Has my mac been hacked?

[r0k]

2 users is normal. One is console and has been idle for 15 hours. One is you logged in right now. Just make sure you run a browser other than Safari or at least shut down "automatically open safe files after download." and you shouldn't have to worry about the present malware/trojan that is going around for OS X.

If you run another terminal window, a third copy of you will show up. Nothing to see here. Move along.

 

[yorsac]

Erase ard

Just find the ard app dont know where is located but in the system folders and erase it, it will prevent from any remote logins and no one will control your computer.

 

[r0k]

Just find the ard app dont know where is located but in the system folders and erase it, it will prevent from any remote logins and no one will control your computer.

Why? Deleting ard isn't necessary if you turn off remote admin and screen sharing in system preferences. Sure you can admin OS X like you would admin Linux by removing execute permissions or deleting files but why? There's a gui for it and the gui works just use it.

 

[FreshlySnipes]

Macbook Pro Acting wierd/ sketchy emails

I have been recieving emails from unknown addresses for the past 24 hours with links that do not do anything. I am getting an email about every hour. They are pretty sketchy. Also my internet is working very slow, half the speed it should be. I have 10mps internet and it is running a bit under 5 consistently. I have followed the steps listed, turned firewall on, checked activity monitor..etc. I typed locate ard in console and it says the database does not exist. is that a good thing? Thanks for the help Oh and I am running Lion

 

[John T]

Sounds like you are getting spam messages. If you don't recognise the senders address DO NOT click on any links but either delete the message or, better still, bounce it (message > bounce).

 

[Abertrand64]

I think my I mac was compromised including my Yahoo

I have the same troubles. Since then I do not get any more Emails. I find these hackers pathetic. And wish that they **** in their beds every night, cause of their stupidity! Honestly, since then I have been wondering why I do not get any moreEmails from my friends. And they also have said they gotten an Email from me and all there was in was a link to another web site. I never mailed this Email. I have also looked upon my hard disk and I do have Norton Anti Virus for i Mac. I have Firewall turned on. Still do not get as many Emails as I used too! I am pissed now, cause if this trojan virus is slowly destroying my i Macs life, there is nothing I can do. I am up set. Any help or ideas from Apple yet?Thanks. Help!

 

[GGJstudios]

I am pissed now, cause if this trojan virus is slowly destroying my i Macs life,

You don't have a trojan or virus. Your email account password was hacked, so a spammer is sending emails using your account, or your email address is being spoofed. Neither have anything to do with your computer or malware. Change your email password to something complex, using numbers, special characters and upper and lower case letters.

Macs are not immune to malware, but no true viruses exist in the wild that can run on Mac OS X, and there never have been any since it was released over 10 years ago. You cannot infect your Mac simply by visiting a website, unzipping a file, opening an email attachment or joining a network. The only malware in the wild that can affect Mac OS X is a handful of trojans, which cannot infect your Mac unless you actively install them, and they can be easily avoided with some basic education, common sense and care in what software you install. Also, Mac OS X Snow Leopard and Lion have anti-malware protection built in, further reducing the need for 3rd party antivirus apps.

Mac Virus/Malware FAQ​

 

[ChrisA]

I have the same troubles. Since then I do not get any more Emails. I find these hackers pathetic. And wish that they....

Almost certainly there is nothing wrong with your mac. Faking an email does not require hacking your Mac. It is as easy is faking a postal mail. I'll they need to do is write your address in the return address space and send the mail from any place. A sophisticated user can detect this kind of fake but 99% of people can't This applies to both postal and emails.

The weak link is that you send/receive mail through an ISP and someone can guess the password. Change it to something like "aS4%hke8&&wkQ" and then no one will guess it.

