You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Very likely mac has been remotely hacked

Hi there


My Mac has almost certainly been hacked (remotely). I have copied the following from my Terminal. Can anyone who knows about these things see anything that looks a bit odd or like a remote hack? I am aware that Hackers change the names of what they place in, to make it seem more normal. But I haven't installed anything out of the ordinary myself. (Also I don't have a BlackBerry, so not sure what that first thing is about). Thanks so much.


FROM TERMINAL


com.rim.driver.BlackBerryUSBDriverInt(0.0.67)

at.obdev.nke.LittleSnitch(4362)

client-093-003:~ UserName$


com.opendns.OpenDNS_Updater.67872

de.novamedia.VodafoneDeviceObserver

at.obdev.LittleSnitchUIAgent

com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a2 3d420d

com.oracle.java.Java-Updater

net.tunnelblick.tunnelblick.LaunchAtLogin

com.google.keystone.user.agent

client-093-003:~ UserName$


/Library/Components:


/Library/Extensions:

ACS6x.kext

ATTOCelerityFC8.kext

ATTOExpressSASHBA2.kext

ATTOExpressSASRAID2.kext

ArcMSR.kext

BJUSBLoad.kext

CIJUSBLoad.kext

CalDigitHDProDrv.kext

HighPointIOP.kext

HighPointRR.kext

LittleSnitch.kext

PromiseSTEX.kext

SoftRAID.kext


/Library/Frameworks:

AEProfiling.framework

AERegistration.framework

Adobe AIR.framework

AudioMixEngine.framework

NMDeviceObserver.framework

NMGsmKit.framework

NMNetCore.framework

NMNetWorker.framework

NMRegistrationCore.framework

NMStatistics.framework

NyxAudioAnalysis.framework

PluginManager.framework

Python.framework

RIM_VSP.framework

gsm_device_tools.framework

iTunesLibrary.framework


/Library/Input Methods:


/Library/Internet Plug-Ins:

AdobePDFViewer.plugin

AdobePDFViewerNPAPI.plugin

Default Browser.plugin

Disabled Plug-Ins

Flash Player.plugin

JavaAppletPlugin.plugin

Quartz Composer.webplugin

flashplayer.xpt


/Library/LaunchAgents:

at.obdev.LittleSnitchUIAgent.plist

com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a2 3d420d.plist

com.oracle.java.Java-Updater.plist

de.novamedia.VodafoneDeviceObserver.plist


/Library/LaunchDaemons:

at.obdev.littlesnitchd.plist

com.adobe.ARMDC.Communicator.plist

com.adobe.ARMDC.SMJobBlessHelper.plist

com.adobe.fpsaud.plist

com.cyberghostsrl.CyberghostPrivilegedHelper.plist

com.oracle.java.Helper-Tool.plist

net.tunnelblick.tunnelblick.tunnelblickd.plist

org.wireshark.ChmodBPF.plist


/Library/PreferencePanes:

Flash Player.prefPane

JavaControlPanel.prefPane


/Library/PrivilegedHelperTools:

com.adobe.ARMDC.Communicator

com.adobe.ARMDC.SMJobBlessHelper

com.cyberghostsrl.CyberghostPrivilegedHelper


/Library/QuickLook:

iBooksAuthor.qlgenerator

iWork.qlgenerator


/Library/QuickTime:

AppleIntermediateCodec.component

AppleMPEG2Codec.component


/Library/ScriptingAdditions:


/Library/StartupItems:


Library/Address Book Plug-Ins:

SkypeABCaller.bundle

SkypeABChatter.bundle

SkypeABDialer.bundle

SkypeABSMS.bundle


Library/Input Methods:

.localized


Library/Internet Plug-Ins:


