Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

A friend is concerned that a keylogger has been installed on their machine, a Mac running MacOS 10.7.

I have the following Terminal output. Do any of you spot any indication of keylogging apps being present?

    Last login: Wed May 15 23:12:43 on console
[NAME OF COMPUTER]-:~ [USERNAME]$ kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}'
[NAME OF COMPUTER]:~ [USERNAME]$ kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}'
[NAME OF COMPUTER]:~ [USERNAME]$ sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix)|edu\.mit|org\.(amavis|apache|cups|isc|ntp|postfix|x)/{print $3}'
Password:
Sorry, try again.
Password:
com.rim.BBDaemon
com.oracle.java.Helper-Tool
com.microsoft.office.licensing.helper
com.google.keystone.daemon
com.fitbit.galileod
com.barebones.authd
com.adobe.fpsaud
[NAME OF COMPUTER]~ [USERNAME]$ ls -1A /e*/mach* {,/}L*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/Bu,P*P,Priv,Qu,Scripti,Servi,Spo,Sta}* L*/Fonts 2> /dev/null
/Library/Components:

/Library/Extensions:

/Library/Frameworks:
AEProfiling.framework
AERegistration.framework
Adobe AIR.framework
AudioMixEngine.framework
NyxAudioAnalysis.framework
PluginManager.framework
RIM_VSP.framework
RimBlackBerryUSB.framework
TSLicense.framework
iLifeFaceRecognition.framework
iLifeKit.framework
iLifePageLayout.framework
iLifeSQLAccess.framework
iLifeSlideshow.framework
iTunesLibrary.framework

/Library/Input Methods:

/Library/Internet Plug-Ins:
AdobePDFViewer.plugin
AdobePDFViewerNPAPI.plugin
Flash Player.plugin
GlancePlugIn.plugin
JavaAppletPlugin.plugin
Quartz Composer.webplugin
QuickTime Plugin.plugin
SharePointBrowserPlugin.plugin
SharePointWebKitPlugin.webplugin
Silverlight.plugin
SnagitSafariScroller.webplugin
flashplayer.xpt
googletalkbrowserplugin.plugin
iPhotoPhotocast.plugin
npgtpo3dautoplugin.plugin
nsIQTScriptablePlugin.xpt
o1dbrowserplugin.plugin

/Library/Keyboard Layouts:

/Library/LaunchAgents:
com.google.keystone.agent.plist
com.oracle.java.Java-Updater.plist
com.rim.BBLaunchAgent.plist

/Library/LaunchDaemons:
com.adobe.fpsaud.plist
com.apple.remotepairtool.plist
com.barebones.authd.plist
com.barebones.bbedit.plist
com.cloudpath.maccmd.plist
com.fitbit.galileod.plist
com.google.keystone.daemon.plist
com.microsoft.office.licensing.helper.plist
com.oracle.java.Helper-Tool.plist
com.rim.BBDaemon.plist

/Library/PreferencePanes:
Flash Player.prefPane
JavaControlPanel.prefPane

/Library/PrivilegedHelperTools:
com.barebones.authd
com.barebones.bbedit
com.cloudpath.maccmd
com.microsoft.office.licensing.helper

/Library/QuickLook:
GBQLGenerator.qlgenerator
iWork.qlgenerator

/Library/QuickTime:
AppleIntermediateCodec.component
AppleMPEG2Codec.component

/Library/ScriptingAdditions:

/Library/Spotlight:
GBSpotlightImporter.mdimporter
LogicPro.mdimporter
Microsoft Office.mdimporter
iWork.mdimporter

/Library/StartupItems:

/etc/mach_init.d:

/etc/mach_init_per_login_session.d:

/etc/mach_init_per_user.d:

Library/Address Book Plug-Ins:
SkypeABDialer.bundle
SkypeABSMS.bundle
YMsgrCallABPlugin.bundle
YMsgrMsnABPlugin.bundle
YMsgrSmsABPlugin.bundle
YMsgrYimABPlugin.bundle

Library/Fonts:
BEBAS___.TTF
Backspacer tribute to Pearl Jam.ttf
Console Input.ttf
Console Output.ttf
Console Relay.ttf
Console.ttf
FoglihtenFr01.otf
Ginga.otf
HEADOH__.TTF
HenryMorganHand 2.ttf
HenryMorganHand 3.ttf
HenryMorganHand.ttf
ONEFS___.TTF
REVOLUTION.ttf
ROUGD___.TTF
SectiI00.ttf
Shardee.ttf
Shit Happens trial d__.otf
Splendid Plan 9 Regular.ttf
The Great Thunder.ttf
WLScribbleFlinger.ttf
big_noodle_titling.ttf
cac_champagne.ttf
cloister_black_bt.ttf
golong.ttf
heavy_dock11.otf
one_fell_swoop
stereo 2.ttf
stereo 3.ttf
stereo.ttf

Library/Frameworks:
EWSMac.framework

Library/Input Methods:
.localized

Library/Internet Plug-Ins:
CitrixOnlineWebDeploymentPlugin.plugin
WebEx64.plugin

Library/Keyboard Layouts:

Library/LaunchAgents:
com.adobe.ARM.202f4087f2bbde52e3ac2df389f53a4f123223c9cc56a8fd83a6f7ae.plist
com.spotify.webhelper.plist

Library/PreferencePanes:
[COMPUTER NAME]:~ [USERNAME]$ 
share

migration rejected from stackoverflow.com May 20 '13 at 13:01

This question came from our site for professional and enthusiast programmers. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as not a real question by Daniel Beck May 20 '13 at 13:01

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.