I'm investigating the state of my MacBook Pro which I know was compromised, and do not know if I removed the exploits completely (and I realize, technically will never know this). I'm trying to hone in on specific exploits, not expecting to prove they don't exist, but in any case I can prove that they do, that can help me decide on various courses of action from basic remediation to replacing the whole system in the most extreme.
Looking for briefest answers, here are some starting questions I have:
What are the common vectors for installing rootkits? (And if I understand correctly, this would include MBR as well as BIOS? So same question for each.)
How common are rootkits that survive OS reinstall (and are these limited to BIOS, or can MBR infections achieve this?)
How common are USB key infections? I know many government agencies have had policies for a few years now of not allowing employees to even use USB keys on their machines, but these are high security settings.
If there's a concern about attacks that are unknown to commercial AV tools, would commercial tools still be useful in detecting a rootkit from a fresh OS install? E.g. detecting unexpected network traffic as it tries to download additional malware?
On a previously compromised machine, is there really any hope of detecting a keylogger? I am suspecting not (unless a very poorly written keylogger, or already known to AV software.)
On all of these, I can post single questions for more detail; I'm just trying to figure out which things to explore first, and which are dead-ends.