Odd possible Trojan, OS/X 10.7.2, Mail and Safari

Question

I started seeing odd behavior on both an iMac and MBA running 10.7.2 in the past week to ten days. Every once in a while either a new Safari window wil pop up, or a new blank email window will appear. If it is Safari, a search will have been initiated, and if it is Mail, the message text will be filled in. In both cases the string being filled in contains a large number of the word 'him'. For example:
So. And it to you in unit and in and in him and him and him and him him and him him him him him him him him him him him him him him him or her own will and you are and hope for is that I now may you know it is. You know who begins the story I think that visitors will surrounding area, and the inherent
The string appears to be random, meaning that I don't believe I've seen the same one twice.
ClamAV didn't find anything on a scan, and Little Snitch isn't showing anything unusual, either. The two machines are pretty close to each in therms of installed software, but I can't think of anything recently that I installed on both.
I'm pretty baffled...I teach graduate-level computer science courses, including networking, operating systems, and security, but this has me stumped.
Has anyone seen this one?
Perry

Answer 1

Thanks for the quick response. Not seeing anything that unusual, except perhaps two entries for Flash Player; one for Safari and one for Chrome, maybe?
Perry
:~ $ kextstat -kl | awk ' !/apple/ { print $6 $7 } '
at.obdev.nke.LittleSnitch(2.4.4)
com.parallels.kext.prl_netbridge(6.0
com.parallels.kext.prl_vnic(6.0
com.bresink.driver.BRESINKx86Monitoring(8.0)
com.parallels.kext.prl_usb_connect(6.0
com.parallels.kext.prl_hypervisor(6.0
com.parallels.kext.prl_hid_hook(6.0
:~ perryd$ sudo launchctl list | sed 1d | awk ' !/0x|apple|com\.vix|edu\.|org\./ { print $3 } '
com.dragon.express.kprs-service
com.dragon.express.sevn-service
com.dragon.express.logi-service
com.dragon.express.gurl-service
com.parallels.vm.prl_naptd
com.openssh.sshd
com.parallels.desktop.launchdaemon
com.microsoft.office.licensing.helper
com.cocoatech.pathfinder.SMFHelper
com.bombich.ccc
com.barebones.textwrangler
com.adobe.SwitchBoard
at.obdev.littlesnitchd
:~ perryd$ launchctl list | sed 1d | awk ' !/0x|apple|edu\.|org\./ { print $3 } '
com.agilebits.onepassword-osx-helper
net.culater.SIMBL.Agent
com.parallels.vm.prl_pcproxy
com.parallels.desktop.client.launch
com.brother.LOGINserver
at.obdev.LittleSnitchUIAgent
at.obdev.LittleSnitchNetworkMonitor
com.google.keystone.user.agent
com.adobe.ARM.a07a5dc52b60251866873a0fdd37594b79a2d8502345e4ec54417ad0
com.adobe.AAM.Scheduler-1.0
:~ perryd$ ls -1A {,/}Library/{Ad,Compon,Ex,Fram,In,La,Mail/Bu,P*P,Priv,Qu,Scripti,Servi,Sta}* 2> /dev/null
/Library/Components:
/Library/Extensions:
/Library/Frameworks:
AEProfiling.framework
AERegistration.framework
Adobe AIR.framework
AudioMixEngine.framework
ExtensisPlugins.framework
MacFUSE.framework
NyxAudioAnalysis.framework
PluginManager.framework
iLifeFaceRecognition.framework
iLifeKit.framework
iLifePageLayout.framework
iLifeSQLAccess.framework
iLifeSlideshow.framework
/Library/Input Methods:
/Library/Internet Plug-Ins:
AdobePDFViewer.plugin
Flash Player.plugin
JavaAppletPlugin.plugin
Quartz Composer.webplugin
QuickTime Plugin.plugin
SharePointBrowserPlugin.plugin
SharePointWebKitPlugin.webplugin
SnagitSafariScroller.webplugin
flashplayer.xpt
iPhotoPhotocast.plugin
nsIQTScriptablePlugin.xpt
/Library/LaunchAgents:
at.obdev.LittleSnitchNetworkMonitor.plist
at.obdev.LittleSnitchUIAgent.plist
com.adobe.AAM.Updater-1.0.plist
com.brother.LOGINserver.plist
com.parallels.desktop.launch.plist
com.parallels.vm.prl_pcproxy.plist
net.culater.SIMBL.Agent.plist
/Library/LaunchDaemons:
at.obdev.littlesnitchd.plist
com.adobe.SwitchBoard.plist
com.apple.remotepairtool.plist
com.barebones.textwrangler.plist
com.bombich.ccc.plist
com.cocoatech.pathfinder.SMFHelper.plist
com.microsoft.office.licensing.helper.plist
com.parallels.desktop.launchdaemon.plist
/Library/PreferencePanes:
MacFUSE.prefPane
/Library/PrivilegedHelperTools:
com.barebones.textwrangler
com.bombich.ccc
com.cocoatech.pathfinder.SMFHelper
com.microsoft.office.licensing.helper
/Library/QuickLook:
GBQLGenerator.qlgenerator
ParallelsQL.qlgenerator
iWork.qlgenerator
/Library/QuickTime:
AppleIntermediateCodec.component
AppleMPEG2Codec.component
iWebcameraX.component
macam.component
/Library/ScriptingAdditions:
Adobe Unit Types.osax
SIMBL.osax
/Library/StartupItems:
BRESINKx86Monitoring
ChmodBPF
Library/Address Book Plug-Ins:
Contents
EndiciaABAction.bundle
Library/Extensis:
Suitcase Fusion
com.extensis.FMCore-LaunchInfo.conf
Library/Frameworks:
EWSMac.framework
Library/Input Methods:
.localized
Library/Internet Plug-Ins:
Library/LaunchAgents:
com.adobe.AAM.Updater-1.0.plist
com.adobe.ARM.a07a5dc52b60251866873a0fdd37594b79a2d8502345e4ec54417ad0.plist
com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.929667D6-F8C4-4210-BC6D-348 3B9C26F8D.plist
[email protected]
com.google.keystone.agent.plist
com.linotype.FontFolderProtector.plist
Library/PreferencePanes:
Printopia.prefPane
Library/Services:
Import into NOOK for Mac.workflow
Unzip ePub.workflow
Zip Epub.workflow