How to remove rootkits and malware?

Sorry, I must have misinterpreted what you said; I had the impression that your families were acquainted. You still have the option of warning her off with a "cease and desist unless you'd like the embarassment of a police visit".

And yes, it does sound like you meet the wrong kind of women. I can't say I've noticed any general inclinations of this sort among women in general...

And I am shocked myself that you use phases like "world-class hacking", when literally anybody can download software which enables them to install keyloggers and remotely spy on people.

But not automatically and without any action on the part of the computer's owner. Not even on modern versions of Windows 8 (unless poorly configured). And not on any up to date version of OS X, iOS, most Unix versions and many Linux versions (again, only ones with poor default configurations). Further, while Windows might be poorly configured out of the box, the default configuration for OS X is pretty secure.

In any case, good luck.

No doubt. And how much of her behaviour (with people in general, not even just you) is enabled by everyone around her being too genteel to want to cause her aprents any embarassment?

I'm a Professional Engineer (a Chartered Engineer, as I'm guessing you're in the UK). Both my wife and I are well-educated professionals. I can tell you that if this were my daughter, I'd want the embarassing police visit. And my daughter, Cambridge educated twenty-something or not, would be having a very unpleasant day afterwards.

But then again, I'm Canadian; maybe I'm just not that refined. You're the one that has to deal with your particular situation and the consequences of whatever choices you make.

Again, good luck.

Minty18522 wrote:

Are you totally sure that just opening the emails won't give any malware access to my machines?

On a Mac or iPhone, I am totally sure. It seems reasonable to me that if someone were to spend a great deal of time and money they could write a complex javascript that would be rendered by a Mail client or webmail browser and interact with OS X API's to do something. There have certainly been such attacks on the Windows side of the house (perhaps Android and RIM, but I don't track those). But to date there have not been any reports of even a proof-of-concept malformed javascript for e-mail. There are currently 285 JS (javascript) malware definitions in the ClamAV® database and none show as OSX. I'm sure the majority of those are for websites, but there are a couple that could be mail related.

Minty18522 wrote:

there is no other way I can think of she could have remotely accessed the machines

So you had your Firewall turned on, all sharing options disabled, require a password to log into your user account and wake from screensaver or sleep?

Minty18522 wrote:

The, what I think, contiminated emails were lying open in my inbox for sometime - ClamXav usually flags those up, so they can't be totally harmless.

Yes, most often they are exactly harmless. Without knowing the infection names, I can't really tell you, but most of the ones we see are either possible phishing attempts where you would have to click a link and enter privacy information to cause any harm or Windows malware attachments. There are only a couple that are attachments which take advantage of a Microsoft Word 2004 / 2008 for Mac vulnerability that was patched several years ago. Those are being targeted against some very small groups (e.g. Tibetan sympathizers). [I spend a good part of my time doing uncompensated tech support in the ClamXav Forum.]

You say remotely installing malware, like keyloggers and rootkits is difficult.

But I have actually had another girl who did this as well in the past

No, I'm sure that was probably another case of someone using your online accounts to make you believe she has access to more than she really does. There's just no chance that two different girls of the nature you have described could have done a little Googling and figured out how to do what you say they did.

If you don't believe me, let me ask you this: are you as smart as these two girls? I would guess so, from the way you have characterized them. In that case, give it a try yourself. See if you can figure out a way to do this, and try to actually do it. (To yourself, mind you... you really don't want to tread in federal crime territory by doing this to someone else.)

I will guarantee you that you won't be able to do so, at least not on Mac OS X or iOS. (With Android and older versions of Windows, I would make no such guarantees.)

Are you totally sure that just opening the emails won't give any malware access to my machines? Because I have seen forums where wannabe hackers have requested advice on how to remotely put spyware on people's machines via just emails without links and attachments

I am absolutely, 100% sure. It's always possible such a vulnerability could be discovered at some point in the future, but if one is known right now, it's known only in the darkest, most secretive corners of the hacking underworld, where professional security researchers haven't found signs of it.

Keep in mind, these are "wannabe" hackers you're talking about here. There are countless numbers of what the security community refers to as "script kiddies" out there who like to run their mouths and make wild claims of what they are able to do.

But in my experience, it is silly little girls who sit doing this kind of thing - perhaps not on multiple devices like you say, but certainly on just one at a time; and that it doesn't seem particularly difficult.

Again, if it's so easy that "silly little girls" can do this, try it for yourself. And keep in mind that there's an entire white hat hacker community out there, full of very knowledgeable and experience people, who devote large amounts of time to finding and drawing attention to vulnerabilities that allow this sort of thing. Many companies these days even pay out "bug bounties" to people who report major vulnerabilities directly to them. There are also those in the hacker community who would love nothing more than to give Apple a black eye by publicly reporting such a vulnerability. If these people can't find such vulnerabilities, what sense does it make to assume two "silly girls" can spend an hour or two on Google and figure it out?

At this point, everything you have provided details about boils down to either something that could be accessed trivially by someone having access to one of your online accounts or glitches on the computer (crashing apps and disappearing icons). Nothing you have mentioned shows any indication that all your devices have been hacked.

Unfortunately, I can't think of anything more I can say to sway you to my point of view. So, I think at this point I'll sign off. My last recommendation: I strongly recommend trying to do some of these things yourself and see how far you get. After all, if a couple "silly girls" an do it, shouldn't you be able to?

In reality of course, there is no such thing as total internet privacy: US and British intelligence agencies have successfully cracked much of the online encryption relied upon by hundreds of millions of people to protect the privacy of their personal data, online transactions and emails:

http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security