Malware or Keylogger running?

[TooCol]

Hi everybody, I'm new to the forums but it seems like there's a great community here. I am getting a bit paranoid about a keylogger or anything else running on my MacBook. Here's my processes running from ps -e in the terminal:

PID TTY TIME CMD
1 ?? 10:12.05 /sbin/launchd
37 ?? 1:54.32 /usr/libexec/UserEventAgent (System)
38 ?? 1:42.49 /usr/sbin/syslogd
40 ?? 0:11.47 /usr/libexec/kextd
41 ?? 1:23.23 /System/Library/Frameworks/CoreServices.framework/Vers
43 ?? 0:01.16 /usr/libexec/thermald
45 ?? 0:01.75 /System/Library/CoreServices/appleeventsd --server
46 ?? 1:17.33 /usr/libexec/configd
47 ?? 1:19.20 /System/Library/CoreServices/powerd.bundle/powerd
50 ?? 1:49.26 /usr/libexec/airportd
52 ?? 0:04.12 /usr/libexec/warmd
54 ?? 4:37.20 /System/Library/Frameworks/CoreServices.framework/Fram
59 ?? 0:01.35 /usr/libexec/diskarbitrationd
70 ?? 0:45.34 /usr/libexec/opendirectoryd
71 ?? 0:00.92 /usr/sbin/wirelessproxd
73 ?? 2:30.95 /usr/libexec/discoveryd --udsocket standard --loglevel
74 ?? 0:26.78 /System/Library/PrivateFrameworks/ApplePushService.fra
75 ?? 2:09.74 /System/Library/CoreServices/launchservicesd
76 ?? 0:00.23 /System/Library/PrivateFrameworks/MobileDevice.framewo
77 ?? 0:05.54 /usr/sbin/securityd -i
79 ?? 0:44.74 /usr/libexec/locationd
81 ?? 0:18.20 /usr/libexec/displaypolicyd
82 ?? 0:00.12 autofsd
83 ?? 0:08.69 /usr/sbin/blued
87 ?? 0:00.10 /usr/libexec/stackshot -t -O
88 ?? 0:02.38 /System/Library/PrivateFrameworks/GenerationalStorage.
89 ?? 1:56.59 /System/Library/CoreServices/loginwindow.app/Contents/
90 ?? 0:00.13 /System/Library/CoreServices/logind
91 ?? 0:00.03 /usr/sbin/KernelEventAgent
93 ?? 66:21.38 /usr/libexec/hidd
94 ?? 0:11.25 /usr/libexec/taskgated -s
95 ?? 0:46.30 /usr/sbin/notifyd
101 ?? 0:43.74 /usr/sbin/distnoted daemon
122 ?? 0:05.70 /System/Library/Frameworks/Security.framework/Versions
131 ?? 0:25.71 /System/Library/CoreServices/coreservicesd
135 ?? 0:00.09 /System/Library/Frameworks/PCSC.framework/Versions/A/X
150 ?? 355:39.98 /System/Library/Frameworks/ApplicationServices.framewo
157 ?? 6:20.61 /System/Library/Frameworks/CoreServices.framework/Fram
163 ?? 0:02.91 /System/Library/Frameworks/OpenGL.framework/Versions/A
165 ?? 0:02.95 /System/Library/PrivateFrameworks/AmbientDisplay.frame
178 ?? 0:01.14 /usr/libexec/usbd
181 ?? 0:00.65 /usr/libexec/corestoraged
182 ?? 0:20.34 /usr/sbin/ntpd -c /private/etc/ntp-restrict.conf -n -g
183 ?? 0:00.78 /System/Library/Frameworks/CoreMediaIO.framework/Resou
187 ?? 0:12.75 /usr/libexec/networkd
192 ?? 0:00.01 /usr/libexec/discoveryd_helper --loglevel Detailed --l
198 ?? 0:00.21 /usr/libexec/securityd_service
199 ?? 0:16.65 /usr/libexec/UserEventAgent (Aqua)
201 ?? 2:51.66 /usr/sbin/distnoted agent
210 ?? 0:04.66 /usr/sbin/usernoted
