KnockKnock

KnockKnock shows you what's persistently installed on your Mac!

Malware installs itself persistently, to ensure it is automatically executed each time a computer is restarted. KnockKnock (UI) uncovers persistently installed software in order to generically reveal such malware. If the item is an executable binary, KnockKnock automatically queries VirusTotal with a hash of the binary in order to retrieve any information.

• Added plugin: extensions and widgets (Finder Syncs, etc)
• Improved UI to show if persistent binaries are packed or 'OS X'-encrypted
• Launch Daemon/Agent plugin extended to lists items with 'StartInterval'/'StartCalendarInterval' keys
• Launch Daemon/Agent improved to use 'Program' key (over 'ProgramArguments') when both are present
• Compliled in latest mach-O parser (bug fixes, etc)
• Signing authorities now ignored if code signing checks fail
• Updated hashes and whitelisting for OS X 10.11.5
• Fixed bug when processing VirusTotal results in plugins that enumerate files and commands
• Added plugin: period scripts
• Added plugin: OS startup scripts (/etc/rc*, etc)
• Improved browser extension plugin for newer versions of Firefox and Safari
• Improved login/out hook plugin as payload can be file *or* command
• Improved code signing checks (flags: kSecCSCheckNestedCode|kSecCSStrictValidate)
• Updated whitelist for El Capitan
• UI fixes, such as file name extraction (via Info.plist when possible, etc.
• Updated crontab plugin, so it would ignore commented out jobs
• Made application fully resizable
• Improved 'inserted dylibs' plugin (now checks for __XPC_DYLD_INSERT_LIBRARIES)
• Added self verification check so malicious modifications (e.g. whitelists) may be detected
• Updated whitelist hashes for El Capitan
• Fixed bug where VirusTotal timeout could trigger crash
• Added Cron Job plugin
• Added Login/Logout Hook plugin
• Improved Launch Daemon/Agent plugin (now includes items with 'OnDemand' set to False)
• Apple-signed binaries now shown with green 'signed' icon
• Fixed issue with copy and paste (via NSApplicationKeyEvents subclass)
• Updated whitelist to include various Apple binaries (kexts)
• When saving results, user can now specify name and location of output
• Network availability now checked before trying to connect to VirusTotal
• Other minor UI tweaks/improvement (e.g. fixed text color issue in unselected rows, etc.)
• Extra error checking to improve stability
• Made preferences persistence
• Fixed logic bug where re-scans might hang
• Added extra error checking in launch item plugin