Terminal results finding for keylogger

Question

Level 1

0 points

Terminal results finding for keylogger

Hi! I've been suspecting that my grandparents and dad installed a keylogger on my macbook. So I searched for an answer and found a post about copying and paste codes on terminal. I did it successfully but now I don't know what the results are. 🙂

Here is a copy paste from my terminal.

Last login: Sun Sep 14 19:51:36 on ttys000

Chadymae-Pretty:~ chady$ kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}'

Chadymae-Pretty:~ chady$ sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix)|edu\.mit|org\.(amavis|apache|cups|isc|ntp|postfi x|x)/{print $3}'

PPPMonitord.plist

com.zeobit.MacKeeper.plugin.AntiTheft.daemon

com.vsearch.helper

com.microsoft.office.licensing.helper

com.adobe.fpsaud

Chadymae-Pretty:~ chady$ launchctl list | sed 1d | awk '!/0x|com\.apple|edu\.mit|org\.(x|openbsd)/{print $3}'

com.paragon.ntfs.trial

SwapperUFi.plist

com.vsearch.agent

com.paragon.updater

com.bjango.istatlocal

com.zeobit.MacKeeper.Helper

com.google.keystone.user.agent

com.facebook.videochat.chady.updater

Chadymae-Pretty:~ chady$ ls -1A /e*/mach* {,/}L*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/**,P*P,Priv,Qu,Scripti,Servi,Spo,Sta} * L*/Fonts 2> /dev/null

/Library/Components:

/Library/Extensions:

/Library/Frameworks:

AEProfiling.framework

AERegistration.framework

AudioMixEngine.framework

EWSMac.framework

NyxAudioAnalysis.framework

PluginManager.framework

TSLicense.framework

iLifeFaceRecognition.framework

iLifeKit.framework

iLifePageLayout.framework

iLifeSQLAccess.framework

iLifeSlideshow.framework

iTunesLibrary.framework

/Library/Input Methods:

/Library/Internet Plug-Ins:

Flash Player.plugin

Flip4Mac WMV Plugin.plugin

JavaAppletPlugin.plugin

Quartz Composer.webplugin

QuickTime Plugin.plugin

SharePointBrowserPlugin.plugin

SharePointWebKitPlugin.webplugin

Silverlight.plugin

flashplayer.xpt

iPhotoPhotocast.plugin

nsIQTScriptablePlugin.xpt

/Library/Keyboard Layouts:

/Library/LaunchAgents:

SwapperUFi.plist

com.bjango.istatlocal.plist

com.paragon.updater.plist

com.vsearch.agent.plist

/Library/LaunchDaemons:

PPPMonitord.plist

com.adobe.fpsaud.plist

com.microsoft.office.licensing.helper.plist

com.vsearch.daemon.plist

com.vsearch.helper.plist

com.zeobit.MacKeeper.plugin.AntiTheft.daemon.plist

/Library/PreferencePanes:

Flash Player.prefPane

Flip4Mac WMV.prefPane

MenuMeters.prefPane

NTFSforMacOSX.prefPane

/Library/PrivilegedHelperTools:

com.microsoft.office.licensing.helper

/Library/QuickLook:

GBQLGenerator.qlgenerator

iBooksAuthor.qlgenerator

iWork.qlgenerator

/Library/QuickTime:

AppleIntermediateCodec.component

AppleMPEG2Codec.component

Flip4Mac WMV Advanced.component

Flip4Mac WMV Export.component

Flip4Mac WMV Import.component

/Library/ScriptingAdditions:

Adobe Unit Types.osax

/Library/Spotlight:

GBSpotlightImporter.mdimporter

LogicPro.mdimporter

Microsoft Office.mdimporter

iBooksAuthor.mdimporter

iWork.mdimporter

/Library/StartupItems:

HWNetMgr

HWPortDetect

StartOuc

/etc/mach_init.d:

/etc/mach_init_per_login_session.d:

/etc/mach_init_per_user.d:

Library/Address Book Plug-Ins:

SkypeABDialer.bundle

SkypeABSMS.bundle

Library/Fonts:

