Ask Different is a question and answer site for power users of Apple hardware and software. It only takes a minute to sign up.
Sign up to join this community
About 3 months ago, my windows often suddenly closed and the cursor would move. So I deleted all the team viewer apps and closed all the Share options in System Preference. I checked within Activity Monitor and also used netstat -n in terminal, but I don't know how to use/understand it.
How can I know if my Mac was being remotely viewed?
I would actually use the "last" command.
$ last > ~/Desktop/last_users.txt
will output the results to a document on the desktop you can open up and have a look at. Really, you should see your own user, reboot (a pseudo-user that gets activated when rebooting the computer), and just about nothing else. I. personally have a "_mbsetupuser" that has to do with updating my OS, so you may have that as well.
If you see any usernames you don't recognize, that's a red flag. If you see your own user on a tty other than "console" that might be an issue. I'm not really great with netstat nor lsof, but here's an lsof primer. The reason to learn lsof (whether in conjunction with netstat or not) is that linux treats most things as files. lsof (short for "list open files") is a utility that helps you find out which files are open. If someone's watching your system, they're opening "files" to do it, and that utility will show you that, unless there's a rootkit in place and/or the lsof utility itself has been hacked/modified to not show their presence, which is unlikely.
See a primer I quite like here: https://danielmiessler.com/study/lsof/