Library/LanguageModeling:

da-dynamic.lm

de-dynamic.lm

en-dynamic.lm

es-dynamic.lm

fi-dynamic.lm

fr-dynamic.lm

it-dynamic.lm

nb-dynamic.lm

nl-dynamic.lm

pl-dynamic.lm

pt-dynamic.lm

sv-dynamic.lm

tr-dynamic.lm


Library/LaunchAgents:

com.google.keystone.agent.plist

net.tunnelblick.tunnelblick.LaunchAtLogin.plist


Library/PreferencePanes:

client-093-003:~ UserName$

Library/PreferencePanes:

client-093-003:~ UserName$ ps -cx

PID TTY TIME CMD


PID TTY TIME CMD

247 ?? 0:04.81 UserEventAgent

249 ?? 0:04.24 distnoted

251 ?? 0:05.31 cfprefsd

252 ?? 0:02.58 CommCenter

253 ?? 0:02.23 lsd

255 ?? 0:06.13 Dock

256 ?? 0:07.16 Little Snitch Agent

258 ?? 0:09.41 SystemUIServer

259 ?? 0:08.58 Finder

263 ?? 0:03.59 identityservicesd

264 ?? 0:03.50 secd

266 ?? 0:19.80 CalendarAgent

267 ?? 0:00.44 mapspushd

268 ?? 0:02.10 gamed

269 ?? 0:00.86 cloudphotosd

270 ?? 0:04.19 tccd

273 ?? 0:00.48 secinitd

274 ?? 0:00.70 com.apple.AddressBook.ContactsAccountsService

275 ?? 0:20.51 accountsd

277 ?? 0:04.89 SafariCloudHistoryPushAgent

278 ?? 0:00.23 CallHistorySyncHelper

279 ?? 0:00.29 fmfd

281 ?? 0:03.01 akd

282 ?? 0:00.09 askpermissiond

284 ?? 0:00.77 bird

285 ?? 0:20.72 nsurlstoraged

286 ?? 0:01.81 usernoted

287 ?? 0:01.14 CalNCService

288 ?? 0:20.12 cloudd

289 ?? 0:01.02 nsurlsessiond

290 ?? 0:03.34 suggestd

292 ?? 0:02.22 storeaccountd

297 ?? 0:01.84 callservicesd

298 ?? 0:00.02 pboard

299 ?? 0:07.71 fontd

300 ?? 0:00.36 sharedfilelistd

301 ?? 0:05.88 sharingd

302 ?? 0:02.56 pkd

307 ?? 0:07.73 Spotlight

309 ?? 0:00.37 com.apple.CloudPhotosConfiguration

310 ?? 0:00.32 NML2NDeviceObserver

311 ?? 0:00.10 FolderActionsDispatcher

313 ?? 0:00.02 spindump_agent

315 ?? 0:00.11 SocialPushAgent

317 ?? 0:00.14 Keychain Circle Notification

320 ?? 0:02.25 NotificationCenter

322 ?? 0:00.14 icdd

323 ?? 0:00.23 iconservicesagent

324 ?? 0:00.90 AppleIDAuthAgent

327 ?? 0:00.37 AirPlayUIAgent

328 ?? 0:00.93 imagent

329 ?? 0:03.20 cloudpaird

332 ?? 0:00.91 WiFiAgent

333 ?? 0:00.67 diagnostics_agent

336 ?? 0:01.87 soagent

338 ?? 0:04.33 useractivityd

339 ?? 0:00.31 com.apple.dock.extra

343 ?? 0:00.38 WiFiProxy

348 ?? 0:00.08 iTunesHelper

349 ?? 0:01.89 OpenDNS Updater

352 ?? 0:00.59 IMDPersistenceAgent

354 ?? 0:04.84 storeassetd

366 ?? 0:00.09 CallHistoryPluginHelper

379 ?? 0:00.42 CloudKeychainProxy

380 ?? 0:02.19 com.apple.geod

381 ?? 0:00.38 IMRemoteURLConnectionAgent

384 ?? 0:00.19 IMRemoteURLConnectionAgent

388 ?? 0:06.63 SpotlightNetHelper

391 ?? 0:00.07 pbs

394 ?? 0:02.32 AppleSpell

400 ?? 0:01.39 com.apple.CommerceKit.TransactionService

402 ?? 0:00.15 ContainerMetadataExtractor

411 ?? 0:00.16 com.apple.InputMethodKit.TextReplacementService

