I think I have a keylogger help me.

Question

Level 1

0 points

I think I have a keylogger help me.

Hello my computer changes things whilst im away from it, also clicks and opens things, changes settings, i have a feeling someone has come and put a keylogger virus on it or something, i downloaded etrecheck and here is the report i got after running it:

Hardware Information:

MacBook Pro (13-inch, Mid 2009)

MacBook Pro - model: MacBookPro5,5

1 2.26 GHz Intel Core 2 Duo CPU: 2 cores

2 GB RAM

Video Information:

NVIDIA GeForce 9400M - VRAM: 256 MB

System Software:

Mac OS X 10.6.8 (10K549) - Uptime: 24 days 22:59:56

Disk Information:

ST9160314ASG disk0 : (149.05 GB)

(null) (disk0s1) <not mounted>: 200 MB

Macintosh HD (disk0s2) /: 148.73 GB (81.81 GB free)

HL-DT-ST DVDRW
GS23N

USB Information:

Apple Inc. Built-in iSight

Apple Inc. iPhone

Apple Internal Memory Card Reader

Apple Inc. BRCM2046 Hub

Apple Inc. Bluetooth USB Host Controller

Apple Inc. Apple Internal Keyboard / Trackpad

Apple Computer, Inc. IR Receiver

FireWire Information:

Thunderbolt Information:

Kernel Extensions:

com.sophos.kext.sav (8.0.14)

Problem System Launch Daemons:

[failed] com.apple.suhelperd.plist

[not loaded] org.samba.winbindd.plist

Problem System Launch Agents:

[failed] com.apple.Kerberos.renew.plist

Launch Daemons:

[loaded] com.adobe.fpsaud.plist

[loaded] com.sophos.autoupdate.plist

[loaded] com.sophos.intercheck.plist

[loaded] com.sophos.notification.plist

[loaded] com.zeobit.MacKeeper.plugin.AntiTheft.daemon.plist

Launch Agents:

[not loaded] com.adobe.AAM.Updater-1.0.plist

[loaded] com.adobe.CS4ServiceManager.plist

[failed] com.wacom.pentablet.plist

User Launch Agents:

[loaded] com.adobe.AAM.Updater-1.0.plist

[loaded] com.facebook.videochat.****

[failed] com.veoh.webplayer.startup.plist

[failed] com.zeobit.MacKeeper.Helper.plist

User Login Items:

GrowlHelperApp

iTunesHelper

Dropbox

uTorrent

SophosUIServer

3rd Party Preference Panes:

AppTrap

PenTablet

DivX

Flash Player

Growl

Internet Plug-ins:

AdobePDFViewer.plugin

AdobePDFViewerNPAPI.plugin

DirectorShockwave.plugin

DivXBrowserPlugin.plugin

Flash Player.plugin

FlashPlayer-10.6.plugin

iPhotoPhotocast.plugin

JavaAppletPlugin.plugin

QuickTime Plugin.plugin

WacomNetscape.plugin

WacomSafari.plugin

User Internet Plug-ins:

Bad Fonts:

None

Time Machine:

Cannot find /usr/bin/tmutil

Top Processes by CPU:

14% firefox

9% iTunes

7% plugin-container

5% EtreCheck

3% syslogd

2% WindowServer

1% hidd

1% activitymonitord

1% InterCheck

1% ps

Top Processes by Memory:

266 MB
firefox

129 MB
InterCheck

98 MB iTunes

74 MB plugin-container

53 MB WindowServer

47 MB Finder

39 MB mds

23 MB Activity Monitor

20 MB DashboardClient

18 MB SystemUIServer

Virtual Memory Statistics:

28 MB Free RAM

1013 MB
Active RAM

483 MB
Inactive RAM

268 MB
Wired RAM

6.26 GB
Page-ins

4.23 GB
Page-outs

Mac OS X (10.6.8)

Posted on Nov 4, 2013 2:25 AM

Reply

Answer 1

thomas_r.

Level 7

32,031 points

Nov 4, 2013 3:12 AM in response to ptwiggy

The most concerning thing here is that you have MacKeeper installed. That's garbage software that should be removed. Drag the app to the trash, which should cause it to ask you if you want to uninstall it.

Unless I'm not understanding your problem, though, MacKeeper isn't causing it. Neither is Sophos, which I suspect some of the folks here who are hostile to the very notion of anti-virus software will tell you to also remove.

You said:

my computer changes things whilst im away from it, also clicks and opens things, changes settings

I'm assuming that you're saying the mouse is moving and clicking by itself, correct? If so, see:

My mouse keeps moving around on its own, as if someone is remotely controlling my Mac!

This is almost certainly not any kind of malware... it is certainly not the behavior of a keylogger.

If that's not what is going on, can you clarify?

Reply

Answer 2

Kurt Lang

Level 9

68,448 points

Nov 4, 2013 5:52 AM in response to ptwiggy

In addition to Thomas' excellent suggestions (and his resource page), open the System Preferences and click on the Sharing icon. Make sure all check boxes are off.

Reply