Hacker News Reader

Wouldn't malware be smart enough by now not to send stuff while Wireshark's running, or even to not send while the machine's actively being used?

Typically yes, but if it's communicating, it's got to do it somehow, which is why I added the caveat that op knows how to read a packet output.

I've heard great things from paranoids about Little Snitch on OS X.

I'm downloading it now. I deleted all the apps except the basic Mac apps. I'm going through the activity monitor trying to find things that don't look right.

There was a VPN client which I'm assuming he's used.

Well, at this point, it's all idle curiosity on her and your part. The first thing you should have done is image off a couple of copies of that drive. One for archive, the other to examine.

A ram snapshot would have been good as well.

Ah yeah. Good idea. I don't think it's really that big of a deal, I think she was just curious. I would be too. Everything looks ok for now though. I don't think he would be that smart working for a company around here.

LilSnitch will show all outgoing request