412 ?? 0:00.87 photolibraryd

421 ?? 0:00.08 ScopedBookmarkAgent

423 ?? 0:00.05 mdflagwriter

424 ?? 0:00.06 storelegacy

426 ?? 0:00.13 LaterAgent

427 ?? 0:00.09 storedownloadd

436 ?? 0:06.96 com.apple.Safari.SafeBrowsing.Service

446 ?? 0:00.06 com.apple.CommerceKit.TransactionService

447 ?? 0:00.12 com.apple.photomoments

450 ?? 0:00.25 AssetCacheLocatorService

530 ?? 0:00.14 EscrowSecurityAlert

532 ?? 0:01.97 com.apple.sbd

533 ?? 0:00.47 com.apple.lakitu

627 ?? 0:00.04 USBAgent

796 ?? 0:00.53 nbagent

910 ?? 0:00.27 CMFSyncAgent

913 ?? 0:00.18 DataDetectorsDynamicData

915 ?? 0:09.32 recentsd

1028 ?? 0:00.03 com.apple.tonelibraryd

1031 ?? 0:00.04 com.apple.CharacterPicker.FileService

1386 ?? 0:00.48 ViewBridgeAuxiliary

1414 ?? 0:00.32 CoreServicesUIAgent

1471 ?? 0:02.17 com.apple.Safari.History

1474 ?? 0:00.04 com.apple.SafariServices

1476 ?? 0:00.11 com.apple.WebKit.Networking

1748 ?? 0:00.02 DiskUnmountWatcher

2035 ?? 0:00.06 cdpd

2036 ?? 0:00.02 followupd

2038 ?? 0:00.06 com.apple.AddressBook.InternetAccountsBridge

2157 ?? 0:00.02 com.apple.hiservices-xpcservice

2571 ?? 1:19.07 Safari

2572 ?? 0:18.75 com.apple.WebKit.Networking

2600 ?? 0:00.93 com.apple.Safari.SearchHelper

2682 ?? 0:00.05 swcd

2683 ?? 2:30.80 Console

2803 ?? 0:00.11 com.apple.Safari.ImageDecoder

2812 ?? 0:21.87 com.apple.WebKit.WebContent

2818 ?? 0:00.13 com.apple.iCloudHelper

2842 ?? 0:06.54 Terminal

2849 ?? 0:00.06 mdworker

2850 ?? 0:00.07 mdworker

2851 ?? 0:00.07 mdworker

2858 ?? 0:09.62 Notes

2860 ?? 0:00.12 mdworker

2862 ?? 0:00.09 mdworker

2863 ?? 0:00.14 mdworker

2864 ?? 0:00.11 mdworker

2865 ?? 0:00.12 mdworker

2866 ?? 0:00.22 mdworker

2867 ?? 0:00.12 mdworker

2843 ttys000 0:00.11 login

2844 ttys000 0:00.05 -bash

2941 ttys000 0:00.01 ps

client-093-003:~ UserName$


client-093-003:~ UserName$ ps ax

PID TT STAT TIME COMMAND

1 ?? Us 0:26.82 /sbin/launchd

43 ?? Ss 0:05.35 /usr/libexec/UserEventAgent (System)

44 ?? Ss 0:15.09 /usr/sbin/syslogd

46 ?? Ss 0:06.18 /usr/libexec/kextd

47 ?? Ss 0:05.10 /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/FSEvent s

51 ?? Ss 0:06.98 /usr/libexec/configd

52 ?? Ss 0:00.36 /System/Library/CoreServices/appleeventsd --server

53 ?? Ss 0:02.32 /System/Library/CoreServices/powerd.bundle/powerd

60 ?? Ss 0:09.79 /usr/libexec/airportd

62 ?? SNs 0:00.41 /usr/libexec/warmd

63 ?? Us 0:10.15 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework /

67 ?? Ss 0:00.05 /System/Library/CoreServices/iconservicesd

68 ?? Ss 0:00.03 /System/Library/CoreServices/iconservicesagent

69 ?? Ss 0:00.52 /usr/libexec/diskarbitrationd

70 ?? Ss 0:11.66 /Library/Little Snitch/Little Snitch Daemon.bundle/Contents/MacOS/Little Snitch

