Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite

If I suspect that someone has installed a keylogger application on my computer, what is the best way to test/find if such an application exists? Also, if I boot my Mac in safe mode, does this mean that a keylogger application would be disabled on startup?

share|improve this question
1  
If you seriously think your computer is compromised, it's probably just safer to re-build instead of continuing to use it at all. – Iszi Sep 28 '11 at 19:35

1 Answer

up vote 1 down vote accepted

First, I agree with Iszi in that it would be safest to format the hard disk and re-install OSX. You would want to backup your documents and such first. If you do decide to take that route, have a look at tripwire. That should be installed immediately after you re-install OSX.

Short of that, you can do a couple of things:

  1. Use Little Snitch to detect and prevent any data being sent across the network.
  2. Secure your Mac physically, or take it with you if it is a Macbook to make sure nobody but you has physical access to it.
  3. Look for processes, using Activity Monitor already on your Mac in Applications/Utilities, that look like 'logKext'.
  4. Try this: http://www.chkrootkit.org/
share|improve this answer
Would booting up in safe mode prevent a keylogger from running at startup? – Matt Oct 6 '11 at 22:38
Matt, it depends on the way the alleged keylogger was installed and how it is architected. Booting in safe-mode will likely prevent many types of nasties from being loaded. At that point you could compare the process list to that of a non-safe mode boot. But that still won't guarantee you'll find anything. That's why the safest thing to do is start fresh with a newly formatted system. Short of that you can try safe-mode. Your mileage may vary. Best of luck. – Midwire Oct 9 '11 at 4:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.