12-28-2009, 12:00 AM

hello all... I am new here and I am looking for some information and hope you all can help.

Within the past week, a few of my accounts have been compromised. My yahoo email, my paypal and one of my credit cards. The weird thing is, my email password was changed.... there were 2 unauthroized transactions on my Paypal (one purchasing something from a penny auction site - and one a transfer of money from my own account) and then a large payment was intitiated to make a payment on one of my credit cards (which was already paid off) which caused me to have a NSF fee from my bank.

My mac has not been used by someone else physically... so I can only wonder about keylogging and somehow it could have been compromised remotely by something I did online.

Any recommendations for software for Mac OS X (10.6.2) for keylogger software detection?

I looked at the Activity Monitor as suggested in my research on the web, but not sure what to look for exactly or how to read the Activity Monitor.

Looking for any advice on how to figure out if my machine is compromised? Please help

12-28-2009, 01:24 AM

An unauthorized payment made on one of your own credit cards? That (and the other things) sounds like someone is messing with you, as opposed to trying to steal from you. Do you have an unhappy roommate?

I sincerely doubt that you have a keystroke logger. But, you can simply search your machine to see if any unauthorized/unknown/suspicious applications are there.

If I were you I'd immediately change all my passwords. I wouldn't write them down anywhere. And I certainly wouldn't tell anyone what they are.

If you are really paranoid about the possibility of spyware on your machine, then you should back up your data, scrub the HD, reinstall the OS, and reinstall the applications you use, and copy your data back in. When backing up your data, be selective and only include stuff you know is yours, and don't use an everything back up like Time Machine.

12-28-2009, 01:25 AM

Not that it's impossible, but I think it's unlikely that your problem is a keylogger if no one else has access to your computer. That is, unless you're installing pirated or otherwise shady software, in which case you might have unintentionally installed a keylogger. Have you installed or run any nonstandard software recently, or has anything you double-clicked in the Finder or elsewhere asked for your password?

I'd look elsewhere for the problem first. Email, credit card, and PayPal accounts are prime targets of phishing. Have you received any emails from any of those companies asking you to verify your password? If so, you unknowingly could have given your password to malicious people; none of the companies will actually ask you to do such a thing. Alternatively, have you ever told anyone any of your passwords? If so, that's a starting place. Also, is your password secure?

12-29-2009, 11:22 AM

Okay here is an update. Not sure how this is happening however, no one has access to my computer. And I am aware of phishing scams and have not clicked on any links in emails from which I am not sure of the sender especially ones from banks, paypal, credit card companies etc.. My passwords are secure.... that has been something I have done for a while.

I have been changing all my passwords. As for my credit card account, I figured out that the "Automatic Payments" were set-up on two of my credit card accounts. The one was set to pay the entire balance which I didn't have in my bank account. I did not set the auto pay options up. I always pay month by month because I don't always have the entire amount in my bank account.

As for my paypal, they investigated and have refunded the transaction in question, however they have limited the account and I am trying to get it restored. They say I am using an anonymizing proxy to access teh account. I have no idea what that is or how to use one. Can anyone tell me how to figure out how to find this? Is this something on my system?

I am at a relatives home using their internet right now but am heading home today. Once I am there I will back up my data and work on a restore. In the meantime, any help on the anonymizing proxy info would be good. I have googled it and am doing some research now but not sure what it all means

12-29-2009, 08:40 PM

a proxy is a web site that allows you to use the internet by going though other servers ex.- (normal)computer-isp-web site server (proxy) computer-isp-proxy server-web site server. so if paypal said it was on an anon. proxy it might have been a hacker using the proxy so it would be more difficult to track his ip address. this coined the term and internet meme: "good luck, im behind 7 proxies". it originated because someone hacked someones myspace and said this in response. sorry for the bit of interwebs history, i like to make references