72 ?? Ss 0:05.98 /usr/libexec/coreduetd

73 ?? Ss 0:00.03 /usr/libexec/wdhelper

75 ?? Ss 0:01.15 /System/Library/CoreServices/backupd.bundle/Contents/Resources/mtmfs --tcp --res

76 ?? Ss 0:08.21 /usr/libexec/opendirectoryd

77 ?? Ss 0:03.38 /usr/sbin/wirelessproxd

79 ?? Ss 0:06.75 /System/Library/PrivateFrameworks/ApplePushService.framework/apsd

80 ?? Us 0:08.54 /System/Library/CoreServices/launchservicesd

81 ?? Ss 0:00.11 /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/Resources/u s

82 ?? Ss 0:07.66 /usr/sbin/securityd -i

84 ?? Ss 0:02.15 /usr/libexec/locationd

86 ?? Ss 0:00.06 /usr/libexec/displaypolicyd

87 ?? Ss 0:13.45 /usr/sbin/blued

88 ?? Ss 0:00.02 autofsd

92 ?? Ss 0:24.04 /usr/sbin/mDNSResponder

94 ?? Ss 0:00.12 /System/Library/PrivateFrameworks/GenerationalStorage.framework/Versions/A/Supp o

95 ?? Ss 0:00.01 /usr/sbin/KernelEventAgent

96 ?? Ss 0:06.74 /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow console

97 ?? Ss 0:00.05 /System/Library/CoreServices/logind

100 ?? Ss 3:26.09 /usr/libexec/hidd

101 ?? Ss 0:01.63 /usr/libexec/AirPlayXPCHelper

102 ?? Ss 0:04.94 /usr/sbin/notifyd

111 ?? Ss 0:00.46 /usr/sbin/distnoted daemon

128 ?? Ss 0:00.13 aslmanager

129 ?? Ss 0:00.53 /usr/libexec/diagnosticd

131 ?? Ss 0:00.31 /usr/libexec/amfid

133 ?? Ss 0:01.13 /usr/libexec/sandboxd

135 ?? Ss 0:03.66 /usr/sbin/cfprefsd daemon

137 ?? Ss 0:00.48 /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/authd.xpc/ C

146 ?? Ss 0:01.29 /System/Library/CoreServices/coreservicesd

155 ?? Ss 0:00.02 /System/Library/Frameworks/PCSC.framework/Versions/A/XPCServices/com.apple.ctkp c

156 ?? Ss 0:00.02 /System/Library/Frameworks/CryptoTokenKit.framework/ctkd -s

159 ?? Ss 0:00.08 /usr/libexec/secinitd

164 ?? Ss 0:02.99 /usr/sbin/coreaudiod

171 ?? Ss 0:00.08 /System/Library/Frameworks/CoreAudio.framework/Versions/A/XPCServices/com.apple .

172 ?? Ss 0:02.23 /usr/libexec/lsd runAsRoot

183 ?? Ss 0:07.72 /usr/libexec/networkd

184 ?? Ss 0:00.58 /usr/libexec/findmydeviced

185 ?? Ss 0:00.07 /usr/libexec/networkd_privileged

187 ?? Ss 0:00.44 /System/Library/PrivateFrameworks/WirelessDiagnostics.framework/Support/awdd

188 ?? Us 13:18.32 /System/Library/Frameworks/ApplicationServices.framework/Frameworks/CoreGraphic s

189 ?? Us 0:00.28 /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/com.apple. C

190 ?? Ss 0:00.02 /System/Library/PrivateFrameworks/FindMyMac.framework/Resources/FindMyMacd

191 ?? Ss 0:00.11 /System/Library/PrivateFrameworks/CoreSymbolication.framework/coresymbolication d

192 ?? Ss 0:00.11 /usr/libexec/diskmanagementd

193 ?? Ss 0:00.01 /usr/libexec/smd

194 ?? Ss 0:00.16 /System/Library/CoreServices/backupd.bundle/Contents/Resources/backupd-helper -l

195 ?? Ss 0:04.63 /System/Library/CoreServices/backupd.bundle/Contents/Resources/mtmd