28 Days Later 3.ttf

ANGEL___.otf

Always In My Heart.ttf

CRAZK___.TTF

Capture_it.ttf

DINBek-Regular.ttf

DINbek Bold.ttf

DK Crayon Crumble.ttf

Franchise-Bold.ttf

FunkyRundkopfTwoNF.ttf

GREMLINS.TTF

LeafyStencil.ttf

MTF Base Leafy.ttf

Mont Royal.ttf

SCRIPTIN.ttf

SnackerComic_PerosnalUseOnly.ttf

SouthernAire_Personal_Use_Only.ttf

The Sixth Sense.ttf

UnquietSpirits.ttf

batmfa__.ttf

batmfo__.ttf

orange juice 2.0.ttf

peach-sundress.ttf

radio1875_Bold.ttf

spyagency3acad.ttf

Library/Frameworks:

EWSMac.framework

Library/Input Methods:

.localized

Library/Internet Accounts:

V1

Library/Internet Plug-Ins:

ConduitNPAPIPlugin.plugin

FacebookVideoCalling.bundle

LWAPlugin15.8.bundle

Library/Keyboard Layouts:

Library/LaunchAgents:

com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.6F1B4284-3073-4373-867B-FB2 EB51B838A.plist

com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.CC26751B-BEC4-47B7-B8BB-0BF 4AE16DB06.plist

com.facebook.videochat.chady.plist

com.google.keystone.agent.plist

com.zeobit.MacKeeper.Helper.plist

Library/PreferencePanes:

Chadymae-Pretty:~ chady$ osascript -e 'tell application "System Events" to get name of every login item' 2> /dev/null

iTunesHelper, uTorrent

Chadymae-Pretty:~ chady$

Mac Pro, OS X Mountain Lion (10.8.5)

Posted on Sep 14, 2014 5:13 AM

Reply

Answer 1

Linc Davis

Level 10

209,739 points

Sep 14, 2014 7:32 AM in response to ChuddyWagogo

Whether your family members have installed a keylogger on your computer is something you should discuss with them. You have, on the other hand, installed malware and a scam "utility."

A.

You installed the "VSearch" trojan, perhaps under a different name. Remove it as follows.

Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.

Back up all data before proceeding.

Triple-click anywhere in the line below on this page to select it:

/Library/LaunchAgents/com.vsearch.agent.plist

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.

Repeat with each of these lines:

/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist

Restart the computer and empty the Trash. Then delete the following items in the same way:

/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin

Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

From the Safari menu bar, select

Safari ▹ Preferences... ▹ Extensions

Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

Reset the home page and default search engine in all the browsers, if it was changed.

This trojan is distributed on illegal websites that traffic in pirated content. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.

You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that this Internet criminal has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

B.

Remove "MacKeeper" as follows. First, back up all data.

"MacKeeper" is a scam with only one useful feature: it deletes itself.

Note: These instructions apply to the version of the product that I downloaded and tested in early 2012. I can't be sure that they apply to other versions.

If you have incompletely removed MacKeeper—for example, by dragging the application to the Trash and immediately emptying—then you'll have to reinstall it and start over.

IMPORTANT: "MacKeeper" has what the developer calls an “encryption” feature. In my tests, I didn't try to verify what this feature really does. If you used it to “encrypt” any of your files, “decrypt” them before you uninstall, or (preferably) restore the files from backups made before they were “encrypted.” As the developer is not trustworthy, you should assume that the "decrypted" files are corrupt unless proven otherwise.

In the Finder, select

Go ▹ Applications

from the menu bar, or press the key combination shift-command-A. The "MacKeeper" application is in the folder that opens. Quit it if it's running, then drag it to the Trash. You'll be prompted for your login password. Click the Uninstall MacKeeper button in the dialog that appears. All the other functional components of the software will be deleted. Restart the computer and empty the Trash.

☞ Quit MacKeeper before dragging it to the Trash.

☞ Let MacKeeper delete its other components before you empty the Trash.

☞ Don't try to drag the MacKeeper Dock icon to the Trash.

Reply