Using the "Console" app within OS X and viewing the "syslog" file I can see the user shutdown their laptop (it was a HALT operation) around 10:22PM. For some reason, 9 seconds after midnight (12:00:09) the machine would boot up on its own. I looked through the log files to see if it was doing something suspicious. I saw the launch process followed by an mDnsResponder process, followed by a process trying to connect to the wifi network, followed by iCal, MobileMe, processes trying to perform a synchronization. Nothing really looked like it was doing something bad.
But why would the computer be starting up on it's own every night at exactly the same time?
Are there any good apps out there I can use to see if the machine has been hacked?
Is there a way I can temporarily "harden" the machine to see if the behavior disappears?
What are good command line utilities I can use to gather all / any information?