196 ?? Ss 0:00.07 /usr/libexec/nsurlsessiond --privileged

197 ?? Ss 0:00.17 /usr/libexec/nehelper

198 ?? Ss 0:01.18 /usr/sbin/ntpd -c /private/etc/ntp-restrict.conf -n -g -p /var/run/ntpd.pid -f /

199 ?? Ss 0:00.65 /usr/sbin/cupsd -l

200 ?? Ss 0:00.20 /usr/libexec/corestoraged

202 ?? Ss 0:02.37 /usr/libexec/usbd

204 ?? Ss 0:00.03 /System/Library/CryptoTokenKit/com.apple.ifdreader.slotd/Contents/MacOS/com.app l

205 ?? Ss 0:13.08 /usr/libexec/ApplicationFirewall/socketfilterfw

207 ?? Ss 0:00.04 /usr/libexec/thermald

209 ?? Us 0:11.54 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework /

210 ?? Ss 0:00.25 /System/Library/PrivateFrameworks/AmbientDisplay.framework/Versions/A/XPCServic e

211 ?? Ss 0:11.19 /usr/libexec/symptomsd

218 ?? Ss 0:00.22 /System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd

222 ?? Us 0:00.12 /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/CVMServer

238 ?? Us 0:00.04 /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple .

245 ?? Ss 0:20.06 /usr/libexec/securityd_service

247 ?? S 0:04.91 /usr/libexec/UserEventAgent (Aqua)

249 ?? S 0:04.32 /usr/sbin/distnoted agent

251 ?? S 0:05.36 /usr/sbin/cfprefsd agent

252 ?? S 0:02.61 /System/Library/Frameworks/CoreTelephony.framework/Support/CommCenter

253 ?? S 0:02.88 /usr/libexec/lsd

255 ?? S 0:06.36 /System/Library/CoreServices/Dock.app/Contents/MacOS/Dock

256 ?? S 0:07.27 /Library/Little Snitch/Little Snitch Agent.app/Contents/MacOS/Little Snitch Agen

258 ?? S 0:09.50 /System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer

259 ?? S 0:08.59 /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder

261 ?? Ss 0:00.34 /usr/sbin/WirelessRadioManagerd

263 ?? S 0:03.65 /System/Library/PrivateFrameworks/IDS.framework/identityservicesd.app/Contents/ M

264 ?? S 0:03.53 /usr/libexec/secd

266 ?? S 0:19.81 /System/Library/PrivateFrameworks/CalendarAgent.framework/Executables/CalendarA g

267 ?? S 0:00.45 /System/Library/CoreServices/mapspushd

268 ?? U 0:02.19 /System/Library/PrivateFrameworks/GameCenterFoundation.framework/Versions/A/gam e

269 ?? S 0:00.86 /System/Library/CoreServices/cloudphotosd.app/Contents/MacOS/cloudphotosd

270 ?? U 0:04.47 /System/Library/PrivateFrameworks/TCC.framework/Resources/tccd

273 ?? S 0:00.48 /usr/libexec/secinitd

274 ?? S 0:00.70 /System/Library/Frameworks/AddressBook.framework/Versions/A/XPCServices/com.app l

275 ?? S 0:20.99 /System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd

277 ?? S 0:05.01 /usr/libexec/SafariCloudHistoryPushAgent

278 ?? S 0:00.23 /System/Library/PrivateFrameworks/CallHistory.framework/Support/CallHistorySync H

279 ?? S 0:00.29 /usr/libexec/fmfd

281 ?? S 0:03.10 /System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd

282 ?? S 0:00.09 /System/Library/PrivateFrameworks/AskPermission.framework/Versions/A/Resources/ a

284 ?? S 0:00.84 /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/ b

285 ?? S 0:21.73 /usr/libexec/nsurlstoraged

286 ?? S 0:01.81 /usr/sbin/usernoted

287 ?? Ss 0:01.14 /System/Library/PrivateFrameworks/CalendarAgent.framework/Versions/A/XPCService s

288 ?? S 0:20.79 /System/Library/PrivateFrameworks/CloudKitDaemon.framework/Support/cloudd

