Is my mac hacked? Found weird things
The line
stty -onlcr -echo echonl
and the repeated
/usr/bin/atos -p "XXX" -printHeader
comes from the stackshot program that is used to produce a stack dump for all running processes.
I found same entries in my log and got really suspicious, but after some googling around I found out that pressing Control-Option-Command-Shift-Period (at the same time) starts stackshot, which to my surprise actually produces these entries in /var/root/.sh_history
.
I would appreciate if someone who knows more about OS X could explain why a shell script performing in the background does this.
For me this must have been happening when I (stupidly enough) decided to clean my keyboard while the Mac was running. :)
It does indeed sound like someone has been messing with your Mac. Unless you have an ssh server running to allow remote access it does sound like it is someone who had physical access to your computer. It was probably a good idea to change your passwords, you should also make sure the computer is locked when you are not around so other people don't have access to it. Also, keep in mind every machine is hack-able with the right skills, so your best bet is to regularly check for strange things that don't look right. I think you did a great job catching it.