Is there a way to tell which .plis files in launch agent and daemons folders are trojans or malicious script?
Usually the plist file will be named after the bundle identifier of the application, but you can also just look in the file to see what application is being run.
Do any of these look suspicious to you:
file://localhost/System/Library/LaunchDaemons/edu.mit.Kerberos.kadmind.plist
file://localhost/System/Library/LaunchDaemons/edu.mit.Kerberos.krb5kdc.plist
file://localhost/System/Library/LaunchDaemons/exec.plist
file://localhost/System/Library/LaunchDaemons/finger.plist
file://localhost/System/Library/LaunchDaemons/ftp.plist
file://localhost/System/Library/LaunchDaemons/login.plist
file://localhost/System/Library/LaunchDaemons/nmbd.plist
file://localhost/System/Library/LaunchDaemons/ntalk.plist
file://localhost/System/Library/LaunchDaemons/org.amavis.amavisd_cleanup.plist
file://localhost/System/Library/LaunchDaemons/org.amavis.amavisd.plist
file://localhost/System/Library/LaunchDaemons/org.apache.httpd.plist
file://localhost/System/Library/LaunchDaemons/org.cups.cups-lpd.plist
file://localhost/System/Library/LaunchDaemons/org.cups.cupsd.plist
file://localhost/System/Library/LaunchDaemons/org.isc.named.plist
file://localhost/System/Library/LaunchDaemons/org.net-snmp.snmpd.plist
file://localhost/System/Library/LaunchDaemons/org.ntp.ntpd.plist
file://localhost/System/Library/LaunchDaemons/org.postfix.master.plist
file://localhost/System/Library/LaunchDaemons/org.samba.winbindd.plist
file://localhost/System/Library/LaunchDaemons/org.x.privileged_startx.plist
file://localhost/System/Library/LaunchDaemons/shell.plist
file://localhost/System/Library/LaunchDaemons/smbd.plist
file://localhost/System/Library/LaunchDaemons/ssh.plist
file://localhost/System/Library/LaunchDaemons/telnet.plist
file://localhost/System/Library/LaunchDaemons/tftp.plist
Not really, but items in the /System/Library/ folder are part of the system - nothing should be messing with or putting items there. Anything installed by you should have been installed in the /Library or ~/Library folders.
Thanks dude!!
Deleting .plist files
