If I suspect that someone has installed a keylogger application on my computer, what is the best way to test/find if such an application exists? Also, if I boot my Mac in safe mode, does this mean that a keylogger application would be disabled on startup?

  • 1
    If you seriously think your computer is compromised, it's probably just safer to re-build instead of continuing to use it at all.
    – Iszi
    Sep 28 '11 at 19:35

First, I agree with Iszi in that it would be safest to format the hard disk and re-install OSX. You would want to backup your documents and such first. If you do decide to take that route, have a look at tripwire. That should be installed immediately after you re-install OSX.

Short of that, you can do a couple of things:

  1. Use Little Snitch to detect and prevent any data being sent across the network.
  2. Secure your Mac physically, or take it with you if it is a Macbook to make sure nobody but you has physical access to it.
  3. Look for processes, using Activity Monitor already on your Mac in Applications/Utilities, that look like 'logKext'.
  4. Try this: http://www.chkrootkit.org/
  • Would booting up in safe mode prevent a keylogger from running at startup?
    – Matt
    Oct 6 '11 at 22:38
  • Matt, it depends on the way the alleged keylogger was installed and how it is architected. Booting in safe-mode will likely prevent many types of nasties from being loaded. At that point you could compare the process list to that of a non-safe mode boot. But that still won't guarantee you'll find anything. That's why the safest thing to do is start fresh with a newly formatted system. Short of that you can try safe-mode. Your mileage may vary. Best of luck.
    – Midwire
    Oct 9 '11 at 4:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.