Spyware, Malware, Hack?

All so-called "anti-virus" and "anti-malware" software is at best useless and should be removed. It's worse than the imaginary "viruses" would be if they really existed, which they don't.

If you suspect for other, legitimate reasons that you've been the victim of a computer crime, and you intend to take legal action, you need the services of an expert in forensic computing.

Hello CreativeLeadership,

I'm skeptical about your anti-virus software. All too often here on Apple Support Communities, I see people who are running anti-virus software while being infected with adware. I would need to see the exact criteria that it uses for "servers known to be associated with malware". Internet servers are bulk commodities and any particular server may host all kinds of services, from government sites to malware. There are an awful lot of scams and an awful lot of misinformation being spread these days.

At this time, the only effective, reliable, and recommended 3rd party security software is MalwareBytes for Mac. It should not be removed.

If you are concerned about what software is running in the background on your machine, I wrote a little diagnostic program to show it to you. Download EtreCheck from http://www.etrecheck.com, run it, and paste the results here. EtreCheck is perfectly safe to run, does not ask for your password to install, and is signed with my Apple Developer ID. it will list all of the software running on your machine, both good and bad. If there is something that might explain connections to "servers known to be associated with malware", it may show it.

Disclaimer: Although EtreCheck is free, there are other links on my site that could give me some form of compensation, financial or otherwise.

Hello again CreativeLeadership,

Little Snitch seems to have a bad reputation here on Apple Support Communities and I think that is undeserved. I used to use Little Snitch years ago but got busy with development activities and beta versions stopped using it. But that was because I was too busy, not because of any fault in Little Snitch. But Little Snitch only monitors outgoing connections - apps "phoning home" so to speak. My official opinion at this point is that it would be very difficult to differentiate legitimate outgoing activity from malicious activity. It is better to just keep your operating system up to date, keep Gatekeeper turned on, and be very cautious whenever software asks for your password. A safe approach is to always refuse to provide your password when first prompted out of the blue. Then investigate the software or feature yourself. If you get a password prompt from an action you initiated on purpose, then it should be OK.

I used to be a government contractor myself. I'm certain that my OPM data was hacked too. But I'm not one of the lucky few who have been notified. Considering that I've moved to Canada since then, I may never be notified. But when I did do government work I had to use Symantec Endpoint Protection on my Mac, which was, at the time, the top-of-the-line corporate version of Norton. I have to say, I was not impressed. Symantec always seemed to lag on supporting Apple's OS versions. While Apple is super-secretive, they do give out advance warnings of new operating system releases (not to mention beta copies for developers). How can Symantec respond to zero-day malware threats when they have such trouble with six-month warnings from the world's biggest corporation?

OS X 10.11 "El Capitan" includes System Integrity Protection. That should prevent many, but not all, executables from being modified. Of course, there are always ways around such things. What exactly was the problem downloading EtreCheck? One of the new features of EtreCheck is that it automatically verifies the digital signatures of any Apple tasks or, more importantly, any task that claims to be an Apple task. As far as I know, EtreCheck is the first app to systematically verify these signatures. I should warn you though that Apple doesn't sign everything and some of the Apple signatures are invalid. By default, EtreCheck hides these failures. EtreCheck is the closest thing available to comparing your system with a "clean" system.

There are some other tools you might find helpful too. You already know about MalwareBytes and hopefully haven't removed it. MalwareBytes was written by a former member of Apple Support Communities who went on to bigger and better things. DetectX (http://sqwarq.com/detectx/), written by another former member of Apple Support Communities, isn't quite as good at adware as MalwareBytes, but it might do a better job of checking for other "grey area" software like scam-ware and key loggers.

The sad thing is that dealing with scammers and hackers online is just part of the new normal for Mac users. We are going to have to get used to it. I am hoping that 3rd party anti-virus and anti-malware tools will improve their Mac products. For years all they did was scan your e-mail for harmless Windows malware. Maybe now that MalwareBytes is doing such a good job, they will step up their game and we can all benefit from honest competition in the anti-malware market.

At this point however, Norton crashing isn't evidence of anything other than a bug in Norton. It is always better to connect to the internet from a hardware NAT (Network address translation) routing device like a WiFi router. But if you are directly connected to the internet, you should expect hacking attempts. As long as you don't have any sharing services turned on, you should be safe. Don't rely on the firewall. It is just a marketing gimmick. By defaults, it allows external connections to sharing services.

Do you know anyone who would find value in the forensic data?

If you're asking for a specific referral, I don't have one. In general terms, a forensic IT expert.

if there is no value in the data, will just wipe the drive.

That's rarely necessary, but it is the only way you can be sure the machine is safe to use. A compromised machine can't be trusted to detect its own compromise, so running any kind of softwarefor that purpose on the suspect machine is obviously pointless. If the software tells you that nothing is wrong, you still don't know. If it tells you something is wrong, the alarm may be false, as in the case of Norton telling you that harmless Windows malware attachments in email are malware infections.

The usual way of being infected with malware is to run unknown applications just because some stranger on a website asks you to.

Hello again CreativeLeadership,

Don't worry about the sound icon. I'm sure that is some random bug in the operating system. That is something else that Mac uses need to get used to. Modern versions of OS X are riddled with bugs.

You have given some hints of things that you think might be hacks, but no real substantive information to go on. Regarding Norton, all I can tell you is that it will protect your computer from literally millions of old Windows malware that was never any threat to your Mac to begin with. I have no idea about whether your router was hacked or not. A log report of "multiple communications from my computer to servers known to be associated with malware" means nothing. What processes were communicating? What servers were they talking to? On what ports? Virtually the entire internet is awash in malware.

There is really very little hacking of personal computers on the internet. What hacking does take place usually works through sharing services (like Back to My Mac or similar) and weak passwords. Very few people have any information of value to sophisticated hackers. If you don't currently employ your own security staff, then you probably aren't one of those people.