219 ?? 2:23.26 /System/Library/CoreServices/Dock.app/Contents/MacOS/D
221 ?? 1:28.78 /System/Library/CoreServices/SystemUIServer.app/Conten
223 ?? 152:11.16 /usr/sbin/coreaudiod
229 ?? 0:00.03 /usr/sbin/pboard
239 ?? 0:00.28 /System/Library/PrivateFrameworks/AskPermission.framew
240 ?? 0:09.03 /System/Library/PrivateFrameworks/IDS.framework/identi
245 ?? 0:01.47 /System/Library/CoreServices/backupd.bundle/Contents/R
246 ?? 0:14.96 /usr/libexec/sharingd
248 ?? 2:18.58 /System/Library/Frameworks/ApplicationServices.framewo
253 ?? 0:04.29 /usr/sbin/filecoordinationd
258 ?? 0:12.14 /Library/CoreMediaIO/Plug-Ins/DAL/AppleCamera.plugin/C
260 ?? 0:16.12 /System/Library/CoreServices/Spotlight.app/Contents/Ma
262 ?? 0:03.92 /System/Library/CoreServices/Menu Extras/AirPort.menu/
269 ?? 0:00.65 /usr/sbin/diskmanagementd
272 ?? 0:00.40 /System/Library/CoreServices/CrashReporterSupportHelpe
277 ?? 0:02.20 /System/Library/CoreServices/Dock.app/Contents/XPCServ
280 ?? 0:00.99 /System/Library/PrivateFrameworks/IMCore.framework/ima
281 ?? 0:06.69 /System/Library/PrivateFrameworks/ParsecUI.framework/V
283 ?? 0:03.09 /System/Library/PrivateFrameworks/CommerceKit.framewor
286 ?? 0:08.33 /usr/libexec/watchdogd
293 ?? 3:20.53 /System/Library/Services/AppleSpell.service/Contents/M
295 ?? 0:05.25 /System/Library/PrivateFrameworks/GeoServices.framewor
312 ?? 0:00.59 /System/Library/CoreServices/SocialPushAgent.app/Conte
314 ?? 0:01.60 /System/Library/CoreServices/Keychain Circle Notificat
316 ?? 0:03.81 /Library/Application Support/Logitech.localized/Logite
318 ?? 0:16.38 /System/Library/CoreServices/NotificationCenter.app/Co
325 ?? 0:00.95 /System/Library/CoreServices/cloudpaird
328 ?? 0:04.55 /System/Library/CoreServices/WiFiAgent.app/Contents/Ma
329 ?? 0:15.34 /System/Library/CoreServices/diagnostics_agent
334 ?? 0:00.60 /Applications/iTunes.app/Contents/MacOS/iTunesHelper.a
335 ?? 0:01.78 /Users/colePortable/Library/Application Suppor
383 ?? 0:00.24 /System/Library/PrivateFrameworks/CommerceKit.framewor
384 ?? 0:08.50 /System/Library/PrivateFrameworks/CommerceKit.framewor
385 ?? 0:01.71 /System/Library/PrivateFrameworks/CommerceKit.framewor
386 ?? 0:13.93 /System/Library/PrivateFrameworks/CommerceKit.framewor
389 ?? 0:06.96 /System/Library/Frameworks/CoreServices.framework/Fram
394 ?? 0:00.13 /System/Library/Frameworks/CoreServices.framework/Fram
437 ?? 0:00.53 /System/Library/CoreServices/SubmitDiagInfo server-ini
539 ?? 0:00.14 /usr/libexec/USBAgent
553 ?? 0:00.13 /System/Library/Frameworks/CoreServices.framework/Fram
636 ?? 0:03.04 /System/Library/Frameworks/ApplicationServices.framewo
1061 ?? 0:03.21 /System/Library/PrivateFrameworks/Noticeboard.framewor
1069 ?? 0:00.14 /System/Library/PrivateFrameworks/Noticeboard.framewor
