Keyloggers

Question

Level 1

0 points

Keyloggers

Hello there,

Apologies if I am starting a topic which has already been addressed.

I have just downloaded a .rar file from 2shared.com, this file was not from a known source.

On opening the file (foolishly), unrarx came up with some errors saying it was missing a password, but oddly the .rar file then disappeared from my desktop.

This seems pretty odd to me, so as a result I am worried that I may have installed some kind of keylogger. I have done some research and I have read in some places that keyloggers can't be installed via .rars and someone needs direct access to your machine… but I am not 100%, and so would appreciate any further advice on the matter.

Many thanks in advance
Tim

MacBook Pro, OS X Mountain Lion (10.8.2)

Posted on Mar 20, 2013 4:36 PM

Reply

Answer 1

Best reply

John Galt

Level 10

140,832 points

Mar 20, 2013 4:53 PM in response to timsaw

timsaw wrote:

... I have done some research and I have read in some places that keyloggers can't be installed via .rars and someone needs direct access to your machine…

True but the point is that you have direct access to your machine. You downloaded some unknown software from some unknown source. It's a good way to cause interesting things to happen. The resulting consequences are anyone's guess.

Read the response from MadMacs0 in this thread: Keylogger Possibility? I have not used the utility he mentioned so I cannot recommend it.

The safest action to take in your case is to revert to a backup created before the incident you describe, followed by changing any passwords you may have used since then.

Reply

Answer 2

andyBall_uk

Level 7

20,516 points

Mar 20, 2013 4:55 PM in response to timsaw

Hi Tim

rather more likely that unrarx hid or deleted the file, I'd think, assuming that downloading/opening the rar is the extent of it.

try findanyfile to locate it - http://apps.tempel.org/FindAnyFile/

if you want to link here, minus the http &/or www surely somone'll check it out & put your mind at rest

Reply

Answer 3

timsaw Author

Level 1

0 points

Mar 20, 2013 5:18 PM in response to John Galt

Hi John,

Thanks for your response (albeit not the answer I was hoping for!). I will try MacScan first I guess.

Reply

Answer 4

timsaw Author

Level 1

0 points

Mar 20, 2013 5:19 PM in response to andyBall_uk

Hi Andy,

Thanks for your advice. I tried the findanyfile, but no trace. In Chrome's download list it marks it as removed. Is is common for rar's to auto delete?

To have someone check out the file would be absolutely brilliant, but I don't think I can post the link on here…

Reply

Answer 5

John Galt

Level 10

140,832 points

Mar 20, 2013 5:22 PM in response to timsaw

I think the likelihood of having inadvertently installed one is small. Post the URL, just obscure it like

badsite dot com

preceded by http and www

for example.

I'll try it on my Mac.

Chrome may automatically delete downloads for all I know - I don't use it.

Reply

Answer 6

timsaw Author

Level 1

0 points

Mar 20, 2013 5:27 PM in response to John Galt

John, that is so kind of you — thank you. It would really put my mind at rest…

The only issue about not wanting to post the link, is that it is music. Do you have an email I could send the link via?

Reply

Answer 7

timsaw Author

Level 1

0 points

Mar 20, 2013 5:48 PM in response to John Galt

Really hoping I haven't lost your offer of help based on my last reply… 😊

Reply

Answer 8

andyBall_uk

Level 7

20,516 points

Mar 20, 2013 5:53 PM in response to timsaw

best not link here then, against the rules.

if you need to: a1 at howmarvellous.plus.com

Reply

Answer 9

timsaw Author

Level 1

0 points

Mar 20, 2013 6:08 PM in response to andyBall_uk

Thanks Andy, just sent you a mail…

Reply

Answer 10

John Galt

Level 10

140,832 points

Mar 20, 2013 6:14 PM in response to timsaw

No worries, but I'm afraid I am unwilling to post any email addresses here. Not only is it a openly searchable website, it is against its terms of use to reveal personal information.

I see the site you mentioned is a file sharing site similar to Megaupload, is that right? I could find no obvious way to download anything from it.

.rar files are generally associated with Windows, and would be an unlikely compression choice for someone designing a Trojan intended for OS X. Though .rar can be expanded easily enough in OS X, I am inclined to believe whatever it is was not designed for a Mac and can have no effect on one.

Music files themselves cannot do anything, the only possibility was to have downloaded and installed something masquerading as a music file.

Aside from the self-deleting download (which may be normal for Chrome), I can find no justification for any specific concern, only a general one for having downloaded something unknown.

Reply

Answer 11

timsaw Author

Level 1

0 points

Mar 20, 2013 6:33 PM in response to John Galt

Sure, I understand, no worries.

Yes it was a site like the one you mention.

Interesting point about the rar format. I am hoping you are right on that one.

Re. the auto delete, this is absolutely not something that Chrome does automatically. And this is the thing that rang alarm bells the most.

I think Andy might be looking at the file for me… so hopefully we can get to the bottom of this!

Thanks again for all your help.

Reply

Answer 12

John Galt

Level 10

140,832 points

Mar 20, 2013 7:11 PM in response to timsaw

I'm afraid I have not been much help at all, but thanks. I was halfway through creating yet another throwaway Yahoo account when I read Andy's response. Let me know what you determine.

Reply

Answer 13

andyBall_uk

Level 7

20,516 points

Mar 21, 2013 10:42 AM in response to timsaw

It's seemingly a bug in unrarx that removes the original file if a resulting folder has the same name, extraction fails, and the default "Extract to File Directory " is chosen (eg: you just double-click the file to open it) (or maybe it's a bogus archive anyway,same bug) - but nothing to fear re malware that I see.

The Unarchiver deals with it as expected.

Reply

Answer 14

Aug 20, 2013 8:27 PM in response to John Galt

John Galt wrote:

timsaw wrote:

... I have done some research and I have read in some places that keyloggers can't be installed via .rars and someone needs direct access to your machine…

True but the point is that you have direct access to your machine. You downloaded some unknown software from some unknown source. It's a good way to cause interesting things to happen. The resulting consequences are anyone's guess.

Read the response from MadMacs0 in this thread: Keylogger Possibility? I have not used the utility he mentioned so I cannot recommend it.

The safest action to take in your case is to revert to a backup created before the incident you describe, followed by changing any passwords you may have used since then.

Running a scan on Spybot S&D, "perfect keylogger" popped up for a few seconds in the progress bar. No keylogger has turned up in the results.

Reply

Answer 15

MadMacs0

Level 5

5,221 points

Aug 20, 2013 9:56 PM in response to susudomenty

susudomenty wrote:

Running a scan on Spybot S&D, "perfect keylogger" popped up for a few seconds in the progress bar. No keylogger has turned up in the results.

I'm not following you on this. There is no Spybot S&D for the Mac, so what's the connection.

I also don't understand why you are posting to threads that are marked "solved" and over five months old?

Reply