While scouring through tons of logs generated during an audit of a Mac filesystem after a potential malware infection, and I am wondering if there are any better ways to verify that all kernel extension (.kext) and property list (.plist) files are legitimate?

So far, I have just been doing cat auditlog.txt | grep -v com.apple so that I'm only looking at third party extensions. This filters out the vast majority of results, leaving only the files that aren't signed by Apple, but I have a feeling there is a better method.

  • I hope you are not considering just keeping your OS, you should reinstall – Lucas Kauffman Sep 10 '15 at 18:32

The only good solution for recovering from a malware infection is to wipe the disk and reinstall the OS. If you have a backup that you are confident predates the infection, you can go back to that.

I know that you state that it's a potential malware infection, but if you have any doubts (which you obviously do as you asked this question), wipe the disk.

  • That's the plan, and I agree completely. This was my first recommendation to the computer's owner. At this point, I'm doing retroactive forensics just to see if I can discover anything interesting. – user83426 Sep 10 '15 at 23:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.