4947 ?? 5:17.35 /System/Library/CoreServices/Finder.app/Contents/MacOS
4960 ?? 0:00.12 /System/Library/PrivateFrameworks/KerberosHelper/Helpe
4974 ?? 317:45.41 /Applications/Google Chrome.app/Contents/MacOS/Google
4978 ?? 0:02.68 /Applications/Google Chrome.app/Contents/Versions/54.0
4979 ?? 89:15.44 /Applications/Google Chrome.app/Contents/Versions/54.0
4982 ?? 5:43.15 /System/Library/Frameworks/VideoToolbox.framework/Vers
4987 ?? 17:43.48 /Applications/Google Chrome.app/Contents/Versions/54.0
4988 ?? 2:01.51 /Applications/Google Chrome.app/Contents/Versions/54.0
4989 ?? 13:32.03 /Applications/Google Chrome.app/Contents/Versions/54.0
4990 ?? 1:07.88 /Applications/Google Chrome.app/Contents/Versions/54.0
5128 ?? 4:59.44 /System/Library/Frameworks/Foundation.framework/Versio
5364 ?? 0:00.26 /System/Library/Frameworks/InputMethodKit.framework/Re
7101 ?? 0:14.34 /System/Library/Frameworks/CoreServices.framework/Fram
7359 ?? 0:18.09 /System/Library/PrivateFrameworks/DiskImages.framework
7364 ?? 0:00.07 /System/Library/PrivateFrameworks/DiskImages.framework
7594 ?? 0:13.37 /System/Library/Frameworks/CoreMIDI.framework/MIDIServ
8576 ?? 0:11.90 /Applications/LogMeIn Hamachi/LogMeIn Hamachi Menubar.
8586 ?? 0:34.62 /Library/Application Support/LogMeIn Hamachi/bin/hamac
9807 ?? 0:00.09 /System/Library/Frameworks/DiskArbitration.framework/V
10135 ?? 0:08.49 /Users/colePortable/Library/Application Suppor
11676 ?? 0:08.44 /usr/sbin/cfprefsd daemon
11682 ?? 0:15.84 /usr/sbin/cfprefsd agent
11828 ?? 0:01.22 /usr/libexec/secinitd
11830 ?? 0:00.12 /usr/libexec/secd
11831 ?? 0:00.05 /usr/libexec/networkd_privileged
11832 ?? 0:00.47 /usr/libexec/nsurlstoraged
11833 ?? 0:00.42 /System/Library/PrivateFrameworks/MessagesKit.framewor
11834 ?? 0:01.43 /usr/libexec/nsurlstoraged
11835 ?? 0:11.51 /usr/libexec/coreduetd
11837 ?? 0:01.22 /System/Library/CoreServices/AirPlayUIAgent.app/Conten
11838 ?? 0:01.44 /System/Library/Frameworks/Security.framework/Versions
11839 ?? 0:10.35 /System/Library/CoreServices/lsuseractivityd
11845 ?? 0:00.16 /usr/libexec/diagnosticd
11846 ?? 0:15.72 /usr/libexec/systemstatsd
11852 ?? 0:05.33 /usr/libexec/amfid
11854 ?? 0:10.82 /usr/libexec/gamecontrollerd
11862 ?? 3:57.14 sysmond
11873 ?? 0:02.88 /System/Library/PrivateFrameworks/CalendarAgent.framew
11874 ?? 0:00.87 /System/Library/PrivateFrameworks/TCC.framework/Resour
11875 ?? 0:00.41 /System/Library/PrivateFrameworks/CalendarAgent.framew
11908 ?? 15:05.48 /Applications/Google Chrome.app/Contents/Versions/54.0
12027 ?? 0:00.29 /System/Library/Frameworks/Accounts.framework/Versions
12056 ?? 0:00.92 /System/Library/CoreServices/mapspushd
12058 ?? 0:00.02 /usr/libexec/periodic-wrapper daily
12059 ?? 1:27.66 /System/Library/CoreServices/Software Update.app/Conte
