Comments on: How to detect sneaky installs on a Mac

Question: How to detect sneaky installs on a Mac

Anonymous — Sun, 26 Aug 2007 18:40:14 -0800

Is there any way for me to tell if someone has installed software on my Macbook, like a keyboard logger, without my knowledge? I'm a bit of a Mac newbie, and I'm pretty sure my roomie is looking at my email to see if I've been corresponding with his ex-girlfriend (which I have NOT been doing, for what it's worth).

By: The Deej

The Deej — Sun, 26 Aug 2007 18:51:59 -0800

Here's a review of MacScan, which the reviewer says is available as "try before you buy."

I haven't used it, but it may be worth a shot.

Your roommate uses your computer? You might have to just say no.

By: melorama

melorama — Sun, 26 Aug 2007 18:54:09 -0800

one specific thing you can look for:

Boot up your mac in verbose mode by holding down command+v after the bootup chime.

If you see an item scroll by that says "logKext" in it, then you have yourself a keylogger

By: sneakin

sneakin — Sun, 26 Aug 2007 18:54:49 -0800

...Or make him his own guest account where he can't access your shits.

By: melorama

melorama — Sun, 26 Aug 2007 19:06:04 -0800

a few other question i have:

When you start up your mac, does it automatically log you in to your desktop? If so, thats a huge problem, especially if your account has admin privledges. Even if it didnt, your roommate can still boot your system in single user mode and pretty much do anything they want.

I would STRONGLY suggest that you enable the Open Firmware password on your system. That way you are required to enter a password just to boot the system (regardless of what OS you have installed on it.

By: birdsquared

birdsquared — Sun, 26 Aug 2007 19:15:26 -0800

First, there's this web page, second, these lists, lists2(not likely comprehensive), and finally, what you want to do is run Activity Monitor, and see if you recognize a keylogger name in the list of processes.

By: bshort

bshort — Sun, 26 Aug 2007 19:22:15 -0800

I'm pretty sure that even if you have your Mac automatically log in when you reboot, you still have to type the user password (or the admin password) when you install applications.

By: bruce

bruce — Sun, 26 Aug 2007 19:33:24 -0800

compose an email like this:

dorothy, i think you're incredibly hot. what we did the other night, i've never felt anything like that before. you're way too good for my idiot roommate. i am so looking forward to seeing you tomorrow night, ten o'clock, at...

[select location carefully. you'll want a higher vantage point for when roomie comes nosing around after reading this, you can dump a bucket of dogshit on him]

and just unplug the phone line before you hit send. the keylogger won't know the box is offline.

By: melorama

melorama — Sun, 26 Aug 2007 19:49:16 -0800

I'm pretty sure that even if you have your Mac automatically log in when you reboot, you still have to type the user password (or the admin password) when you install applications.

Yes, but if his account has Admin priviledges, he could easily create his own new account (also with admin privledges), hide the new account from the login window and always have a way to install programs on the machine, regardless of who the current account is logged in as. And since the auto-login bypasses the login window in the first place, the OP wouldn't be any the wiser, unless he knoew exactly what to look for.

By: hampton

hampton — Sun, 26 Aug 2007 21:07:36 -0800

Following Bruce's line of thinking, but differing: if he is spying on you do not let him know that you know. You have the upper hand here. I wish someone would (sloppily) spy on me so that I could concoct and execute a plan to deal with it. I hope you typed this question from a different computer.

By: willnot

willnot — Sun, 26 Aug 2007 21:10:15 -0800

By: ilsa

ilsa — Sun, 26 Aug 2007 21:40:52 -0800

Friendly advice. Make sure you have an admin password your roommate does now know. As you may have discovered, one needs to know the admin pw to install darn near anything on a Mac. Then, set things up so it wants your password to log in at all. As for choosing a pw, I recommend one with both numbers and letters that you will remember but it is unlikely that someone else could guess. Your favorite food plus the middle two numbers of your SSN, maybe. Or your high school mascot and your girlfriend's birthday. You remember that, right? Oh, ooops! ;-)

Otherwise, willnot and the deej and melorama have good advice. The good news is that keyloggers and other malicious software are rare (not nonexistent, just rare) for the Macintosh. If you want to get to know OSX better and don't have money to spend, here's Google Book's rendition of David Pogue's book

By: filmgeek

filmgeek — Sun, 26 Aug 2007 22:38:59 -0800

willnot's advice is a bit easier if you use Activity Monitor which is in your Utilities Folder.

By: TravellingDen

TravellingDen — Sun, 26 Aug 2007 23:40:50 -0800

Go on the offensive.. install a keylogger (Try Spector Pro) and review his activity afterwards?

By: Mikey-San

Mikey-San — Mon, 27 Aug 2007 03:13:44 -0800

Open the Terminal application, type: top and hit return. This will give you a list of all the applications that are currently running. Do a google search for anything you don't recognize to see what it might be.

Top will only let you see what the size of your Terminal window will show you. You want this commmand:

ps -auxc

By: Mikey-San

Mikey-San — Mon, 27 Aug 2007 03:15:37 -0800

Just hope that there aren't any keyloggers named "DashboardClient".

By: Xere

Xere — Mon, 27 Aug 2007 03:20:57 -0800

Put some text file in a prominent place, with a tantalizing filename. Contents: "FUCK YOU, STOP POKING AROUND MY SHIT."

By: oaf

oaf — Fri, 31 Aug 2007 05:00:13 -0800

make him his own guest account where he can't access your shits

This is not effective if he can boot the machine from another volume.