Keylogger Possibility?

I doubt but you can never say never

Just use the red button and quit the processes and restart

Antivirus is available

You can use CLAM XAV free from App store

or Sophos free for home use (Which I use) and run a scan

http://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-mac-home-ed ition.aspx

http://www.usatoday.com/story/tech/columnist/komando/2013/02/14/tech-myths-mac-s oftware-megapixels-camera/1910521/

Keylogger programs are not viruses or malware and will not be detected as such.

I know of three Mac keylogger apps:

ABK a/k/a AOBO Keylogger installs in a hidden folder: /Library/.A_o_b_o/Abk.app

Its process will appear in Activity Monitor with the name A_o_b_o. The underscore characters are exactly that.

In Safari's URL field, type file:///Library/.A_o_b_o/

You should a grey screen with the result "No file exists at the address file:///Library/.A_o_b_o/"

Refog Mac Keylogger installs in a hidden folder: /Library/.smoke/Refog.app

In Safari's URL field, type file:///Library/.smoke/

You should see the result "No file exists at the address file:///Library/.smoke/"

Spector Soft installs its keylogger app at /usr/local/sps/

In Safari's URL field, type file:///usr/local/sps/

You should see the result "No file exists at the address file:///usr/local/sps/"

If any one of these actions results in Safari switching to a Finder window then it is installed.

Other keylogger apps may exist. If you are still concerned please explain the reasons for your concern and I will suggest another test for you to conduct.

The scams such as you describe are common. It is only the latest variation on a century's old confidence game. The way they work is to convince you to download and install a program that can be subsequently used to harvest data or for other malicious purpose. From what you describe that did not occur.

The caution that you exercise - knowing what information you are providing, to whom, and for the purpose for providing it - is the best way to avoid trouble.

Your son became justifiably concerned at the solicitation to download something unknown. No harm done, and he probably won't make that mistake again.

By the way this is what my Activity Monitor showed, filtering for "web"

If you see something similar it is not cause for concern.

Is there anything else you would suggest us do?

Nothing other than what you have hopefully been doing already - use reasonably good passwords and change them once in a while, have a reliable backup strategy, keep your Mac up to date with software updates from Apple, don't supply your name and password merely because something or someone asks for them, don't click on links in unknown emails, and be on guard whenever you talk to strangers. Whether they are on the street or Skype chat makes no difference.

More to read:

OS X Mountain Lion: Keep your information safe

Generally applicable to Lion or any OS for that matter.

Well my son went on skype and some stranger friended him and sent him some files for him to recieve from skype.

That's a matter for the police. Your son was the intended victim of a crime.

I'm not going to give you parenting advice, but if the "scammer" was someone your son doesn't know, in your place I'd be on the phone to the police or the FBI. This is a classic MO for sexual predators.

John Galt wrote:

I know of three Mac keylogger apps:

...

Other keylogger apps may exist.

MacScan has a reasonably complete list here. It's about the only thing MacScan is good for.

ThatPellirojo wrote:

I have looked at Security programs and found ClamXav and saw how it's free and found an article with the top 10 mac anti-virus programs...http://www.nbcnews.com/id/43183530/ns/technology_and_science-security/#.UTlhmXjU 7lK

I'm not in the habit of recommending A-V software for reasons that will be clear later. There are plenty of others who do that here routinely. I'll start by pointing out that the article is old (last updated in May 2011). Since then PCTools no longer supports iAntiVirus and the name is being used by Norton for a scaled back version of their software. Most of the ones listed were brand new at the time from formerly PC software vendors that thought they saw a chance for a new Mac market. A few of them still haven't shown that they fully understand OS X. Some have not provided sufficient resources. Some don't even provided updates to their databases. Note that the article doesn't really compare them. Most all of these have not been effective at identifying any of the Zero-day exploitations until several days after they were found in-the-wild. You can find a few other sites that will tell you they have done comparative testing, but most accept advertisement and / or payments from the vendors.

One comparison that does exist today is provided by Thomas Reed, a frequent contributor in the ACS forum and a colleague of mine Mac anti-virus testing, part 2.

Although I personally have four A-V programs installed, none of them are currently in use, except for testing. Many of us feel that a fully up-to-date OS X 10.6.8 and above provide adequate protection against all currently known malware that can impact OS X. If I frequented shady web sites, left Java turned on in my browsers, ignored warnings and entered my admin password indiscriminately, or exchanged files with Windows users, I might feel differently.

Full disclosure: I do uncompensated tech support on the ClamXav Forum.

I see that you've already gotten some very good advice here. In particular, I want to stress the importance of what Linc has said. What happened was a very serious crime, and needs to be reported. For all you know, the creep on the other end of the line was trying to get a webcam hack installed, not a keylogger, in hopes that he could spy on your son. Call the police, please!

Now, as to the software that was sent... Most likely, it really was a Windows-only exploit. However, we really don't know how deep a conversation your son had with this man, and it's entirely possible that it was actually a Mac backdoor that was sent. We also don't know what the message was about something needing to be downloaded... I don't see any reason for that message, as a malicious app or installer would be able to download stuff without asking, once it got its foot in the door (so to speak). Worst of all, it sounds like you have deleted the files, so those of us who could help you figure out what they might have been cannot do that.

Ultimately, your response to this is your decision. I have an extremely good relationship with my teenagers, and yet if the same thing happened here, I would not make any assumptions. I would consider the worst-case scenario - that some stranger might have gotten something installed that will let them spy on my child - and would respond to that.

In that case, there's only one reliable way to handle that worst-case scenario. Completely erase the hard drive. Then, if you have one, restore to a backup from before this incident happened. If you don't have one, reinstall the system and all applications from scratch, and copy personal documents only (no settings files, and no using Setup Assistant or Migration Assistant for the import) from a backup.

How would I erase the hard drive? Will it take a while to do this?

You would hold down command-R at startup, which will start up the machine in "recovery mode." From there, you choose Disk Utility from the list of choices, select your hard drive and erase it. (Of course, you will want to be sure any important documents are saved beforehand, as this destroys all the data on the hard drive.)

Next, quit Disk Utility and either reinstall the system or restore from a Time Machine backup from before this incident occurred.

Restoring from a Time Machine backup will take a little time, depending on how much data needs to be transferred and how the backup drive is connected. Reinstalling the system will also take some time, depending on how fast your network connection is (about 4 GB will need to be downloaded from Apple's servers), but more important is the amount of time it will take to reinstall all your apps from scratch, get all the settings back the way you want them and import documents from a backup.

Most likely, this is an extreme and unnecessary solution. But, given the circumstances, we cannot guarantee that it's not necessary, in which case there could be some very bad consequences for not doing it.