Some process does ICMP port scan on my OSX box and I am afraid my Mac got a virus

Posted by Jamgold on Super User See other posts from Super User or by Jamgold
Published on 2011-01-10T23:50:45Z Indexed on 2011/01/11 1:55 UTC
Read the original article Hit count: 324

Filed under:

osx

|

virus

|

icmp

I noticed that my 10.6.6 box has some process send out ICMP messages to "random" hosts, which concerns me a lot.

when doing a tcpdump icmp I see a lot of the following

15:41:14.738328 IP macpro > bzq-109-66-184-49.red.bezeqint.net: ICMP macpro udp port websm unreachable, length 36
15:41:15.110381 IP macpro > 99-110-211-191.lightspeed.sntcca.sbcglobal.net: ICMP macpro udp port 54045 unreachable, length 36
15:41:23.458831 IP macpro > 188.122.242.115: ICMP macpro udp port websm unreachable, length 36
15:41:23.638731 IP macpro > 61.85-200-21.bkkb.no: ICMP macpro udp port websm unreachable, length 36
15:41:27.329981 IP macpro > c-98-234-88-192.hsd1.ca.comcast.net: ICMP macpro udp port 54045 unreachable, length 36
15:41:29.349586 IP macpro > c-98-234-88-192.hsd1.ca.comcast.net: ICMP macpro udp port 54045 unreachable, length 36

I got suspicious when my router notified me about a lot of ICMP messages that don't get a response

Does anyone know how to trace which process (or worse kernel module) might be responsible for this?

I rebooted and logged in with a virgin user account and tcpdump showed the same results.

Any dtrace magic welcome.

Thanks in advance

© Super User or respective owner

Some process does ICMP port scan on my OSX box and I am afraid my Mac got a virus

Posted by Jamgold on Super User See other posts from Super User or by Jamgold
Published on 2011-01-11T00:39:29Z Indexed on 2011/01/11 0:55 UTC
Read the original article Hit count: 324

Filed under:

osx

|

virus

I noticed that my 10.6.6 box has some process send out ICMP messages to "random" hosts, which concerns me a lot.

when doing a tcpdump icmp I see a lot of the following

15:41:14.738328 IP macpro > bzq-109-66-184-49.red.bezeqint.net: ICMP macpro udp port websm unreachable, length 36
15:41:15.110381 IP macpro > 99-110-211-191.lightspeed.sntcca.sbcglobal.net: ICMP macpro udp port 54045 unreachable, length 36
15:41:23.458831 IP macpro > 188.122.242.115: ICMP macpro udp port websm unreachable, length 36
15:41:23.638731 IP macpro > 61.85-200-21.bkkb.no: ICMP macpro udp port websm unreachable, length 36
15:41:27.329981 IP macpro > c-98-234-88-192.hsd1.ca.comcast.net: ICMP macpro udp port 54045 unreachable, length 36
15:41:29.349586 IP macpro > c-98-234-88-192.hsd1.ca.comcast.net: ICMP macpro udp port 54045 unreachable, length 36

I got suspicious when my router notified me about a lot of ICMP messages that don't get a response

[INFO] Mon Jan 10 16:31:47 2011 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.1.189 to 212.25.57.90

Does anyone know how to trace which process (or worse kernel module) might be responsible for this?

I rebooted and logged in with a virgin user account and tcpdump showed the same results.

Any dtrace magic welcome.

Thanks in advance

© Super User or respective owner

Related posts about osx

OSX/Wine - Associating file extension (.php) with a Windows program on OSX

as seen on Super User - Search for 'Super User'
Greetings, I am running PSPad (a Windows programming editor) on OSX/Snow Leopard using Wine 1.1.35 I want to associate various file extensions (.php, .js, .html) with PSPad.exe OSX Finder does not allow this association -- I can only associate file types with $.app items in Applications. How do… >>> More
osx web service spawns icon in taskbar - osx - while drawing image

as seen on Stack Overflow - Search for 'Stack Overflow'
I have a web endpoint that displays an image of a string... When the following code is run (in tomcat) it spawns a java icon in the taskbar on OSX. Not sure if it is a problem, or whats going on. Looking for some sort of explination @RequestMapping("/text/{text}") public void textImage(HttpServletResponse… >>> More
Cannot disable spotlight indexing on volume

as seen on Super User - Search for 'Super User'
I have a FAT32 partition on my HDD. When using OSX, it is mounted to /Volumes/MEDIA. After a recent upgrade to Mavericks, spotlight is having trouble indexing it, eating up almost all of my system resources, and I cannot get the indexing to stop: [jay-mba-osx ~]% sudo mdutil -v -a -i off /: Indexing… >>> More
OSX - User home directories shared via NFS

as seen on Super User - Search for 'Super User'
Hi, I've run into some problems with how I've got user home directories set up on our system here. Our server is an XServe, using Open Directory to manage the user accounts. The majority of our workstations are OSX, but there are a few running Linux (Centos 5.3), and, as time goes on, we expect… >>> More
Can't connect to local IP address on OSX

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm trying to connect to a webserver that's running on my mac OSX 1.6. I'm able to connect to it locally using http://127.0.0.1:8888/myapp but when I attempt to connect to it using my machine's local IP address (http://192.168.1.15:8888/myapp IP shown below) from the same machine (or another on the… >>> More

Related posts about virus

virus behaviour but couldn't find any virus on windows7

as seen on Super User - Search for 'Super User'
Hi Friends, I found strange virus like behaviour on my pc running windows 7. I'm not able to type properly with my keyboard. Some times it won't respond, and some other times it adds characters indefinitely to the typing area. When i click on desktop it creates new folders. When press ctrl+N on a… >>> More
virus behaviour but couldn't find any virus on windows7

as seen on Super User - Search for 'Super User'
Hi Friends, I found strange virus like behaviour on my pc running windows 7. I'm not able to type properly with my keyboard. Some times it won't respond, and some other times it adds characters indefinitely to the typing area. When i click on desktop it creates new folders. When press ctrl+N on a… >>> More
How to know if your computer is hit by a dnschanger virus?

as seen on Super User - Search for 'Super User'
The Federal Bureau of Investigation (FBI) is on the final stage of its Operation Ghost Click, which strikes against the menace of the DNSChanger virus and trojan. Infected PCs running the DNSChanger malware at unawares are in the danger of going offline on this coming Monday (July 9) when… >>> More
AVG Anti-Virus Plus Firewall

as seen on Internet.com - Search for 'Internet.com'
AVG's real-time <a href = "http://www.winplanet.com/file/13384.htm">Anti-Virus scanner</a> paired with a powerful firewall for added security >>> More
AVG Anti-Virus Pro

as seen on Internet.com - Search for 'Internet.com'
Comprehensive, award-winning antivirus and antispyware protection for your PC >>> More