What security products are suggested for scrubbing rootkits from a Mac? There are good articles on similar repair for PCs and it makes me want to see if I can save this machine. It's in forensic recovery right now so I myself have not done anything yet.

Question

What security products are suggested for scrubbing rootkits from a Mac? There are good articles on similar repairs for other makes online. I would like to investigate whether a machine can be truly scrubbed or if it's best to retire it. I haven't done anything yet as it is a candidate for more extensive forensic recovery.
Also, I am not sure if various malicious spoofing and cloaking tricks (making Wi-Fi appear off when it is on, hiding unauthorized sharing/remote access, falsifying System Preferences preference panes, etc.) are resolved by a thorough drive erase or are more similar to APTs?
Finally, is there any emerging information regarding APT hiding places other than the recovery partition? I have heard mention of the EFI, for example, but it seems unproven and unlikely. Some people have also mentioned the RAM.
This is an upsetting topic to some people, including me, so I appreciate circumspect, measured responses. Thanks! And don't try to answer all my questions if you really just want to comment or answer one. All thoughts are appreciated.

Answer 1

Hi, Lincoln,
A straightforward question. You are correct in recognizing the difference between tentative conclusion and certainty. Here are our main reasons:
1. Incoming items noted on the console (or console sub logs) and Activity Monitor after defenses are overcome, and which are brought in by an unwelcome remote user, often have a process name and the word "kit." (Bear with me.) We soon observe the process is under attack, from terminal evidence and soon, decreased or lost functionality of the process. The terminal generally reports alteration of specific kernel behaviors. A simple example (that may or may not be accompanied by kernel changes and may simply alter permissions) is modifying Disk Utility such that key uses are unavailable. You can see how an attacker might value disabling partition views, mounting and permission repair. In retrospect, DU might not be a root alteration. I was thinking that its relation to fsck flagged it as a possible ring 0 item. I may need to know core parameters of a good example to pick strong ones.
2. Incoming folders hidden for possible later use contained bundles of similar root kits, including some not applicable to Macs. From what I have read from reasonably credible sources, root kits are sold and traded both singly and in bundles.
3. Root kits are a logical next choice for our attackers, as various prior techniques hindered us but did not paralyze us.
4. One of the most authoritative articles I found was about PCs not Macs. I noted the assertion, undocumented, that an estimated one million computers are infected by root kit manipulations, and underscored that the kits can be used by people with low computer skills.
5. MacAfee lists root kits (by description, not name) as a top pop five threat prediction in the coming year, though again, the emphasis is on PCs.
Linc, I am trying to show a spectrum of observations and info that have shaped my thinking. To retrieve better captured evidence requires significant legwork at this time, but it is something I am willing to do if you can be patient. Understand this long attack has been like a natural disaster to us.
I have not linked a few articles of interest because I forget if that's allowed. If so, I'd be glad to.
After reviewing this partial answer, you may form another hypothesis. If so, please share it. I am comfortable with my position but not clinging to it.
Thanks for your interest. Looking forward to your thoughts.
Oh, yeah: some material is out for analysis, so we should have credible opinions pretty soon. Not positive exactly when.