On one of the mac machines I'm somewhat responsible for (Snow Leopard), something periodically changes the default login shell from bash to tcsh.
This seems like it's probably suspicious, but not necessarily so.
Has anyone heard of anything that will transparently do this without notifying the user? Is this a known malware sign?
crontabs and calllaunchctl listto see if there's anything suspicious. – slhck Nov 19 '11 at 9:26