Detect spyware and determine who is spying on my imac

I might be paranoid -- but need to know at this point if someone very close to me has installed spyware on my mac. I keep finding forums that say to back up files and just restart your system and wipe everything clean, change passwords, etc. But this won't work for me for a couple of reasons: 1) I really need to know if there is someone close to me who has installed this on my computer and would like to find the IP address that the information is headed to. and 2) the person in question still has access to my computer and almost all of my passwords.


Please can we not get into why I think this person is spying, etc. and if anyone knows anyway for me to detect spyware and determine where information is being sent that would be the most helpful.


Would greatly appreciate any help here as I am paranoid about even looking up these kinds of things of my home computer (which i am doing now) and my iphone. (which I also need help with determining if it has spyware on it).


Thanks very much for any help.

iMac, Mac OS X (10.7.5)

Posted on Mar 24, 2013 5:22 AM

Reply
96 replies

Sep 8, 2016 6:49 AM in response to Pinkalmond

Pinkalmond wrote:


Hi Linc!

Thanks so much for this info! I've followed the steps but I don't know what "post output" means, so i obviously haven't done that! Please advise? I would really appreciate your help! Is "Activity Monitor" a tracking app? If so, how do I remove it? Also, since I've done that, I can't relaunch Finder?!!

From MadMacs0's comment above:


Linc doesn't normally respond to "me too" requests and almost certainly isn't monitoring this three year old discussion. He often changes his diagnostics routines, so what your have posted may be meaningless now and certainly should not be interpreted by anybody but Linc.


You will always be better off posting a new topic, fully explaining whatever issues you are experiencing without jumping to conclusions about what might be causing them and without posting any diagnostics until requested.


That's just the way this forum works best.

Oct 26, 2016 11:50 AM in response to quinidine

quinidine wrote:


Hi I see this is a pretty old post but i followed the steps given and was wondering if you could interpret/analyze the results for me

Linc doesn't normally respond to "me too" requests and almost certainly isn't monitoring this three and a half year old discussion. He often changes his diagnostics routines, so posting here may be meaningless now and certainly should not be interpreted by anybody but Linc.


You will always be better off posting a new topic, fully explaining whatever issues you are experiencing without jumping to conclusions about what might be causing them and without posting any diagnostics until requested.


That's just the way this forum works best.

Oct 27, 2016 5:03 AM in response to quinidine

Linc no longer posts in these forums.


Your problem, hardware or software, may not be exactly the same as that of the original poster of this older thread, and it can be very confusing for everybody if we try to answer more than one question in each thread, which can also result in you applying the wrong advice to your particular problem.


In order for us to give your problem our proper attention to try to solve it, would you kindly start your own thread, describing the trouble you are having in the fullest detail, including completing your details to show what Mac or iDevice you are using, what operating system, and what version of the application in question. Please remember to post in the forum relevant to your hardware or version of OS X. A full list of all the support forums is here:


http://discussions.apple.com/index.jspa

Nov 14, 2017 12:27 PM in response to Linc Davis

Hello Linc Davis. Can you please please look at my information below and email me at nowforsale@me.com? Thank you very much!


Last login: Tue Nov 14 14:04:55 on ttys001

ME:~ kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}'

ME:~ sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix)|edu\.mit|org\.(amavis|apache|cups|isc|ntp|postfi x|x)/{print $3}'

Password:

com.adobe.ARMDC.Communicator

com.prey.agent

com.oracle.java.Helper-Tool

com.adobe.fpsaud

com.adobe.ARMDC.SMJobBlessHelper

com.radiosilenceapp.nke.PrivateEye

ME:~ launchctl list | sed 1d | awk '!/0x|com\.apple|edu\.mit|org\.(x|openbsd)/{print $3}'

ws.agile.1PasswordAgent

com.openssh.ssh-agent

com.getdropbox.dropbox.2608

unknown

com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a2 3d420d

com.oracle.java.Java-Updater

com.dropbox.DropboxMacUpdate.agent

ME:~ ls -1A /e*/mach* {,/}L*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/**,P*P,Priv,Qu,Scripti,Servi,Spo,Sta} * L*/Fonts 2> /dev/null

/Library/Components:


/Library/Extensions:

ACS6x.kext

ATTOCelerityFC8.kext

ATTOExpressSASHBA2.kext

ATTOExpressSASRAID2.kext

ArcMSR.kext

CalDigitHDProDrv.kext

HighPointIOP.kext

HighPointRR.kext

PromiseSTEX.kext

SoftRAID.kext

hp_io_enabler_compound.kext


/Library/Frameworks:

AEProfiling.framework

AERegistration.framework

AudioMixEngine.framework

NyxAudioAnalysis.framework

PluginManager.framework

iTunesLibrary.framework


/Library/Input Methods:


/Library/Internet Plug-Ins:

AdobePDFViewer.plugin

AdobePDFViewerNPAPI.plugin

Disabled Plug-Ins

Flash Player.plugin

JavaAppletPlugin.plugin

Quartz Composer.webplugin

flashplayer.xpt


/Library/Keyboard Layouts:


/Library/LaunchAgents:

com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a2 3d420d.plist

com.apple.iCloudSync.plist

com.oracle.java.Java-Updater.plist


/Library/LaunchDaemons:

com.adobe.ARMDC.Communicator.plist

com.adobe.ARMDC.SMJobBlessHelper.plist

com.adobe.fpsaud.plist

com.oracle.java.Helper-Tool.plist

com.prey.agent.plist

com.radiosilenceapp.nke.PrivateEye.plist


/Library/PreferencePanes:

Flash Player.prefPane

JavaControlPanel.prefPane


/Library/PrivilegedHelperTools:

com.adobe.ARMDC.Communicator

com.adobe.ARMDC.SMJobBlessHelper


/Library/QuickLook:

iBooksAuthor.qlgenerator

iWork.qlgenerator


/Library/QuickTime:

AppleIntermediateCodec.component

AppleMPEG2Codec.component


/Library/ScriptingAdditions:

Script32.osax


/Library/Spotlight:

Microsoft Office.mdimporter

iBooksAuthor.mdimporter

iWork.mdimporter


/Library/StartupItems:


/etc/mach_init.d:


/etc/mach_init_per_login_session.d:


/etc/mach_init_per_user.d:


Library/Fonts:


Library/Input Methods:

.localized


Library/Internet Plug-Ins:


Library/Keyboard:

en-dynamic.lm


Library/Keyboard Layouts:


Library/KeyboardServices:

TextReplacements.db

TextReplacements.db-shm

TextReplacements.db-wal


Library/LanguageModeling:

da-dynamic.lm

de-dynamic.lm

en-dynamic.lm

es-dynamic.lm

fi-dynamic.lm

fr-dynamic.lm

it-dynamic.lm

nb-dynamic.lm

nl-dynamic.lm

pl-dynamic.lm

pt-dynamic.lm

sv-dynamic.lm

tr-dynamic.lm


Library/LaunchAgents:

.DS_Store

com.dropbox.DropboxMacUpdate.agent.plist

ws.agile.1PasswordAgent.plist


Library/PreferencePanes:


Library/Services:

ME:~ $ osascript -e 'tell application "System Events" to get name of every login item' 2> /dev/null


Dropbox

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Detect spyware and determine who is spying on my imac

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.