5

I'm tailing var/log/sys.log and I keep getting this message:

Jul 13 23:43:52 mac[redacted lol] syslogagent[19960]: Authentication String htt[space added]p://logsviewer.com/membermac/livedesk/arewelive.php?username=

Jul 13 23:43:53 mac[...] syslogagent[19960]: {

every 25 seconds or so.

Sometimes it'll include a string of numbers such as:

Jul 13 17:50:41 mac[...] syslogagent[19960]: Authentication String htt[space added]p://logsviewer.com/membermac/livedesk/arewelive.php?username=

Jul 13 17:50:41 mac[...] syslogagent[19960]: 2147483647

Jul 13 17:50:42 mac[...] syslogagent[19960]: {

And as I was writing this it changed (for the first time since I caught it about 9 hours ago today, although after the tail logfile turned over and I restarted it) its process ID number to [21174]

After some intensive googling I found out that this URL roughly matches that which occurs in the SniperSpy spyware program.

First of all, am I correct. Second of all, I ran Sophos and nothing came up. Third, is it even functionally installed because the message makes it seem like it maybe didn't get fully installed. Fourth, how do I remove it?

soren
  • 51

1 Answers1

2

There's a huge possibility that you have a spyware. Please check this link.

It is an Application named "SysLogAgent" which is hidden in your home folder along with files to launch it at startup and when you log in and none of them were detected as infected.

How to remove (Spyware.SniperSpy.B - Removal)? Please check this link.

Matt Komarnicki
  • 1,698
  • @soren After removing Spyware.SniperSpy.B check the app(s) you installed on 13th of July and/or the website(s) you visited immediately before you got infected. – klanomath Jul 14 '15 at 11:51