Have I been hacked?

[Krevinek]

Everything I can see in your logs looks normal.

A couple things to point out:

- Unix, Linux and MacOS X are based around the concept of services. So the concept of server/client gets a little blurred. A server is a client, and a client is a server. The only difference is what services are running, and if those services accept connections from the network or not. So when you print, you always print to a 'server', even if that server is your own machine. MacOS X is configured by default to only let your machine print, you would have to turn on printer sharing before other machines would be allowed to connect.

- The Network icon that you see is always there. You will be able to see your own machine under Servers, even if you shut down ALL network connections. While this /is/ one of the more annoying and confusing 'features'... don't worry too much. Just because you see it there, doesn't mean anyone else does. You would have to have file sharing turned on (in System Preferences, under the Sharing pane) before they would even be able to /try/ to login to your computer.

- BootX is just an application that is used to boot OS X on older PowerPC Mac computers. As far as I know, it isn't even used on Intel systems (I wouldn't delete it though), which boot slightly differently.

[mazzy]

Thanks for y'alls input. I don't understand Unix, but I'm trying to learn.

The reason I asked about BootX is because I had an undeletable file named BootX on my win xp machine. I don't play games, so that's not my problem. Whoever did this, accessed my ebay and paypal accounts. I have real reasons for being paranoid.

Can anyone tell explain CertificateAssistantTrustedApps.plist.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist SYSTEM "file://localhost/System/Library/DTDs/PropertyList.dtd">
<plist version="0.9">
<array>
<string>/System/Library/CoreServices/Certificate Assistant.app</string>
<string>/Applications/Mail.app</string>
<string>/Applications/iChat.app</string>
<string>/usr/sbin/racoon</string>
</array>
</plist>

Also, can anyone tell me where I find the plist for a clean install? I'd like to look at mine.

Thanks again for all the help. Y'all do a huge service to paranoids like me. I'll probably have many more questions......hope that's ok.

[crazydigger]

Hi!

I have a follow-up question here re hacking. I was trying to get on the wireless internet in school several times but each time i logged onto the available wireless sites, instead of getting a signal bar on the airport symbol, i get a photo of a little computer in the middle of the signal bar.

I went to the Apple Store today and stupid me was told that those were other computers who were accessing my mac!!! i hadn't turned on my firewall (it's on now) since i didn't realize that it was not automatically turned on when i bought the computer.

Anyway, my question is whether it's possible to check if another computer has indeed hacked into my system and gotten into my files? can they do that?! is there anyway for me to check "footprints" via log or something?

thanks!!

[DeltaMac]

I went to the Apple Store today and stupid me was told that those were other computers who were accessing my mac!!!

Amazing where people get these strange ideas, and then try to convince crazydigger that idea is a fact (it is not....). That icon just means that you are accessing a computer-to-computer network, or a closed network (requiring one of those long passwords to enter), NOT some other computer hacking into your Mac! Sorry, you were blown off by someone at an Apple Store. Don't always accept an answer from one of those that roam around in an Apple Store (or get a 2nd opinion from a 'genius'). You don't always get a correct answer at an Apple Store.

[crazydigger]

wow!! super thanks delta!! next time, i'll just run to this forum for questions instead of going to the apple store!

in any event, how will you know that the computer is getting hacked?

[Satcomer]

Hi!

I have a follow-up question here re hacking. I was trying to get on the wireless internet in school several times but each time i logged onto the available wireless sites, instead of getting a signal bar on the airport symbol, i get a photo of a little computer in the middle of the signal bar.

That is Bonjour finding other computers, I think. Also check your System Preferences Sharing pane and make sure in the Internet tab that you are not sharing the internet with others.

All the logs you want are in /Applications/Utilities/Console.

[symphonix]

I also couldn't see anything unusual in your logs, and I'm still not sure what makes you think you have a problem. You've said a few things like "... and now I've started having problems" but you haven't actually told us much specific. BootX is a perfectly normal file, the Network icon is always there, and the CertificateHelper plist is just the settings for how your browser handles certificates. Nothing too out of the ordinary there.

So yes, if you do have anything that you're not sure about, start by asking about the symptom or problem you're seeing, and then the experts on the forums will point you in the right direction.

[mazzy]

Thank's for everyone's input. And sorry if my questions are dumb, but I spent a fortune repairing my pc over and over, and couldn't keep a persistent hacker out. He'd disble my firewall and all AV programs. OSX is all new to me and if my hacker hasn't already gotten in, I'd like to keep him out.

1. My internet times out after a very short time. I don't know how to keep that from happening. I had a RoadRunner problem, but now that's taken care of, so it's not that.

2. Airport won't stay turned off.

3. BlueTooth likes to come back on too.

4. What is Boot.efi?

5. Can't customize terminal settings.

Activity Monitor shows this when running terminal--
Open Files and Ports
/Users/roxy
/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Library/CoreServices/CharacterSets/CFUnicodeData-L.mapping
/System/Library/CoreServices/CharacterSets/CFCharacterSetBitmaps.bitmap
/System/Library/CoreServices/CharacterSets/CFUniCharPropertyDatabase.data
/Library/Caches/com.apple.IntlDataCache.le.sbdl.501
/System/Library/Fonts/LucidaGrande.dfont
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/Resources/Extras2.rsrc
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/Resources/HIToolbox.rsrc
/System/Library/Contextual Menu Items/AutomatorCMM.plugin/Contents/MacOS/AutomatorCMM
/System/Library/Contextual Menu Items/FolderActionsMenu.plugin/Contents/MacOS/FolderActionsMenu
/System/Library/Contextual Menu Items/SpotlightCM.plugin/Contents/MacOS/SpotlightCM
/Library/Caches/com.apple.LaunchServices-014501.csstore
/usr/share/icu/icudt32l.dat
/System/Library/Caches/com.apple.IntlDataCache.le.kbdx
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/Resources/English.lproj/Localized.rsrc
/System/Library/Extensions/AppleHDA.kext/Contents/PlugIns/AppleHDAHALPlugIn.bundle/Contents/MacOS/AppleHDAHALPlugIn
/System/Library/Components/CoreAudio.component/Contents/MacOS/CoreAudio
/usr/lib/dyld
/usr/lib/libSystem.B.dylib
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreText.framework/Versions/A/CoreText
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
/usr/lib/libicucore.A.dylib
/usr/lib/libobjc.A.dylib
/usr/lib/libstdc++.6.0.4.dylib
/usr/lib/libgcc_s.1.dylib
/usr/lib/libauto.dylib
/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore
/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices
/System/Library/Frameworks/Security.framework/Versions/A/Security
/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration
/System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSync.framework/Versions/A/ColorSync
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/ImageIO
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libJP2.dylib
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv
/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SecurityHI.framework/Versions/A/SecurityHI
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/OpenScripting.framework/Versions/A/OpenScripting
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
/System/Library/Frameworks/CoreData.framework/Versions/A/CoreData
/System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox
/System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCGATS.A.dylib
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCSync.A.dylib
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libRIP.A.dylib
/usr/lib/libncurses.5.4.dylib
/dev/null
/dev/console
/dev/console
apple.shm.notification_center
/tmp/com.apple.csseed.90
apple.shm.notification_center
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/Resources/Extras2.rsrc


/Applications/Utilities/Terminal.app/Contents/Resources/Terminal.rsrc
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/Resources/HIToolbox.rsrc
/dev/ptyp1
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/Resources/English.lproj/Localized.rsrc



So, If all of this is normal, then I'll shut up!