Common loading points for viruses, worms, and Trojan horse programs on Mac

On the menu bar, click the Apple icon and select System Preferences.

Under the System pane, click Accounts and review the list of Mac user account.

You should disable the Guest Account, if the Administrator has not enabled it for any user of your Mac. Check any other user account that seems suspicious to ensure that it is a legitimate account for your Mac.

On the top-right corner of the Accounts window, to look for any suspicious login items that have loaded, click Login Items.

Review these items to verify that they are legitimate and logically named. Any login item that is suspicious and unknown should be investigated further. To reveal where on the drive the suspicious Login Item loads from, right-click on the item and select Reveal in Finder.

On the menu bar, click Go and select Go to Folder.

In the dialog box that appears, type the location of the folders exactly as they appear in the list, and click Go.

• /System/Library/LaunchAgents

• /System/Library/LaunchDaemons

• /System/Library/StartupItems

• /Library/LaunchAgents

• /Library/LaunchDaemons

• /Library/StartupItems

• ~/Library/LaunchAgents

• ~/Library/LaunchDaemons

The Property List files (.plist) that are in an XML format are displayed and can be reviewed with a text editor.

In the LaunchAgents and LaunchDaemon folders, search for any .plist files that are named suspiciously, and then double-click to open them in TextEdit.

In the TextEdit window, check for the <key>ProgramArguments</key> section to verify the location of the item loaded by the .plist file.

If these items appear to be unknown or suspicious, submit the samples of the files that the .plist loads to Norton Submission Portal.

On the menu bar, click Go, and then select Utilities.

Double-click Activity Monitor.

Review the list for any processes that look suspicious to investigate further.

In the top-right corner of the Activity Monitor, select one of the following from the drop-down menu:

• To look for the processes that are associated with the logged in user account, select My Processes.

• To check the processes that are associated with other user accounts on the Mac, select Other User Processes.

To verify the open files and ports from where this process originates and what files it uses, select a suspicious process, and click Inspect.

To quit the process, click Quit Process.