CA3LE Posted November 1, 2013 CID Share Posted November 1, 2013 Hi, I found your site by googling: google.keystone.agent.plist which I discovered on my computer by doing the steps in the link below for macs. Is this spyware or a keylogger? I think someone has put a keylogger on my computer and I'm trying to locate it. I'm not under 18 nor an employee. Please look through the list off my computer terminal which I got to see if there's any keylogger clues. If it is found, what should I do, get a lawyer or contact law enforcement? Once I find out the spy software, how do I find out who put it on? Perhaps there are other keyloggers or spyware, do you see any? Hi Ellie, I didn't see anything out of the ordinary... I recommend registering on TMN, then contact mudmanc4 (his profile - the topic you're talking about). He's a regular and usually visits TMN every day so I bet he'll respond quickly. You can also try posting to that topic after you signup... that will help others in the future. I looked it over and you have a bunch of legit Google plugins and addons. I've seen most of them and they're associated with things like google voice and video chat. I researched a bunch I was unaware of and came up with clean services... If you feel like you're being logged you might want to sniff your outgoing traffic. Chances are if someone has done that the program will be sending the information off somewhere (unless of course you have someone who has direct access to the computer... in which case, change your passwords and make new friends if you can't trust them, lol). What you can do is get a program like Little Snitch or something similar that alerts you every time your computer reaches out. You'll be bugged by many legit services... whitelist them and build up a known list of good guys. Then, if something like that tries to communicate out... YOU GOT THEM! You can take the IP to the authorities, they'll know what to do. Although, anyone smart enough will have intermediate proxies between you and them... the proxy machines often don't have anything to do with the snoop / attacker... which can literally make it impossible to find them. Good luck... I hope that you're just being paranoid and nobody is actually logging you. And HEY! Don't forget to test your Internet speed, that's what TestMy.net is all about. Kind Regards, - Damon - TestMy.net com.mcafee.kext.Virex (1.1.0d1) com.mcafee.reporter com.mcafee.menulet com.google.keystone.system.agent com.adobe.CS4ServiceManager #~ $ ls -1A /e*/mach* {,/}L*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/Bu,P*P,Priv,Qu,Scripti,Servi,Spo,Sta}* L*/Fonts 2> /dev/null/Library/Components: /Library/Extensions: /Library/Frameworks: AEProfiling.framework AERegistration.framework AVEngine.framework AudioMixEngine.framework NyxAudioAnalysis.framework PluginManager.framework ScanBooster.framework VirusScanPreferences.framework iTunesLibrary.framework /Library/Input Methods: /Library/Internet Plug-Ins: AdobeAAMDetect.plugin Flash Player.plugin JavaAppletPlugin.plugin Quartz Composer.webplugin QuickTime Plugin.plugin SharePointBrowserPlugin.plugin SharePointWebKitPlugin.webplugin flashplayer.xpt googletalkbrowserplugin.plugin npgtpo3dautoplugin.plugin nsIQTScriptablePlugin.xpt o1dbrowserplugin.plugin /Library/Keyboard Layouts: /Library/LaunchAgents: com.adobe.AAM.Updater-1.0.plist com.adobe.CS4ServiceManager.plist com.google.keystone.agent.plist com.mcafee.menulet.plist com.mcafee.reporter.plist /Library/LaunchDaemons: com.adobe.fpsaud.plist com.apple.remotepairtool.plist com.google.keystone.daemon.plist com.mcafee.ssm.Eupdate.plist com.mcafee.ssm.ScanFactory.plist com.mcafee.ssm.ScanManager.plist com.mcafee.virusscan.fmpd.plist com.microsoft.office.licensing.helper.plist com.wdc.WDDMservice.plist com.wdc.WDSmartWareServer.plist /Library/PreferencePanes: Flash Player.prefPane /Library/PrivilegedHelperTools: com.microsoft.office.licensing.helper /Library/QuickLook: iWork.qlgenerator /Library/QuickTime: AppleIntermediateCodec.component AppleMPEG2Codec.component /Library/ScriptingAdditions: Adobe Unit Types.osax /Library/Spotlight: Microsoft Office.mdimporter iWork.mdimporter /Library/StartupItems: cma /etc/mach_init.d: /etc/mach_init_per_login_session.d: /etc/mach_init_per_user.d: Library/Address Book Plug-Ins: Library/Fonts: Library/Input Methods: .localized Library/Internet Plug-Ins: Google Earth Web Plug-in.plugin Picasa.plugin Library/Keyboard Layouts: Library/LaunchAgents: com.apple.CSConfigDotMacCert-healthyinspiration@me.com-SharedServices.Agent.plist Library/PreferencePanes: #~ $ #~ $ osascript -e 'tell application "System Events" to get name of every login item' 2> /dev/null iTunesHelper, HP Scheduler #~ $ #~ $ kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}' com.mcafee.kext.Virex (1.1.0d1) #~ $ sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix)|edu\.mit|org\.(amavis|apache|cups|isc|ntp|postfix|x)/{print $3}' Password: com.wdc.WDSmartWareServer com.wdc.WDDMservice com.microsoft.office.licensing.helper com.mcafee.virusscan.fmpd com.mcafee.ssm.ScanManager com.mcafee.virusscan.ssm.ScanFactory com.mcafee.ssm.Eupdate com.google.keystone.daemon com.adobe.fpsaud #~ $ Password: com.wdc.WDSmartWareServer com.wdc.WDDMservice com.microsoft.office.licensing.helper com.mcafee.virusscan.fmpd com.mcafee.ssm.ScanManager com.mcafee.virusscan.ssm.ScanFactory com.mcafee.ssm.Eupdate com.google.keystone.daemon com.adobe.fpsaud #~ $ launchctl list | sed 1d | awk '!/0x|com\.apple|edu\.mit|org\.(x|openbsd)/{print $3}' com.mcafee.reporter com.mcafee.menulet com.google.keystone.system.agent com.adobe.CS4ServiceManager #~ $ com.mcafee.reporter com.mcafee.menulet com.google.keystone.system.agent com.adobe.CS4ServiceManager #~ $ ls -1A /e*/mach* {,/}L*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/Bu,P*P,Priv,Qu,Scripti,Servi,Spo,Sta}* L*/Fonts 2> /dev/null/Library/Components: /Library/Extensions: /Library/Frameworks: AEProfiling.framework AERegistration.framework AVEngine.framework AudioMixEngine.framework NyxAudioAnalysis.framework PluginManager.framework ScanBooster.framework VirusScanPreferences.framework iTunesLibrary.framework /Library/Input Methods: /Library/Internet Plug-Ins: AdobeAAMDetect.plugin Flash Player.plugin JavaAppletPlugin.plugin Quartz Composer.webplugin QuickTime Plugin.plugin SharePointBrowserPlugin.plugin SharePointWebKitPlugin.webplugin flashplayer.xpt googletalkbrowserplugin.plugin npgtpo3dautoplugin.plugin nsIQTScriptablePlugin.xpt o1dbrowserplugin.plugin /Library/Keyboard Layouts: /Library/LaunchAgents: com.adobe.AAM.Updater-1.0.plist com.adobe.CS4ServiceManager.plist com.google.keystone.agent.plist com.mcafee.menulet.plist com.mcafee.reporter.plist /Library/LaunchDaemons: com.adobe.fpsaud.plist com.apple.remotepairtool.plist com.google.keystone.daemon.plist com.mcafee.ssm.Eupdate.plist com.mcafee.ssm.ScanFactory.plist com.mcafee.ssm.ScanManager.plist com.mcafee.virusscan.fmpd.plist com.microsoft.office.licensing.helper.plist com.wdc.WDDMservice.plist com.wdc.WDSmartWareServer.plist /Library/PreferencePanes: Flash Player.prefPane /Library/PrivilegedHelperTools: com.microsoft.office.licensing.helper /Library/QuickLook: iWork.qlgenerator /Library/QuickTime: AppleIntermediateCodec.component AppleMPEG2Codec.component /Library/ScriptingAdditions: Adobe Unit Types.osax /Library/Spotlight: Microsoft Office.mdimporter iWork.mdimporter /Library/StartupItems: cma /etc/mach_init.d: /etc/mach_init_per_login_session.d: /etc/mach_init_per_user.d: Library/Address Book Plug-Ins: Library/Fonts: Library/Input Methods: .localized Library/Internet Plug-Ins: Google Earth Web Plug-in.plugin Picasa.plugin Library/Keyboard Layouts: Library/LaunchAgents: com.apple.CSConfigDotMacCert-healthyinspiration@me.com-SharedServices.Agent.plist Library/PreferencePanes: #~ $ iTunesHelper, HP Scheduler sumanth 1 Link to comment Share on other sites More sharing options...
Recommended Posts