289 ?? S 0:01.02 /usr/libexec/nsurlsessiond

290 ?? S 0:03.35 /System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/ s

292 ?? S 0:02.22 /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/st o

295 ?? Ss 0:00.18 /usr/sbin/systemsoundserverd

296 ?? Ss 0:00.05 /System/Library/PrivateFrameworks/TCC.framework/Resources/tccd system

297 ?? S 0:01.84 /System/Library/PrivateFrameworks/TelephonyUtilities.framework/callservicesd

298 ?? S 0:00.02 /usr/sbin/pboard

299 ?? S 0:07.72 /System/Library/Frameworks/ApplicationServices.framework/Frameworks/ATS.framewo r

300 ?? S 0:00.37 /System/Library/CoreServices/sharedfilelistd

301 ?? S 0:06.02 /usr/libexec/sharingd

302 ?? S 0:02.57 /usr/libexec/pkd

307 ?? S 0:08.18 /System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight

308 ?? Ss 0:00.08 /System/Library/CoreServices/sharedfilelistd --enable-legacy-services

309 ?? S 0:00.37 /System/Library/PrivateFrameworks/CloudPhotoServices.framework/Versions/A/Frame w

310 ?? S 0:00.32 /Library/Application Support/Vodafone/NML2NDeviceObserver.app/Contents/MacOS/NML

311 ?? S 0:00.10 /System/Library/CoreServices/FolderActionsDispatcher.app/Contents/MacOS/FolderA c

313 ?? S 0:00.02 /usr/libexec/spindump_agent

315 ?? S 0:00.11 /System/Library/CoreServices/SocialPushAgent.app/Contents/MacOS/SocialPushAgent

317 ?? S 0:00.14 /System/Library/CoreServices/Keychain Circle Notification.app/Contents/MacOS/Key

320 ?? S 0:02.25 /System/Library/CoreServices/NotificationCenter.app/Contents/MacOS/Notification C

322 ?? S 0:00.14 /System/Library/Image Capture/Support/icdd

323 ?? S 0:00.26 /System/Library/CoreServices/iconservicesagent

324 ?? S 0:00.90 /System/Library/CoreServices/AppleIDAuthAgent

327 ?? S 0:00.37 /System/Library/CoreServices/AirPlayUIAgent.app/Contents/MacOS/AirPlayUIAgent --

328 ?? S 0:00.94 /System/Library/PrivateFrameworks/IMCore.framework/imagent.app/Contents/MacOS/i m

329 ?? S 0:03.26 /System/Library/CoreServices/cloudpaird

332 ?? S 0:00.91 /System/Library/CoreServices/WiFiAgent.app/Contents/MacOS/WiFiAgent

333 ?? S 0:00.68 /System/Library/CoreServices/diagnostics_agent

336 ?? S 0:01.87 /System/Library/PrivateFrameworks/MessagesKit.framework/Resources/soagent.app/C o

338 ?? S 0:04.45 /System/Library/PrivateFrameworks/UserActivity.framework/Agents/useractivityd

339 ?? Ss 0:00.31 /System/Library/CoreServices/Dock.app/Contents/XPCServices/com.apple.dock.extra .

341 ?? Ss 0:00.09 /usr/libexec/taskgated -s

343 ?? Ss 0:00.38 /System/Library/PrivateFrameworks/CoreWLANKit.framework/Versions/A/XPCServices/ W

344 ?? Ss 0:00.18 /usr/libexec/watchdogd

348 ?? S 0:00.08 /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app/Contents/MacOS/iTunesH e

349 ?? S 0:01.90 /Applications/OpenDNS Updater.app/Contents/MacOS/OpenDNS Updater

350 ?? Ss 0:00.28 /usr/sbin/filecoordinationd

352 ?? S 0:00.59 /System/Library/PrivateFrameworks/IMDPersistence.framework/XPCServices/IMDPersi s

354 ?? S 0:04.84 /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/st o

366 ?? S 0:00.09 /System/Library/PrivateFrameworks/CallHistory.framework/Support/CallHistoryPlug i

376 ?? Ss 0:00.10 /System/Library/PrivateFrameworks/CacheDelete.framework/deleted