12060 ?? 0:00.20 /System/Library/PrivateFrameworks/SoftwareUpdate.frame
12115 ?? 0:00.15 /usr/sbin/cupsd -l
12135 ?? 0:02.25 /System/Library/PrivateFrameworks/CacheDelete.framewor
12136 ?? 0:00.93 /System/Library/PrivateFrameworks/CloudKitDaemon.frame
12137 ?? 0:00.12 /usr/libexec/nsurlsessiond
12138 ?? 0:00.31 /usr/libexec/nsurlsessiond --privileged
12141 ?? 0:13.28 /System/Library/PrivateFrameworks/PackageKit.framework
12142 ?? 0:00.16 /System/Library/CoreServices/Software Update.app/Conte
12145 ?? 0:00.09 /System/Library/PrivateFrameworks/CommerceKit.framewor
12170 ?? 0:00.13 /System/Library/Frameworks/InputMethodKit.framework/Ve
12171 ?? 0:00.26 /System/Library/PrivateFrameworks/CloudDocsDaemon.fram
12209 ?? 0:00.61 /System/Library/CoreServices/pbs
12218 ?? 0:00.62 /usr/libexec/pkd
12221 ?? 0:02.74 /System/Library/CoreServices/iconservicesagent
12222 ?? 0:00.19 /System/Library/CoreServices/iconservicesd
12268 ?? 0:00.28 /System/Library/PrivateFrameworks/CoreSymbolication.fr
12310 ?? 0:01.50 /usr/sbin/spindump
12311 ?? 0:00.07 /usr/libexec/spindump_agent
12313 ?? 0:00.20 com.apple.CoreSimulator.CoreSimulatorService
12316 ?? 0:00.22 /System/Library/PrivateFrameworks/PerformanceAnalysis.
12332 ?? 0:00.09 /System/Library/PrivateFrameworks/TCC.framework/Resour
12341 ?? 0:00.08 /System/Library/PrivateFrameworks/DataDetectorsCore.fr
12343 ?? 0:00.95 /usr/libexec/sandboxd -n PluginProcess -n
12980 ?? 0:25.40 /System/Library/PrivateFrameworks/DiskImages.framework
13182 ?? 0:58.66 /usr/sbin/systemstats --xpc
13205 ?? 0:02.68 /System/Library/PrivateFrameworks/DiskImages.framework
13221 ?? 0:00.07 /System/Library/Frameworks/ApplicationServices.framewo
13226 ?? 0:00.54 /System/Library/CoreServices/ScopedBookmarkAgent
13234 ?? 0:00.04 /System/Library/PrivateFrameworks/AccountPolicy.framew
13268 ?? 0:13.45 /System/Library/PrivateFrameworks/DiskImages.framework
13307 ?? 0:00.10 /usr/libexec/nehelper
13518 ?? 0:00.13 /System/Library/PrivateFrameworks/DiskImages.framework
13566 ?? 0:00.06 /System/Library/PrivateFrameworks/BookKit.framework/Ve
13734 ?? 0:00.53 /System/Library/PrivateFrameworks/PhotoLibraryPrivate.
13736 ?? 0:00.27 /System/Library/PrivateFrameworks/PhotoLibraryPrivate.
13737 ?? 0:01.08 /System/Library/CoreServices/cloudphotosd.app/Contents
13739 ?? 0:00.64 /System/Library/PrivateFrameworks/CloudPhotoServices.f
14123 ?? 0:00.01 /usr/libexec/periodic-wrapper weekly
14154 ?? 0:01.09 /usr/sbin/distnoted agent
14222 ?? 0:00.33 /System/Library/PrivateFrameworks/CloudServices.framew
14223 ?? 0:00.05 /System/Library/Frameworks/Security.framework/Versions
14519 ?? 0:00.02 /Users/colePortable/Library/Application Suppor
14653 ?? 0:00.03 /System/Library/PrivateFrameworks/HelpData.framework/V
14743 ?? 0:01.49 /Applications/QuickTime Player.app/Contents/MacOS/Quic
