help me catch my hacker...please!

Question

Level 1

8 points

help me catch my hacker...please!

Hi. I have an old Mac Pro 1,1 (2007 I believe), OSX 10.7.5 that has been hacked. I have read some of the questions here so I'll try to include all the necessary info. some of the things that have happened are that a new admin user account is on my computer where I have never created any other account and was using my admin account solely which I now know is not smart. I see the new account at the login screen although it tries to look like it is my account, same icon, but it thankfully can't shut down or restart the computer. I am the sole user of my computer and no one else has access to it physically. also, I can no longer throw anything into the trash. Everything just gets moved somewhere as I can see this from the dialog box that pops up. Also, I have to enter a password just to throw anything away(!), but the trash bin always remains empty so nothing ever makes it there but is obviously going elsewhere. The other thing is all my files are now locked and password protected which of course I didn't do. So, hopefully this all shows my computer has indeed been hacked. In fact, I do know who has done this and he's hacked my iphone as well. He currently lives in another country and when I did wipe my phone and enable location services I started getting ads for the nearest major city of that country where he lives and he is the only person I know who lives in that country. I have other info too as to how I know who it is but won't go into it here. He is some guy I used to know who somehow thinks I'm responsible for him losing his job which is completely preposterous. I know he's gone after my finances but thus far has not been able to access them. My email, which I never check on my home computer or phone anymore, will even on my home computer keep trying to connect to paypal. When I've logged into AppleID on my phone to download apps he has changed my AppleID password & security questions but I was fortunately able to change it and get back into it. He put security questions I would never use like asking something about dates and I never remember dates.

Anyway, I really need to catch this guy as I have info that he has done this to others as well. I know I could just wipe my machine but that is not something I want to do. While my mac tech guy is normally great he doesn't even believe a mac can have a virus and wants to debate that so for him to believe my computer could have been hacked is impossible so he wouldn't help me. 😟 I have contacted a couple other techs I know but one was PC-oriented and the other who does some work on macs said he didn't have enough mac experience when I told him the litany of things happening on my computer and phone. So, I am turning to the good people of this forum to help me do this myself as I know you guys are great from past experience with minor computer issues.

What I've done so far, mostly from reading these forums: I ran EtreCheck and the only thing that came up looking off was a version of Adobe Flash Player I downloaded that EtreCheck says was a mismatch in their red type. I believe that is how the hacker got his software on my computer. I made visible all the users/accounts and nothing looked funny but a lot of this stuff is greek to me as I have never used the Terminal before. I did find a root user and so disabled that. I have looked through all the Processes, and ran that 5-step terminal thing you guys recommend here that shows preferences & launch agents, etc. and looked and looked but see nothing off. I unfortunately had my computer rather wide open before and so now have done all the normal user things to tighten my security and have Little Snitch and Avast Security on my computer. Oh, I did find the Genio-L bug through MacScan and deleted that. My computer had been running at a crawl but is now faster. Also, I had read something about hackers getting access through Bluetooth and saw besides my keyboard and mouse (my modem is wired so I don't have WiFi) some third item listed. I deleted it as it looked suspicious with very little info on it compared to my other devices. (I forgot to take a screenshot of it.) I have also made all files visible through the Terminal. I was looking around in the Private/Etc files but I don't really know what i'm looking at. Also, I found 3 applications that were loading automatically on login so I deleted them: Adobe Resource Synchronizer, Optimism Agent (Optimism software I have) and FontExplorer.

Anyway, I would love recommendations for how to find this hacking software which I'm assuming can be found through the Terminal. I did try to use Deeper but when I tried to get it to show all the IP addresses for the users on the login page it had an applescript error come up. It said:

FSPathMakeRef (/System/Library/CoreServices/HelpViewer.app) failed with error -43. (1)

i'm sure this guy probably has some pretty sophisticated hacking software, which I understand can even be parental control software. I have reason to believe he has put a keylogger on my computer. So, if there is a way to catch this guy please, please give me some tips but do explain everything really simply & step by step as I know nothing about using the Terminal despite the few things I've done. I was reading under the ssh and it says something about -x being used to disable keyloggers from forwarding info. I do seem to have the applicaton X11 on my computer which I never noticed before. There was also something under ssh about ~# which can list all forwarded connections. Of course I don't know how or where to do these things but if you guys think it would help then I'd totally appreciate directions on how to do these things.

