Mac® Security Bible

24.2. Looking for Rogue Processes

When you're examining a live Mac that may have unwanted software running, your ultimate goal may be to delete the software, but you have to find it first. This isn't as simple as it sounds because malware and hacks rarely appear as ordinary applications in the /Applications folder. Surprisingly enough, though, it may be easier to find software that's actively running than software that merely exists as a file on your disk — it (usually) has nowhere to hide.

Manually looking for unwanted software can provide lots of useful information, but it also involves a certain amount of guesswork and is rather time-consuming. In the vast majority of cases, simply running a good anti-malware program (see Chapter 14) is a faster and more direct solution.

The Activity Monitor utility is a good place to start because it's easy to use and helps you to narrow down the possible range of culprits quickly, as I describe next. However, to find a program based on its network activity, a more direct approach is to use a program called lsof (discussed just afterward).

When deleting troublesome files, the possibility also exists that you'll delete something you need (but didn't realize you need). Therefore, before doing anything, I strongly suggest that you create a backup ...