377 ?? Ss 0:00.03 /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd

378 ?? Ss 0:00.05 /System/Library/CoreServices/backupd.bundle/Contents/Resources/TMCacheDelete

379 ?? S 0:00.42 /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychai n

380 ?? S 0:02.19 /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/ c

381 ?? Ss 0:00.39 /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteUR L

384 ?? Ss 0:00.19 /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteUR L

388 ?? S 0:07.04 /System/Library/PrivateFrameworks/ParsecUI.framework/Versions/A/Support/Spotlig h

391 ?? S 0:00.07 /System/Library/CoreServices/pbs

394 ?? S 0:02.81 /System/Library/Services/AppleSpell.service/Contents/MacOS/AppleSpell -psn_0_106

400 ?? Ss 0:01.40 /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/XPCServices/ c

402 ?? Ss 0:00.17 /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/XPCServices/Contain e

409 ?? Ss 0:00.03 /System/Library/CoreServices/CrashReporterSupportHelper server-init

411 ?? S 0:00.16 /System/Library/Frameworks/InputMethodKit.framework/Versions/A/XPCServices/com. a

412 ?? S 0:00.87 /System/Library/PrivateFrameworks/PhotoLibraryPrivate.framework/Versions/A/Supp o

417 ?? Ss 0:03.10 /System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupda

418 ?? Ss 0:00.04 /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Resources/suhelperd

419 ?? Ss 0:30.81 /System/Library/CoreServices/SubmitDiagInfo server-init

421 ?? S 0:00.08 /System/Library/CoreServices/ScopedBookmarkAgent

423 ?? S 0:00.05 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework /

424 ?? S 0:00.06 /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/st o

425 ?? Ss 0:00.03 /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/st o

426 ?? S 0:00.14 /System/Library/PrivateFrameworks/CommerceKit.framework/Resources/LaterAgent.ap p

427 ?? S 0:00.09 /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/st o

433 ?? Us 0:00.07 /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCS e

435 ?? Ss 0:00.54 /usr/sbin/spindump

436 ?? S 0:06.96 /System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari .

446 ?? Ss 0:00.06 /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/XPCServices/ c

447 ?? Ss 0:00.12 /System/Library/PrivateFrameworks/PhotoLibraryPrivate.framework/Versions/A/Fram e

450 ?? S 0:00.25 /System/Library/PrivateFrameworks/AssetCacheServices.framework/XPCServices/Asse t

484 ?? Ss 0:01.10 /usr/libexec/systemstatsd

525 ?? Ss 0:01.48 sysmond

530 ?? S 0:00.14 /System/Library/CoreServices/EscrowSecurityAlert.app/Contents/MacOS/EscrowSecur i

532 ?? S 0:01.97 /System/Library/PrivateFrameworks/CloudServices.framework/Versions/A/XPCService s

533 ?? S 0:00.47 /System/Library/PrivateFrameworks/CloudServices.framework/Versions/A/Frameworks /

627 ?? S 0:00.04 /usr/libexec/USBAgent

728 ?? Ss 0:00.04 /usr/libexec/nsurlstoraged

790 ?? Ss 0:00.07 /usr/libexec/syspolicyd

793 ?? SNs 0:00.01 /usr/libexec/periodic-wrapper daily

794 ?? SNs 0:00.01 /usr/libexec/periodic-wrapper weekly

796 ?? S 0:00.54 /System/Library/PrivateFrameworks/Noticeboard.framework/Versions/A/Resources/nb a

873 ?? S 0:00.01 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework /

910 ?? S 0:00.27 /System/Library/PrivateFrameworks/CommunicationsFilter.framework/CMFSyncAgent.a p

913 ?? S 0:00.18 /System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/XPCSer v

915 ?? S 0:09.32 /System/Library/PrivateFrameworks/CoreRecents.framework/Versions/A/Support/rece n

1028 ?? S 0:00.03 /System/Library/PrivateFrameworks/ToneLibrary.framework/Versions/A/XPCServices/ c

1029 ?? Ss 0:00.01 /System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.S a

1031 ?? S 0:00.04 /System/Library/PrivateFrameworks/CharacterPicker.framework/Versions/A/XPCServi c