Sorry for writing an essay but I may not be able to get back to this computer for 3-4 days so wanted to give plenty of info for the questions you guys usually ask. Thanks in advance for any and all help!

Mac Pro, Mac OS X (10.6.8)

Posted on Mar 19, 2015 6:41 PM

Reply

Answer 1

Best reply

Eric Root

Level 10

684,051 points

Mar 20, 2015 7:04 AM in response to reflectionlj

If you have been hacked, the best thing to do is boot off the DVD, run Disk Utility Verify/Repair and Repair Permissions until you get no errors. Reformat the drive using Disk Utility/Erase Mac OS Extended (Journaled), then click the Option button and select GUID. Then re-install the OS. Then restore your data from a backup made prior to being hacked.

Reply

Answer 2

Kurt Lang

Level 9

58,308 points

Mar 20, 2015 7:11 AM in response to reflectionlj

i'm sure this guy probably has some pretty sophisticated hacking software

It doesn't need to be sophisticated at all. There are only two ways someone else could do some of the things you list:

1) A person had direct access to your Mac and made these changes at the time, or installed remote access software to perform the changes later.

2) Various sharing options are on in the System Preferences, which would allow those who know where to look the ability to remotely control your computer.

So first, open the System Preferences and click on the Sharing icon. Turn off any check boxes that may be on. If those aren't on, then remote access software may have been installed by this person before they left.

As far as the trash, that's likely just a corrupt trash folder for your account. The files you put it in aren't going anywhere else. They're being deleted immediately with no confirmation. The startup items were normal for various software you are using. All you've done is broken their ability to function correctly.

NOT a good idea to go poking around the system with all files showing. There are thousands of files and folder in Unix that mean nothing to the general user. If you don't know what it is, don't touch it.

You're also making a LOT of assumptions. That EtreCheck noted the Flash Player in red had absolutely nothing to do with being hacked or anything else nefarious. It was simply noting it was out of date. As in, a newer version is available and should be installed.

If you want to get your Mac back to a fully safe state, given you don't know what this person may have done, backup your personal and important data, then erase the drive and reinstall the OS and your apps from scratch. DO NOT do a restore of a full backup as that would just bring back potential malware. Then manually bring back in your personal data. By default all, sharing is off, so you won't need to check that.

Reply

Answer 3

reflectionlj Author

Level 1

8 points

Mar 23, 2015 6:27 PM in response to Eric Root

thanks to both of you for the responses! I will do this disk utility verify and repair permissions until it is clean. I still don't want to have to wipe my hard drive but I will if I absolutely have to. so, if I use time machine files from before the hacking then I should be okay? I think that is what you are saying. I will bring in all those files manually.

Reply

Answer 4

reflectionlj Author

Level 1

8 points

Mar 23, 2015 6:37 PM in response to Kurt Lang

thanks for your response. my computer was unfortunately not very protected prior to this happening and I didn't even have my firewall on. none of my sharing settings are on and I believe they got in through remote access. i have made sure those settings are off as are remote access and automatic login. are there other things I can do to make sure this doesn't happen again? firewall is on, remote login & access are off, sharing is off.

Reply

Answer 5

reflectionlj Author

Level 1

8 points

Mar 23, 2015 6:40 PM in response to reflectionlj

so, how do I get rid of this second admin account? it doesn't show up in the users & accounts preferences window but it is there every time my computer goes to sleep when I wake my computer. I am logged out of my real account and the window that is displayed for me to log back into is not my account. the account that shows up looks like my account but it shows the switch user button down at the bottom of the screen and it does not show the ability to restart or shutdown or sleep. when I click switch user I am taken to my real admin account. I did print out the admin.plist and two listings show up. the first listing is probably mine and the second under modDate is the exact date when these problems started. they both say something about serialNumber. is that something I can use to find this second admin account? or, is there another way to make this account show up separately in my users & accounts preferences so I can delete it? or thru the terminal? again, thanks for any and all help. 🙂

Reply

Answer 6

Eric Root

Level 10

684,051 points

Mar 24, 2015 6:51 AM in response to reflectionlj

You are welcome. Use your files from before the hacking. The second admin account should disappear when you erase the disk.

