Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Keylogger on Mac


  • Please log in to reply
10 replies to this topic

#1 merengue

merengue

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:10:37 PM

Posted 16 February 2018 - 09:30 AM

Hi, a keylogger has been installed on my Mac. I opened a zip file over the weekend and I have since been contacted by someone claiming to have installed a keylogger. He contacted me using my email so Im taking it seriously and assuming its real.

 

Since finding out Ive stopped using it and have switched off the wifi. Ive changed passwords to any sites I've used since this occurred. Ive not tried any scans yet as I understand that this malware is difficult to detect so wanted some expert advice on what to do first.

 

My system info is:

 

iMac

Sierra

10.12.6



BC AdBot (Login to Remove)

 


#2 OldPhil

OldPhil

    Doppleganger


  • Members
  • 4,157 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Long Island New York
  • Local time:11:37 PM

Posted 16 February 2018 - 09:37 AM

I am a PC guy but there is some info on protection and cleaning in the Mac section.

 

https://www.bleepingcomputer.com/forums/f/172/mac-os/


Honesty & Integrity Above All!


#3 buddy215

buddy215

  • Moderator
  • 13,313 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:10:37 PM

Posted 17 February 2018 - 07:33 AM

That could be a prank or something like an attempt to black mail you.

 

Some questions....Why did you download the .zip file and from where did you download it? What was the intended

use of the .zip file?

 

Could you copy the body of the email into your next post? If so, please do.

Have you attempted a search using the info in the email to find if others have received similar?


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#4 merengue

merengue
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:10:37 PM

Posted 17 February 2018 - 12:19 PM

It was from a porn site and Im not quite sure what the contents were going to be apart from details of free porn! I cant actually remember the site tbh.

 

I have deleted the email so I cant actually post a copy but i did find a site yesterday that had similar emails. The content was essentially this... I have installed a keylogger, I have compromising material and pay some bitcoins to make this go away... I didnt respond to the email.



#5 buddy215

buddy215

  • Moderator
  • 13,313 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:10:37 PM

Posted 17 February 2018 - 01:08 PM

Good that you didn't respond. That is a scam and I have no problem with telling you that a keylogger was not installed.

You may or may not of read the info at E-mail video scam : Scams

 

I suggest blocking the sender of the email if possible. I also suggest NEVER opening an email unless you recognize the sender.

NEVER click on a link in an email until you are certain where it will take you. NEVER open an attachment until you have verified

what is in it.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#6 merengue

merengue
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:10:37 PM

Posted 17 February 2018 - 01:27 PM

Thanks buddy. I know all that re opening links/documents but I stupidly ignored it last weekend. I should have known better!

 

I would feel much better if I could check to verify that there isn't any malware on my machine as I dont feel comfortable using my logins to access sites/social networks/etc. What do you suggest so I can be sure? 



#7 buddy215

buddy215

  • Moderator
  • 13,313 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:10:37 PM

Posted 17 February 2018 - 01:55 PM

You can clean out the temp files, cookies, logs, etc. by using CCleaner for Macs.

CCleaner for Mac

 

You can use Malwarebytes FREE or purchase it.

Malwarebytes | Malwarebytes for Mac

 

You have a Mac...not easy to install malware on a Mac. Almost all is the result of downloading programs/ apps from

sources other than the Apple Store.

 

If you don't have an ad blocker installed in your browser(s)....i suggest Adblock Plus.

Adblock Plus and (a little) more: adblock plus safari

 

If you use another browser other than Safari (which I think blocks 3rd Party cookies by default) then see below.

How to disable third-party cookies in all major web browsers


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#8 merengue

merengue
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:10:37 PM

Posted 19 February 2018 - 06:22 AM

Thanks Buddy, Im gonna do a clean install too.



#9 buddy215

buddy215

  • Moderator
  • 13,313 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:10:37 PM

Posted 19 February 2018 - 02:49 PM

Keep in mind that you may receive another similar email. Unless you were able to block the sender.

It is possible that the scammer/ criminal knew you opened the email. Often an unseen beacon is included that

tells the scammer that. That way they know the email address is legit and will send more spam in many cases.


Edited by buddy215, 19 February 2018 - 03:30 PM.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#10 merengue

merengue
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:10:37 PM

Posted 19 February 2018 - 03:06 PM

I got another email a few days after the first one to say my computer would be encrypted/frozen if I didn't pay. I'm assuming it's the same person as I have never received spam like that before.

Do you know how they might have got my work email?

#11 buddy215

buddy215

  • Moderator
  • 13,313 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:10:37 PM

Posted 19 February 2018 - 03:29 PM

Guessed it....from another address book belonging to someone you communicated with...if your address was ever used online like at Craig's list

or forum....many ways it could of been gotten.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users