14746 ?? 0:00.02 /System/Library/Frameworks/AudioToolbox.framework/XPCS
14747 ?? 0:00.32 /System/Library/CoreServices/CoreServicesUIAgent.app/C
14748 ?? 0:00.04 /System/Library/Frameworks/AudioToolbox.framework/XPCS
14786 ?? 0:00.04 /System/Library/CryptoTokenKit/com.apple.ifdreader.slo
14988 ?? 0:00.25 /System/Library/PrivateFrameworks/CommerceKit.framewor
14990 ?? 0:00.02 /System/Library/PrivateFrameworks/StoreXPCServices.fra
14991 ?? 0:00.04 /System/Library/PrivateFrameworks/CommerceKit.framewor
15000 ?? 0:00.27 /System/Library/CoreServices/AssetCacheLocatorService
15001 ?? 0:00.02 /System/Library/PrivateFrameworks/TCC.framework/Resour
15008 ?? 0:00.04 /System/Library/PrivateFrameworks/CommerceKit.framewor
15116 ?? 0:02.78 /usr/sbin/ocspd
15172 ?? 0:00.02 /System/Library/Frameworks/GSS.framework/Helpers/com.a
15243 ?? 0:00.23 /usr/libexec/findmydeviced
15448 ?? 0:01.15 /Applications/Google Chrome.app/Contents/Versions/54.0
15498 ?? 2:02.74 /Applications/Pages.app/Contents/MacOS/Pages -psn_0_28
15503 ?? 0:01.45 /System/Library/Frameworks/AppKit.framework/Versions/C
15584 ?? 5:02.70 /Applications/Google Chrome.app/Contents/Versions/54.0
15585 ?? 3:10.48 /Applications/Google Chrome.app/Contents/Versions/54.0
15643 ?? 1:31.28 /Applications/Google Chrome.app/Contents/Versions/54.0
15688 ?? 0:00.09 /usr/sbin/netbiosd
15731 ?? 1:18.39 /Applications/Google Chrome.app/Contents/Versions/54.0
15752 ?? 0:32.12 /usr/sbin/bluetoothaudiod
15800 ?? 0:43.41 /Applications/Utilities/Activity Monitor.app/Contents/
15894 ?? 0:00.59 /System/Library/Frameworks/CoreServices.framework/Fram
15911 ?? 0:00.02 /System/Library/Frameworks/CoreServices.framework/Fram
15912 ?? 0:00.02 /System/Library/Frameworks/CoreServices.framework/Fram
15916 ?? 0:00.35 /System/Library/Frameworks/CoreServices.framework/Fram
15918 ?? 0:00.34 /System/Library/Frameworks/CoreServices.framework/Fram
15919 ?? 0:00.50 /System/Library/Frameworks/CoreServices.framework/Fram
15934 ?? 0:32.45 /Applications/Google Chrome.app/Contents/Versions/54.0
15940 ?? 0:28.44 /Applications/Google Chrome.app/Contents/Versions/54.0
15944 ?? 0:08.81 /Applications/Google Chrome.app/Contents/Versions/54.0
15945 ?? 0:02.00 /Applications/Utilities/Terminal.app/Contents/MacOS/Te
15947 ?? 0:00.47 /System/Library/Frameworks/OpenGL.framework/Versions/A
15956 ?? 0:02.90 /Applications/Google Chrome.app/Contents/Versions/54.0
15958 ?? 0:15.97 /Applications/Google Chrome.app/Contents/Versions/54.0
15960 ?? 0:19.29 /Applications/Google Chrome.app/Contents/Versions/54.0
15964 ?? 0:27.60 /Applications/Google Chrome.app/Contents/Versions/54.0
15967 ?? 0:02.33 /Applications/Google Chrome.app/Contents/Versions/54.0
15968 ttys000 0:00.03 login -pf colePortable
15969 ttys000 0:00.01 -bash
15972 ttys000 0:00.00 ps -e

