How JustAnswer Works:
  • Ask an Expert
    Experts are full of valuable knowledge and are ready to help with any question. Credentials confirmed by a Fortune 500 verification firm.
  • Get a Professional Answer
    Via email, text message, or notification as you wait on our site.
    Ask follow up questions if you need to.
  • 100% Satisfaction Guarantee
    Rate the answer you receive.
Ask Johnny Mack Your Own Question
Johnny  Mack
Johnny Mack, Mac Support Specialist
Category: Mac
Satisfied Customers: 1353
Experience:  6 years repairing macs and ipods and 3rd level tech support
28647879
Type Your Mac Question Here...
Johnny Mack is online now

How do I check whether my computers been compromised on a

Resolved Question:

How do I check whether my computer's been compromised on a mac as I believe my computer is currently being hacked as contents are randomly deleted.
Submitted: 3 years ago.
Category: Mac
Expert:  Johnny Mack replied 3 years ago.
Hello there! Is there anything else missing or changed? like your email password ? While your answer this questions run the program below to see if you do have any infections on your mac.

http://www.avast.com/en-us/free-antivirus-mac
Customer: replied 3 years ago.

No i don't believe there is an infection.


 


This is a case where messages sent and received on iMessage are all deleted together randomly in one go.

Expert:  Johnny Mack replied 3 years ago.
I understand. The first thing we should do then is make sure your messages are still there to verify if its the messages file that is causing the problem or the application.

Do this steps and let me know the outcome


In the Finder > Go Menu > Go to Folder can you type ~/Library in to the Dialogue Box that appears.
Then find the Messages folder.

In here Open With TextEdit the chat.db item.
This will show all your current saved messages on imessage.


The in imessages do the following


With the Messages window as the front window check the View Menu > Buddy Names and the Show option currently in use.
Try changing it to Names (rather than Handles)
Also in the same View Menu > Messages check the option to Show there as well.
then restart and check your messages.

Expert:  Johnny Mack replied 3 years ago.
I forgot to add this. If you messages still do not show up please do the following

1.

Make sure Messages app is setup to save your history.

Step 2: Go to the Archive folder

Open Finder. In the menu bar, click on “Go” and click “Go to Folder…”.

How To Save iChat Messages Text and Attachments in OS X Mountain Lion
Mac OS X Go to Folder – Shift Command G
Type in ~/Library/Messages/Archive and click the “Go” button.

How To Save iChat Messages Text and Attachments in OS X Mountain Lion
iChat Messages Go To Archive Folder
This command will take you directly to the iChat/Messages Archive folder in the current Finder window.

How To Save iChat Messages Text and Attachments in OS X Mountain Lion
iChat Messages Archive
Step 3: Backup

Now that you’re in the right location, you have a few options:

Create a full backup
Right click the Messages folder
Click Compress “Messages”
Move the created .zip file to your desired backup storage location
Find the one or few items you’re specifically looking for and copy/paste or compress
Navigate to the Attachments folder (located in the Messages folder, alongside the Archive folder — see previous screenshot) to browse for image and other attachment files
To filter for all attachments (since they’re nested pretty deeply), type Command+F, click Search: “Attachments”, and specify Kind is Image.



Run Messages through Terminal (Desktop -> Go -> Utilities -> Terminal) with the following command:
/Applications/Messages.app/Contents/MacOS/Messages -errorLogLevel 7

Confirm that an error similar to this appears: 2013-10-27 15:59:16.465 Messages[666:507] Chat history path

/Users/username/Library/Containers/com.apple.iChat/Data/Library/Messag
es/Archive Status: 3 totalExpected: 162740 countProcessed: 29344, forcing an import.
If so, quit Messages. If not, stop reading. This won’t help you.
Move the Archive folder in ~/Library/Containers/com.apple.iChat/Data/Library/Messages to your Desktop
Run Messages with the same command in Step 1.
That log should now contain this instead: Status: 0 totalExpected: 0 countProcessed: 0, forcing an import.
If so, quit Messages.

Open the Archive folder you moved to your Desktop.

Copy all of the contents of the Archive folder on your desktop and paste them in~/Library/Containers/com.apple.iChat/Data/Library/Messages/Archive
Run Messages and confirm your prior history is present and new history is being saved.
Customer: replied 3 years ago.

Ok this is the situation, I have looked at the chat logs, all the the messages which disappeared on iMessage are still here. However, following your instructions on iMessages, the messages still don't show on the Mac itself.


 


I believe, my apple ID password XXXXX have been compromised, but, where do i check full details of people loggin into my account?

Expert:  Johnny Mack replied 3 years ago.
Unfortunately we have no way of getting that info. The only time is if they get your password XXXXX and your locked out. You can however change your password XXXXX something more complex to make sure that noone is accessing your apple id.
Customer: replied 3 years ago.

Ok this is the situation, I have looked at the chat logs, all the the messages which disappeared on iMessage are still here. However, following your instructions on iMessages, the messages still don't show on the Mac itself.


 


Ok according to this situation itself, does it mean that my iMessage application could be compromised? Since the messages don't appear on the application but on the logs?


Expert:  Johnny Mack replied 3 years ago.
The current database is more then likely corrupted. we can restore it though since you were able to see the msgs in the archived box

First lets close imessages then go to XXXXX /Library/Messages/Archive ( or go then library/messages/archive)

Copy the chat.db file to your desktop

Then go to the following folder

/Library//Containers/com.apple.iChat/Data/Library/Messages ( again starting from go or from the mac hd icon.) And replace the file that is there with the on one your desktop. Then restart and imessage will have all the messages that we saw in text edit :)
Customer: replied 3 years ago.

The only thing in the folder is Container.plist, do I replace that?

Expert:  Johnny Mack replied 3 years ago.
It shoulds just be the chat.db. Its weird that its not in that second location but go ahead and add the file there anyways as that is the location of where imessages gets its message history.
Customer: replied 3 years ago.

Added but the messages still don't show.

Expert:  Johnny Mack replied 3 years ago.
CAn you tell me what version of mac osx your running?


From the Apple () menu, choose About This Mac.
Click the Version number underneath where the window says "OS X". The About This Mac window then displays your OS X version number in place of the version number.
Customer: replied 3 years ago.

10.9.2

Expert:  Johnny Mack replied 3 years ago.
Ok lets go back to where the archived box is and copy the Archive folder, the Attachments folder, and the three .db files to the ~/Library/Messages
Customer: replied 3 years ago.

Done, then?

Expert:  Johnny Mack replied 3 years ago.
reset your mac and open up imessages.
Customer: replied 3 years ago.

What do you mean by resetting

Expert:  Johnny Mack replied 3 years ago.
Sorry i mean turn off your mac then turn it on again.
Customer: replied 3 years ago.

Wait after copying the three folders do I put it some where?

Expert:  Johnny Mack replied 3 years ago.
yes to the library/messages folder.

We would copy them from library/messages/archive to just library/messages
Customer: replied 3 years ago.

Weird thing is that once I changed my apple ID password, it appears that, the iMessage is behaving normal without any messages being deleted and synchronising perfectly with the phone. Possibly someone deleting my data using my Apple ID?

Expert:  Johnny Mack replied 3 years ago.
The more likely thing is Icloud sync'd up your messages from its back up setting everything correctly. Just make sure to stay logged in and the messages will always be saved :). Also please make sure to rate my answer.
Johnny Mack and other Mac Specialists are ready to help you