch/index.html

Reply

Answer 2

Jlan5346 Author

Level 1

0 points

Feb 12, 2012 10:00 AM in response to BDAqua

BDAqua,

Thanks for the suggestion. I followed the instructions and did not find any indication or evidence of this trojan horse. Any other thoughts?

Reply

Answer 3

BDAqua

Level 10

239,219 points

Feb 12, 2012 10:28 AM in response to Jlan5346

Well, I'd get Little Snitch at least to see if some info is trying to get out that you don't know about.

Do you have any Sharing enabled?

Are you connecting through a Router? Are you using Wifi/Airport, or Ethernet?

Reply

Answer 4

Jlan5346 Author

Level 1

0 points

Feb 12, 2012 10:47 AM in response to BDAqua

OK, I'll get the Little Snitch. We do have sharing enabled so we can share files and printers on home network. Also, we are using Airport to facilitate the internet connection through a broadband FIOS router.

Reply

Answer 5

Jlan5346 Author

Level 1

0 points

Feb 12, 2012 11:02 AM in response to Jlan5346

BDAqua,

So I downloaded LittlSnitch. When the program started it opened up with 41 Rules. These "Rules" appear to allow communication for a lot of things. I am not very savvy in interpreting what they are as their titles or names are pretty vague. Do you have any advice on which rules I should change? Or, should I just leave them alone?

Reply

Answer 6

BDAqua

Level 10

239,219 points

Feb 12, 2012 11:15 AM in response to Jlan5346

Those rules are pretty safe, just leave them.

When a new thing wants to send something out over the Internet, LS will pop up & tell you what it is & ask if you want to permit it.

Reply

Answer 7

Jlan5346 Author

Level 1

0 points

Feb 12, 2012 11:19 AM in response to BDAqua

Thanks BDAqua! 😎 This will at least help me keep an eye on things.

Reply

Answer 8

MadMacs0

Level 5

5,221 points

Feb 12, 2012 2:00 PM in response to Jlan5346

Jlan5346 wrote:

we are using Airport to facilitate the internet connection through a broadband FIOS router.

If you are not using WPA2 wireless security, change it immediately. All other forms of wireless security are easily hacked by neighbors or passers by.

Reply

Answer 9

Jlan5346 Author

Level 1

0 points

Feb 12, 2012 2:46 PM in response to MadMacs0

We've always used WPA2. Thanks for the tip, however.

Reply