Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Grave security problem - Screenshots of everything I ever searched

Hi folks.


I need your advice on a very disturbing matter. I recently deleted some images from my external storage and decided to scan it with the software recovery program.


It managed to find over 150K jpg deleted images. I started going trough these images trying to find what I wanted to restore and to my surprise I found images of every single internet search which I did in the past year. Screenshots of Google Searches, eBay bids, even some images of movies I watched using Quicktime, a complete little history of what I did in the past year.


Now, I am not paranoid but this is not normal. I presume I have some sort of spyware installed on my computer. Does anybody know what could do such thing and what steps I should take to remove this?

Posted on Mar 24, 2012 2:03 AM

Reply
15 replies

Mar 24, 2012 3:16 AM in response to apl693

vladimirfromtuebingen wrote:


Well I didn't create them and I didn't delete them.

Ok, well was the drive secondhand?


Why would I make 30 000 screenshots of my browsing history with Safari?

I don't know whether you'd have reason to or not.


So my question is: do I have security problem? Is this some kind of spyware installed on my Mac making screenshots?

Again, no idea. Maybe you can run ClamAV or similar and see what turns up? Do you also run Windows on that Mac?

Mar 24, 2012 3:23 AM in response to gumsie

No the drive was new when I bougth it. I am using it to backup my Mac so these files ca,e from my Mac. I am not troubled because of the drive. I am troubled that someone was making screenshots of my entire browsing history on my Mac and my question is simple: does anyone know if there is some spyware program doing this and how I can remove it?

Mar 24, 2012 3:28 AM in response to apl693

vladimirfromtuebingen wrote:


No the drive was new when I bougth it. I am using it to backup my Mac so these files ca,e from my Mac. I am not troubled because of the drive. I am troubled that someone was making screenshots of my entire browsing history on my Mac and my question is simple: does anyone know if there is some spyware program doing this and how I can remove it?

I don't know about that. Try the ClamAV. It's possible that you have spyware I suppose though I know of none like this. You have enabled all the necessary security measures?

(Stealth mode/Secure virtual mem/Firewall...etc).

Mar 24, 2012 3:53 AM in response to apl693

There is some Mac malware known to take screenshots... see More broken Mac malware and New variant of Revir/Imuler. Also, for more general advice regarding malware, see my Mac Malware Guide. (Note that my pages contain links to other pages that promote my services, and this should not be taken as an endorsement of my services by Apple.)


If you have Imuler.A, there are some removal instructions here:


http://www.f-secure.com/v-descs/backdoor_osx_imuler_a.shtml

Mar 24, 2012 3:56 AM in response to gumsie

I think a computer with security features enabled is a safer one that has none, but I take your point.


Not necessarily. Often, people enable security features without a full understanding of what they do, and then behave as if they were "safe" when they actually are not. If enabling a security feature which is only useful in limited circumstances causes you to behave dangerously, it's actually worse to turn it on.


With regard to malware, there is NO software or security feature that can protect you 100% of the time, even when used appropriately.

Mar 24, 2012 3:59 AM in response to thomas_r.

Thomas A Reed wrote:

Not necessarily. Often, people enable security features without a full understanding of what they do, and then behave as if they were "safe" when they actually are not. If enabling a security feature which is only useful in limited circumstances causes you to behave dangerously, it's actually worse to turn it on.


With regard to malware, there is NO software or security feature that can protect you 100% of the time, even when used appropriately.

We have a slight difference of opinion here which is fine, but as I said. I take your point.

Mar 24, 2012 9:58 AM in response to apl693

Safari keeps a snapshot of every web page you visit so that it can give you a preview when looking at your bookmarks or history. These aren't available to other users on your machine, but depending on how you are backing up your data they may be visible (Time Machine backups keep access privileges). Personally I don't use these snapshots, and if you don't want them around either you can empty your user's ~/Library/Caches/com.apple.Safari/Webpage Previews folder and then set the permissions to read only so snapshots don't get saved.

Grave security problem - Screenshots of everything I ever searched

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.