Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have enabled hidden files, ran netstat to observe active connections, and I am running Clamxav. Anybody know any other tricks or ideas to find anything hiding? This is a client's machine. It ppears to be fine. Just want to know if anything else I could try.

share|improve this question

Look in the Activity Monitor app, probably in /Applications/Utilities/. Or use top in the Terminal. But if things appear fine, what are you looking for?

share|improve this answer

OS X uses launchd to control system and user services. The launchctl command connects with launchd to inspect and manage daemons, agents and XPC services. See man launchctl and man launchd.

There are places where you can look for suspicious files. Applications install valid services. Malware may have installed a malicious agent or service.

Look for unusual files in these folders, especially ~/Library/LaunchAgents because it's user-writable. ~/Library/LaunchDaemons should not exist. If it's present, it's suspicious.

~/Library/LaunchAgents         User-provided agents
/Library/LaunchAgents          Administrator-provided agents
/Library/LaunchDaemons         Administrator-provided system-wide daemons
/System/Library/LaunchAgents   OS X per-user agents
/System/Library/LaunchDaemons  OS X system-wide daemons

Run launchctl list | sort -k3 and look for unusual items.

Run launchctl print system for a detailed list of agents and services.

The older, legacy method before launchd was cron. Run crontab -l for users and for root. See man crontab and man cron.

$ crontab -l
crontab: no crontab for user
$ sudo su
# crontab -l
crontab: no crontab for root
# exit
share|improve this answer

You must log in to answer this question.

protected by nhinkle Jul 16 '12 at 22:32

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .