Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

How can I tell is my Mac is compromised?

A few weeks ago, I imported a few CDs into iTunes. A new folder showed up on my desktop that was titled "Voeg automatisch toe aan iTunes." (It means "automatically add to iTunes" in Dutch. I'm American and using a US Mac.) I didn't think much of it except that it was a weird Mac bug. (Unfortunately, there is only one other person I found via Google who had the problem with iTunes creating a weird Dutch folder, and no one answered him.)


But yesterday, I logged into my Google Webmaster Tools account for the first time in over a year. Less than an hour later, Google sent me an e-mail warning me that they prevented a potential login to my account--from someone based in the Netherlands! (Dutch!)


I remembered that odd folder--which I had left on the desktop because I didn't think anything of it--and tied the two together. There's no way someone could have known that I had logged into Google WITHIN THAT SAME HOUR unless my computer was compromised.


I quickly deleted the folder and ran a software update. I installed the Flashback tool as instructed and ran the specific commands in Terminal as well (neither the installation nor the commands found anything).


Here's my questions: Is there anything else I should do to figure out if my computer is still at risk? What about my other Mac that is on the same network--is that one at risk too? How in the world did this happen?

MacBook Pro, Mac OS X (10.5)

Posted on Jun 4, 2012 6:27 AM

Reply
9 replies

Jun 4, 2012 10:51 AM in response to Moxie Cat

Moxie Cat wrote:


I installed the Flashback tool as instructed and ran the specific commands in Terminal as well (neither the installation nor the commands found anything).

Doesn't sound like Flashback (or any other malware that I'm familiar with, actually) but I would not waste my time running Terminal commands as there have been over two dozen variants of Flashback and none of the Terminal commands I've seen cover all of them.

Is there anything else I should do to figure out if my computer is still at risk?

The only way known to install a key-logger on a Mac is by having physical or network access to the computer. In addtion to the lists provided above, MacScan from SecureMac is probably the best at detecting such "Spyware" although they are also known for producing false alarms, so don't automatically delete anything it may find.


You should also update to OS X 10.6.8 (your profile indicates you are still on 10.5) as soon as possible to take advantage of about a year's worth of security features and updates. If you are a MobileMe subscriber you can get it for free by logging into http://www.me.com/snow-leopard.

Jun 4, 2012 3:01 PM in response to MadMacs0

Thank you so much for the assistance. I have installed Little Snitch, and so far it didn't find anything. I also went step-by-step through all the processes that were running in Activity Monitor, and I didn't find any that were suspicious via Google research.


The reason I suspect a keylogger is because the person who tried to access my Google Webmaster Tools account apparently had my password--a password that I hadn't used to login there in over a year. Google flagged the attempted login because of the IP address being in the Netherlands. If he hadn't had the right password, they wouldn't have blocked the login due to IP, because he wouldn't have been able to get in at all. Plus, this happened within an hour of the first login I had made there in over a year, so apparently someone was tracking my Safari activity as well.


Add to that the odd Dutch iTunes folder that loaded on my desktop the last time I ripped a CD, and this has turned into a very strange and scary situation! Fortunately, this isn't a computer that I use for much "login" type stuff (it's mainly used for video editing), but it does have LAN access to my Mac that I do use for everything else.


No one has physical access to my Mac except me (home office) but I do operate a LAN that contains a few PCs and Macs. They are connected via a AirPort Extreme and my local network, which is password-protected.


Yeah, still in 10.5--just never upgraded.


If anyone has any other advice or thoughts, it is most welcome. I still can't figure out why an iTunes "Automatically add to iTunes" folder showed up on my desktop--with the filename in Dutch! I mean, even if my computer was compromised, how in the world could that happen?!

Jun 4, 2012 4:32 PM in response to BDAqua

iTunes usually adds the "Automatically add to iTunes" folder to my desktop whenever I open iTunes (or sometimes just when I import a CD). I admit that I didn't realize what it was for until I read your link. However, I never saw it created with a Dutch filename until now!


Yup, "open safe files after downloading" is checked in Safari. I will uncheck it.


All my downloads go into the "Downloads" folder, not the desktop. That must be the Safari default because all of my Macs work that way naturally.

Jun 4, 2012 5:30 PM in response to BDAqua

No. LOL.


My regular iTunes (the one with my music library, used for my iPhone, etc.) is on a different Mac. But the DVD drive on that Mac had stopped working, so I couldn't rip some new CDs I purchased. So I opened the iTunes on this secondary Mac, which I mainly just use to convert AIFFs to MP3s and that sort of thing, and which does have a working DVD drive.


I think I only ripped three CDs. Two were Ben Folds, and one was the Boardwalk Empire soundtrack. Then I copied those MP3s to my regular iTunes on the other Mac. And that was that.


There has to be a link, though, to the fact that this iTunes folder was in Dutch and the attempted hacking was from the Netherlands. That's just too much of a coincidence, of all the countries in the world. And it really bugs me that I ripped these CDs at least 2 months ago, so this has apparently been going on at least that long. Thank God I don't use this Mac for any online shopping or banking!

How can I tell is my Mac is compromised?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.