1355 ?? Ss 0:01.07 /usr/sbin/ocspd

1386 ?? S 0:00.51 /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/V i

1398 ?? Ss 0:00.03 /System/Library/PrivateFrameworks/SystemAdministration.framework/XPCServices/wr i

1403 ?? Ss 0:00.06 corestoragehelperd

1414 ?? S 0:00.32 /System/Library/CoreServices/CoreServicesUIAgent.app/Contents/MacOS/CoreService s

1421 ?? Ss 0:00.14 /usr/sbin/systemstats --xpc

1471 ?? Ss 0:02.76 /System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices /

1474 ?? Ss 0:00.04 /System/Library/PrivateFrameworks/SafariServices.framework/Versions/A/XPCServic e

1476 ?? Ss 0:00.12 /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.We b

1748 ?? S 0:00.02 /System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher

2035 ?? S 0:00.06 /System/Library/PrivateFrameworks/CoreCDP.framework/Versions/A/Resources/cdpd

2036 ?? S 0:00.02 /System/Library/PrivateFrameworks/CoreFollowUp.framework/Versions/A/Support/fol l

2038 ?? Ss 0:00.06 /System/Library/Frameworks/AddressBook.framework/Versions/A/XPCServices/com.app l

2157 ?? S 0:00.02 /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ H

2445 ?? S 0:00.06 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework /

2565 ?? SNs 0:00.04 /usr/sbin/netbiosd

2571 ?? S 1:28.58 /Applications/Safari.app/Contents/MacOS/Safari

2572 ?? Ss 0:21.46 /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.We b

2600 ?? Ss 0:00.94 /System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices /

2682 ?? S 0:00.05 /usr/libexec/swcd

2683 ?? S 2:30.87 /Applications/Utilities/Console.app/Contents/MacOS/Console

2803 ?? Us 0:00.11 /System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices /

2812 ?? Ss 0:30.74 /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.We b

2842 ?? R 0:10.18 /Applications/Utilities/Terminal.app/Contents/MacOS/Terminal

2849 ?? S 0:00.06 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework /

2850 ?? S 0:00.07 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework /

2851 ?? S 0:00.09 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework /

2858 ?? S 0:20.00 /Applications/Notes.app/Contents/MacOS/Notes

2860 ?? S 0:00.12 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework /

2862 ?? S 0:00.09 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework /

2863 ?? S 0:00.14 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework /

2864 ?? S 0:00.11 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework /

2865 ?? S 0:00.12 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework /

2866 ?? S 0:00.29 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework /

2867 ?? S 0:00.12 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework /

2974 ?? S 0:00.05 /System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Content s

2975 ?? Ss 0:00.03 /System/Library/Frameworks/QuickLook.framework/Versions/A/Resources/quicklookd. a

2977 ?? S 0:02.78 /Applications/Utilities/Activity Monitor.app/Contents/MacOS/Activity Monitor

2843 s000 Ss 0:00.11 login -pf UserName

2844 s000 S 0:00.05 -bash

2990 s000 R+ 0:00.01 ps ax

client-093-003:~ UserName$

Posted on Jun 13, 2016 6:21 PM

Reply
Question marked as Top-ranking reply

Posted on Jun 14, 2016 2:54 AM

It seems that you believe that a third party has had access to your machine, e.g. because you fell for a support scam or ignored basic safe practice and installed malware or let someone untrustworthy have access to your hardware, etc.

If this is the case there is only one choice: you need to make two independent backups and then 'erase and reinstall' your computer from scratch:


How to reinstall OS X on your Mac - Apple Support


Install only applications you need to use your computer and that come either from the Apple App Store or reputable developers' own website. Restore only your data (documents, photos, music, etc.) from your backups not software or system files.


Pursuing any other path will simply waste a lot of your time and you'll never be sure that you found all the malware and backdoors that have been installed.


If you believe that a crime has been committed you should consult a lawyer or the police. In principle, depending on the nature of the intrusion they may want the disk preserved as evidence. In practice they probably won't be interested.


C.

16 replies

Very likely mac has been remotely hacked

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.