How to catch a malware process on my Mac?

Situation:

1st occurrence: without reason a new draft in mail opened up with non-sense text in the body, no TO,CC or subject
2nd and reoccurring every day around 2 PM: bing search with non-sense text

the text slightly changes but most of the time starts with "him him him him him ..."

I have Intego VirusBarrier running and cannot find anything suspicious in Console.

What software / tool can I use to monitor ALL interactions on my Mac in order to catch the offending process.

I am a software developer and can also read and understand manuals ;-) ... so if someone wants to point me at some UNIX foo ... I am game.

Yes, I know: best would be to backup all data and reinstall the machine. Based on previous experience that will screw about 1.5 days out of my life. ... I don't have that time, so I would rather like to identify and remove the offending process.

Sven

Posted 2011-11-29T19:25:46.623

Reputation: 181

2Read up on fs_usage, opensnoop, ps, netstat, dtrace. Check your crontabs and launchctl. Check out man syslog.conf and look into increasing the logging level. – Daniel Beck – 2011-11-29T19:30:17.053

I found the problem, although more by accident. The random text wasn't so random after all. It always contained some words or phrases that were previously discussed in the room. ... this is when I remembered that the issue started after I installed Dragon Express (dictation software). After not allowing Dragon to run in the background, the issue has not happened anymore. – Sven – 2011-12-18T15:59:15.593

This is cool. They took their approach to automation a bit far I guess ;) could you post that as an answer and accept it once possible, so the system no longer considers this question a answered? If you don't think the topic'll help others you can flag for moderator attention to have it closed or deleted. – Daniel Beck – 2011-12-18T16:06:24.290

How to catch a malware process on my Mac?

Answers