I think I have a keylogger...

Question

Level 1

10 points

I think I have a keylogger...

So I paid a bill on PayPal last night, and I wake up this morning to 3 unauthorized transfers from my account in the amounts of $10, $39, and $10 (no idea why those amounts, but whatever). I immediately cancelled the transfers and changed my login and password, however now I'm paranoid about logging into things on my computer. So first off, I'm wondering if this is indeed a keylogger or some other type of malware, or if there's another way they could've gotten my information. And, if it is indeed a keylogger, how would I go about removing it? Thanks so much!

Adam

MacBook Pro, OS X Mountain Lion (10.8.3)

Posted on Mar 28, 2013 12:00 AM

Reply

Answer 1

Best reply

pennbank

Level 4

1,688 points

Mar 28, 2013 12:21 AM in response to Adam Liss

Have you read this

https://discussions.apple.com/thread/3726952?answerId=17561183022#17561183022

Free anti virus for mac

Sophos

http://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-mac-home-ed ition.aspx

also Clam XAV free from apple store

Reply

Answer 2

pennbank

Level 4

1,688 points

Mar 28, 2013 12:25 AM in response to pennbank

also read

https://discussions.apple.com/thread/4243511?start=0&tstart=0

Reply

Answer 3

MadMacs0

Level 5

5,221 points

Mar 28, 2013 7:15 AM in response to Adam Liss

The only way a KeyLogger could have been installed on your computer is if somebody had physical access to it or your local network. There is currently no known malware capable of doing that with your OS.

Most A-V software won't detect the presence of KeyLoggers since they are almost all commercial or hack software that are used for legitimate purposes. The one exception is MacScan from SecureMac, but it's not very good at detecting most malware and has a tendancy for False Positives, so be certain that anything it identifies is actually what it says it is and not something you need before removing it.

Reply

Answer 4

John Galt

Level 10

140,942 points

Mar 28, 2013 9:34 AM in response to Adam Liss

In addition to your PayPal password, consider changing

your wireless network password
your router password (different than your wireless network - used to change its configuration. Most of them use simple default passwords)
All Mac user account passwords, and those of any other computers you may use

Don't save your PayPal password on your computer. If PayPal's site allows autofill don't use it.

If you haven't already, alert PayPal about the fraudulent charges. You should not be responsible for them.

It is possible your PayPal password was lifted from some other site, so if you use that same password elsewhere change it there as well.

Reply

Answer 5

Adam Liss Author

Level 1

10 points

Mar 28, 2013 4:08 PM in response to pennbank

If I posted that log, would someone be willing to look it over? Or is there any way I could find a list of programs to look for?

Reply

Answer 6

Adam Liss Author

Level 1

10 points

Mar 28, 2013 4:12 PM in response to John Galt

Thanks, that's great advice.

Reply

Answer 7

MadMacs0

Level 5

5,221 points

Mar 28, 2013 4:52 PM in response to Adam Liss

Adam Liss wrote:

If I posted that log, would someone be willing to look it over?

Not certain what log you are referring to. The problem was found using Linc Davis' diagnostic Terminal commands. In any case, feel free to post anything you want as long as it meets Apple's TOS and be cautious not to post personal info (such as an e-mail address).

Or is there any way I could find a list of programs to look for?

You will find it at the link I previously gave you, but here is a direct link to their Spyware List. I'm sure it's incomplete, but better than any other I've run across.

Reply