Reply

Answer 7

reflectionlj Author

Level 1

8 points

Mar 24, 2015 6:34 PM in response to Eric Root

I went ahead and repaired the permissions and the disk itself didn't need any repairs. I still really don't want to wipe my HD, and haven't yet, because I want to catch this guy. can you guys give me a code to enter into the Terminal to show all hidden admin users? I tried something I found on these forums to unhide all 500users but i'm not sure if it was for Lion. (btw, the descriptions for this forum are off. i have a silver tower, it's definitely a mac pro 1,1 and am running Lion 10.7.5) anyway, the terminal said in response:

sudo: /private/etc/sudoers is mode 0446, should be 0440.

this response was before I repaired the permissions.

to address Kurt's question of why i'm convinced I have a hacker I didn't share everything in my OP partly because it was already so long and party because some info I don't feel comfortable sharing online. suffice it to say I have solid knowledge that I've been hacked. I was 99.9% sure of who it was and when the location-based ad on my iphone came up for the country this person currently lives in I knew I was right. think of it like this, if you knew one person who lived in Latvia and suspected he was for sure the person who hacked your computer/phone because you know he's done it to others you know, and suddenly your phone in the US starts getting ads for the nearest major city to where the person lives in Latvia, right after you enabled location-based ads, you'd be pretty sure you suspect the right person. as to how I know this is for sure a hacking I am not comfortable going into on a public forum. suffice it to say, I know without a shadow of a doubt. obviously, the fact that I have an additional admin account on my computer when I live alone and no one, and I mean no one, has physical access to my computer is quite a good indicator.

just earlier today I had additional problems on my iphone 4. (in the last week I've reset the settings several times whenever I have like one or two bars for my connection which is definitely not normal. resetting the settings seems to be really helping the connection.) this morning I was reading on safari (on the NPR site) and suddenly my phone goes black and the same screen I see when my phone is resetting shows up (all-black screen with white horizontal progress bar). something was being reset so I immediately tried to turn off the phone and it wouldn't turn off, but it did not let the progress bar continue with whatever was happening as long as I held the power button down. then after awhile of doing this, the screen suddenly went back to my usual NPR page. I immediately turned off my phone and will reset it when I turn it back on.

so, my question is how protect my phone? I have erased it previously, but don't want to do that again as I can't risk logging into Apple ID on it again, to download apps, as last time I did that my Apple ID password & security question as got changed and I had a hard time getting back into it. what I have done so far is to use a password, set a restrictions password and I have turned off most locations settings and limited ad tracking. when this all started awhile ago the app I use the most, a newspaper, suddenly popped up with a survey that it tried to force me to click on and take. there was no option not to take the survey and the website address it showed ended in .xyz as if that is a real legitimate site. what I did was close the app and delete it as I knew this had nothing to do with this major newspaper app. it was directly after that that the location-based ad in this guy's country started coming up. so, how the heck can I keep this guy off my phone now? I still want to catch him and am hoping I can somehow do that either on my computer or phone. no one should be allowed to do this to another person. it's been a nightmare. again thanks for any and all help.

Reply

Answer 8

Kurt Lang

Level 9

58,308 points

Mar 25, 2015 6:55 AM in response to reflectionlj

So erase the drive and reinstall everything from scratch. Then manually copy your data files back onto the main drive from a backup. It's the sure way of cleaning up any system.

Reply

Answer 9

Oct 3, 2015 2:58 PM in response to reflectionlj

So, there are 2 ways that I can think of that can 99% be useful

1. Go to a apple store, contact the genius bar(bring your mac!) and explain the problem, I bet they will work it out, but I do think that they can catch the hacker.

2. This way is a bit more less effective, it's more of a DIY thing. Just reset your computer using a cable mouse.

Have the best luck!

TheMegaWan

Reply

Answer 10

Kurt Lang

Level 9

58,308 points

Oct 3, 2015 3:20 PM in response to TheMegaWan

For number 2. I'm certain a cable elephant works much better.

Reply