Mac Forum / General / Networking / July 2005

On 28/7/05 4:15 AM, in article
tomstiller-03EA0F.14154127072005@comcast.dca.giganews.com, "Tom Stiller"
<tomstiller@comcast.net> wrote:

This is what is so intriguing Tom. I am not at all expert but I am trying to
learn. I have purchased several books on OSX and Unix and am struggling a
bit, but getting more experienced. I have booted the system in verbose mode,
looked at the the start-up sequence and don't see nmbd starting, but a few
minutes later it is running. I look at it in the activity monitor and it
says that the parent process is msinit but I can't FIND msinit. It isn't
running. It is as though I have a hidden program that is mimicking another
application or somehow fooling the OS, or at least fooling the Activity
Monitor. The only google references to msinit are to windows exe files and
they certainly wouldn't be running on a Mac. VPC wasn't running so they
wouldn't be running there either.

I need to learn a lot more.

Judging by the way the addresses that it attempts to contact resolve, it has
to be something nefarious. I have done a port scan and I only have three
ports open, time server and dns etc. I have verbose logging on and have
checked very carefully, but nothing untoward has attempted to gain access. I
had thought that something was triggering nmbd but nothing seems to be. I
have searched my hard drive with some of the addresses that it has tried to
reach - a very very slow process, but nothing came up. I am lost. I don't
know what is starting it, and I don't know where it is being feed addresses
from, and I don't know its purpose. I have allowed it to send packets out a
couple of times, wondering if I would log some response to it, but nothing
seems to happen. I certainly don't get responses logged from any of the
addresses it seeks out. I have scanned the addresses and ports that it tries
to reach using the network utility and those ports are usually open.

I feel that whatever it is, it probably came as a result of Virtual PC. When
I first installed Virtual PC, it was turning the Firewall off, a problem
noted in several MS virtual PC discussion areas. I would try to start the
firewall manually and it would put a message up that another firewall was
running and then shut down. When I became aware of the problem, I disabled
VPC's networking and it stopped turning the firewall off, but maybe
something got into the system before I did something about it.

I have possibly been too confident that Macs and OSX are not at risk from
trojans and viruses the way PCs are. An ex boyfriend always told me that
Macs didn't have to worry about these thing. It would not have been the only
thing that he was wrong about. ;)

V.

On 28/7/05 1:16 AM, in article slrndef9ap.mh2.jim@odin.magrathea.local,

How would the worm be accessing my computer? I have a firewall and it is an
Apple Macintosh iBook, not a windows system. In order for it to respond, the
worm would have to pass a firewall with no ports but the bare minimum open.
My firewall log doesn't seem to have refused anything within the same time
periods as the nmbd attempts to get out. If anything, it would have to be a
sneaky program that is hidden on my computer and trying regularly to do
something. None of the addresses that it is trying to reach are in my
address book, so I can't make sense of it.

The only software that I have put on my computer that isn't commercial are
some puzzle and card games and I always scan them with Virex before
installing them. Oh, and I have some different language dictionaries also,
but they were virus/trojan checked by Virex before mounting.

This is the first time that I have seen anyone else make comment about the
problem although the fellow in the Apple Computer store in Lyons said he had
heard of other people with the same problem. He thought that it might be
something that Microsoft was doing sneakily, but I don't think so.

V.

Ethereal - http://www.ethereal.com

Works under most UNIXes (including OS X) and Windows.

alex

http://personalpages.tds.net/~brian_hill/

m-