I've been trying to determine if there is malware on my OS X 10.9.3 Mac, that is could be doing keylogging or other forms of non-destructive intrusion.
Given the (not technically based) suspicion I have that my machine was compromised and that the compromise may have survived a complete HD wipe and OS reinstall, I'm wondering what steps I could take to determine if the machine is still compromised. I am not asking for help determining if I am being spied on personally, just trying to determine whether my laptop is secure. Please no comments explaining why it is unlikely that something is happening. I'm asking about technical steps I can take to increase confidence that no one is currently monitoring my laptop.
Steps I've taken so far:
Manually inspected several areas of my disk using basic shell tools. Some files had been overwritten including binaries within specific application directories, and a rogue process that was identified as spyware which I was able to remove, prior to eventually wiping the hard drive and reinstalling OS X (over Air from another machine, since this is a MacBook).
Installed Sophos AntiVirus (many months after OS reinstall). Full HD scan found no threats. Background process scan has yet to alert me of anything.
Wireshark has found several suspicious (to me) network streams sending varying amounts of encrypted packets at regular intervals to several servers, including ones with no DNS entry, a few from *.nl or *.ch TLDs, and some that have turned out to be explained. (A process named SophosWeb is sending encrypted payloads every few seconds, rotating ports in the 5K range, back and forth from a server registered to Google. So, sounds legit...) Wireshark produces a lot of data.
On the last in particular, where the ultimate concern is spying on my activities or data, I don't know how to wade through the noise of frequent traffic between my laptop, the Verizon router, my phone... Some of this looks completely kosher, but then there are things like UPnP exchanges between my Apple laptop and the Verizon router, which are questionably secure at best, and hard to know how to turn off. If I close Chrome I can get traffic down to enough of a trickle to manually investigate each unknown server, but I don't know what to look for.