I have a computer running OS X, and I want to know if there's malware (e.g. a keylogger, or something that lets an attacker control my computer, or something that stops me from installing whatever I want) installed on the computer. How can I tell if I have something like that? How can I remove it if I have it?
A lot depends on the relationship between you and the machine - is it your own? Do you have administrator access to it? Since you mention that it's corporate owned, do you have an administrator that has ok'd a keylogger (for whatever reason)? It's possible (or, in fact, likely) you won't be able to remove it without drastic steps - specifically without re-imaging the machine with a known-good OS install. I don't know of any corporate environments where they'd let you do that.
Unfortunately, with a corporate owned machine, they're likely allowed to install whatever they want, and any measures you take to circumvent the logger may well get you fired.
Some things that you may be comfortable trying though:
Unfortunately, since a keylogger is likely to have revealed your passwords, etc. to an attacker, and is generally a sign of a relatively sophisticated attack - it's very likely that the logger itself has managed to get itself installed as a kernel module or rootkit and so even a clean AV sweep isn't an indication you're clear. You really need to consider that just wiping it may be your only option; start fresh and if you're worried about people you know breaking in, keep a close eye on the machine, keep it locked when you're away and keep your passwords complex and secret.
This may vary across a lot of different consideration
At all, I think trusting is needed for good work.
Nota: As keylogger act like a virus, first thing he do is to hide himself, so whithout strong computer knowledge and full access right to the machine, you can't obtain reliable information (whithout installing strongs tools in a computer that's not your...).
About what to do:
Three possibilities anyway:
Warning: This may by called
Keep in mind: If it's not your, you don't have right to alter them anyway!
The only real answer to both of these is to wipe the machine and re-install OS X. Technically, there could be some kind of hardware device recording your actions, but that is not very plausible unless you have highly valued assets (or unless you are a highly valued asset yourself).
protected by Community♦ Oct 30 '13 at 14:03
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.
Would you like to answer one of these unanswered questions instead?