 

[shadowrip]

i think this is being hacked ive attached the netstat activity

Active Internet connections
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 109.175.135.5.50580 a92-122-126-224..http ESTABLISHED
tcp4 0 0 109.175.135.5.50577 a92-122-126-224..http ESTABLISHED
tcp4 0 0 109.175.135.5.50576 a92-122-126-224..http ESTABLISHED
tcp4 0 0 109.175.135.5.50575 a92-122-126-224..http ESTABLISHED
tcp4 0 0 109.175.135.5.50574 a92-122-126-224..http ESTABLISHED
tcp4 0 0 109.175.135.5.50573 a92-122-126-224..http ESTABLISHED
tcp4 0 0 localhost.49925 localhost.49927 ESTABLISHED
tcp4 0 0 localhost.49927 localhost.49925 ESTABLISHED
tcp4 0 0 109.175.135.5.49906 lhr14s20-in-f22..https ESTABLISHED
tcp4 0 0 109.175.135.5.49798 67.228.168.221-s.http ESTABLISHED
tcp4 0 0 109.175.135.5.49479 db3msgr5011409.g.https ESTABLISHED
tcp4 0 0 109.175.135.5.49371 111.221.74.33.33033 ESTABLISHED
tcp4 0 0 109.175.135.5.49370 91.190.218.51.12350 ESTABLISHED
tcp4 0 0 localhost.49153 localhost.1023 ESTABLISHED
tcp4 0 0 localhost.1023 localhost.49153 ESTABLISHED
udp4 0 0 *.* *.*
udp6 0 0 *.56113 *.*
udp4 0 0 *.56113 *.*
udp6 0 0 *.55912 *.*
udp4 0 0 *.55912 *.*
udp6 0 0 *.62675 *.*
udp4 0 0 *.62675 *.*
udp6 0 0 *.50956 *.*
udp4 0 0 *.50956 *.*
udp6 0 0 *.54510 *.*
udp4 0 0 *.54510 *.*
udp4 0 0 *.61747 *.*
udp4 0 0 *.* *.*
udp4 0 0 localhost.60955 *.*
udp4 0 0 *.ssdp *.*
udp4 0 0 109.175.135.5.50254 *.*
udp4 0 0 localhost.53621 *.*
udp6 0 0 *.64385 *.*
udp4 0 0 *.64385 *.*
udp6 0 0 *.17148 *.*
udp4 0 0 *.17148 *.*
udp4 0 0 *.54545 *.*
udp4 0 0 *.* *.*
udp6 0 0 *.63293 *.*
udp4 0 0 *.63293 *.*
udp6 0 0 *.54801 *.*
udp4 0 0 *.54801 *.*
udp6 0 0 *.59257 *.*
udp4 0 0 *.59257 *.*
udp6 0 0 *.61487 *.*
udp4 0 0 *.61487 *.*
udp6 0 0 *.65337 *.*
udp4 0 0 *.65337 *.*
udp6 0 0 *.63848 *.*
udp4 0 0 *.63848 *.*
udp6 0 0 *.55333 *.*
udp4 0 0 *.55333 *.*
udp6 0 0 *.54736 *.*
udp4 0 0 *.54736 *.*
udp6 0 0 *.49996 *.*
udp4 0 0 *.49996 *.*
udp6 0 0 *.59224 *.*
udp4 0 0 *.59224 *.*
udp4 0 0 *.* *.*
udp4 0 0 109.175.135.5.ntp *.*
udp6 0 0 ripans-macbook-p.ntp *.*
udp6 0 0 localhost.ntp *.*
udp4 0 0 localhost.ntp *.*
udp6 0 0 localhost.ntp *.*
udp6 0 0 *.ntp *.*
udp4 0 0 *.ntp *.*
udp4 0 0 *.* *.*
udp4 0 0 *.* *.*
udp4 0 0 *.* *.*
udp4 0 0 *.* *.*
udp6 0 0 *.mdns *.*
udp4 0 0 *.mdns *.*
udp46 0 0 *.* *.*
udp4 0 0 *.netbios-dgm *.*
udp4 0 0 *.netbios-ns *.*
icm4 0 0 *.* *.*
icm6 0 0 *.* *.*
icm6 0 0 *.* *.*
Active LOCAL (UNIX) domain sockets
Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr
d9bcad5aa37ae9e1 stream 0 0 0 d9bcad5aa37affc1 0 0 /var/run/mDNSResponder
d9bcad5aa37affc1 stream 0 0 0 d9bcad5aa37ae9e1 0 0

----------

need help sooo bad.