 

[pigoo3]

Do you have a reason to suspect a problem?

Assuming there's no issue...why the concern?

- Nick

 

[ferrarr]

Did you allow an unidentifiable program install?

 

[harryb2448]

Only by Google I would suggest!

 

[TooCol]

Hi everybody!

Thank you all for the responses. I am young and dumb and I my download history is not exactly perfect.. I know that Macs are known to be fairly safe against viruses but lately I've been concerned about them because I got one running Windows on another apple machine(which I know doesn't quite apply). Yesterday though I did a system scan for the first time and to my surprise it actually caught something! Now I'm just getting nervous that there might be other things that my virus scanner (bitdefender) didn't catch that I don't know about. I posted my processes running in hopes of it helping but is there any other measures I can take to make sure I have a clean machine? Keylogger if you are there and reading this, please get out of my machine.

 

[ferrarr]

You do not need any anti virus on your Mac OS, unless it is within the Windows OS, either Boot Camp or virtual machine. As long as you do not allow any app to be installed, without you knowing what it is, you should not have to worry about your Mac. The scan you performed, most likely found a Windows OS virus.

 

[Slydude]

I wouldn't be too concerned at this point. Mac anti virus programs rely on definitions of Windows-based viruses to perform their magic. What has probably happened is that Bitdefender found a Windows virus in an email attachment and flagged that as a potential problem Windows viruses cannot infect Mac files. They can however infect your Windows files if you are running a Boootcamp partition with Windows or a virtual machine with Windows installed.

At this point there are no actual Mac viruses "in the wild". There is some malware (browser hijacks and the like). Anti-virus programs do not handle those problems. For that you need something like Adware Medic for the Mac.

 

[TooCol]

Thank you all for the responses,

In my daily use I go against my computers will to either "right click -> open" files that "cannot be opened" or sometimes I think I download things that at first notify me they cannot be downloaded because etc.. is this the built in Mac OS security feature trying to warn me?

In these cases, is my mac susceptible to trojans/worms/rootkits and things of the like? I'm a bit confused as to what can only affect Windows vs what can affect a Mac if given the right permission.

 

[TooCol]

Hi ferrarr,

"In my daily use I go against my computers will to either "right click -> open" files that "cannot be opened" or sometimes I think I download things that at first notify me they cannot be downloaded because etc.. is this the built in Mac OS security feature trying to warn me?

In these cases, is my mac susceptible to trojans/worms/rootkits and things of the like? I'm a bit confused as to what can only affect Windows vs what can affect a Mac if given the right permission."

Not sure if direct replies are any different than "reply to thread"

 

[Rod]

Direct replies just make it easier to see the thread you are replying to either "reply to thread" or the latter work the same.
The warnings you are receiving are a result of GateKeeper which tries to prtect us against ourselves. The settings for this are found in System Preferences > Security an Privacy > Allow apps downloaded from: Options vary a little dependent on your Operating System.
You do not need an antivirus app chewing up your resources but if you decide to trash it (I would) make sure you use the developer's uninstaller or check how to do it with them.
Lastly I will give you the same stock standard advice I give everybody who is concerned about the ongoing security/health of their Mac device.

A couple of our universal suggestions;

1. Make a backup, there are only a few things that are certain in this world and one of them is that your computer will crash one day.
We advise at the very least a Time Machine backup and/or if possible a bootable clone. The advantages of the latter a too numerous to mention (unless you'd like to know) and the apps we recommend for this are;

Carbon Copy Cloner ( https://bombich.com/download ) or

Super Duper (http://www.shirt-pocket.com/SuperDuper/SuperDuperDescription.html).

Both offer 30 day free trials with no obligation. You would need a dedicated external USB Hard Drive about twice the size of your Macintosh HD to store your data and subsequent updates.

2. Download malwarebytes a free app for removing all sorts of malicious Adware available here; https://www.malwarebytes.com/antimalware/mac/

3. Download OnyX a free maintenance, cleaning and repair program (you will need the version for your Operating System) from here;
http://www.titanium.free.fr/onyx.html

Running the full suite of tabbed actions (I thinks there's three) under the Maintenance tab will ensure your macOS is in tip top condition. I run it once a month.

 

[harryb2448]

As Mac OS X is based on the Unix operating system there are no viruses. AV software on tour Mac operating system can therefor do nothing. If you run Windows via BootCamp etc then you certainly do need strong AV on that partition. Malwarebytes for Mac as suggested is great and avoid web sites that are known to include adware with your downlaods, Softonic, CNET and MacUpdate.

 

[TooCol]

Thank you guys for the responses!
Rod Sprague, I've since downloaded Malwarebytes and Onix. Thanks for the suggestion!