up vote 2 down vote favorite
share [g+] share [fb]

If I suspect that someone has installed a keylogger application on my computer, what is the best way to test/find if such an application exists? Also, if I boot my Mac in safe mode, does this mean that a keylogger application would be disabled on startup?

link|improve this question
75% accept rate
1  
If you seriously think your computer is compromised, it's probably just safer to re-build instead of continuing to use it at all. – Iszi Rory or Isznti Sep 28 '11 at 19:35
feedback

1 Answer

up vote 1 down vote accepted

First, I agree with Iszi in that it would be safest to format the hard disk and re-install OSX. You would want to backup your documents and such first. If you do decide to take that route, have a look at tripwire. That should be installed immediately after you re-install OSX.

Short of that, you can do a couple of things:

  1. Use Little Snitch to detect and prevent any data being sent across the network.
  2. Secure your Mac physically, or take it with you if it is a Macbook to make sure nobody but you has physical access to it.
  3. Look for processes, using Activity Monitor already on your Mac in Applications/Utilities, that look like 'logKext'.
  4. Try this: http://www.chkrootkit.org/
link|improve this answer
Would booting up in safe mode prevent a keylogger from running at startup? – Matt Oct 6 '11 at 22:38
Matt, it depends on the way the alleged keylogger was installed and how it is architected. Booting in safe-mode will likely prevent many types of nasties from being loaded. At that point you could compare the process list to that of a non-safe mode boot. But that still won't guarantee you'll find anything. That's why the safest thing to do is start fresh with a newly formatted system. Short of that you can try safe-mode. Your mileage may vary. Best of luck. – Midwire Oct 9 '11 at 4:19
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.