Re: [WISPA] Mt and Macintosh virus
Exelent tip, thanks Scott - Original Message - From: "D. Ryan Spott" To: "WISPA General List" Sent: Friday, March 27, 2009 1:21 PM Subject: Re: [WISPA] Mt and Macintosh virus > Have your customer run this in a terminal window (the terminal window is > found in Applications/Utilities): > > sudo netstat -a > > Have the customer copy and paste EVERYTHING (they will have to scroll > up)! into an email and send it to you. Take a look and see what apps are > making these connections. > > ryan > > Scott Piehn wrote: >> We are seeing something from our Macintosh users only, they are >> establishing 200 - 1000 connections in IP/Firewall/Connections. >> Connection source is port 80. Some go to Google, yahoo, and RIPE Network >> in Amsterdam, etc. >> >> Had one user run a virus scan, said came up clean >> . >> >> anyone else seeing this or know what is going on >> >> >> Scott Piehn >> >> >> >> WISPA Wants You! Join today! >> http://signup.wispa.org/ >> >> >> WISPA Wireless List: wireless@wispa.org >> >> Subscribe/Unsubscribe: >> http://lists.wispa.org/mailman/listinfo/wireless >> >> Archives: http://lists.wispa.org/pipermail/wireless/ >> > > > > WISPA Wants You! Join today! > http://signup.wispa.org/ > > > WISPA Wireless List: wireless@wispa.org > > Subscribe/Unsubscribe: > http://lists.wispa.org/mailman/listinfo/wireless > > Archives: http://lists.wispa.org/pipermail/wireless/ > WISPA Wants You! Join today! http://signup.wispa.org/ WISPA Wireless List: wireless@wispa.org Subscribe/Unsubscribe: http://lists.wispa.org/mailman/listinfo/wireless Archives: http://lists.wispa.org/pipermail/wireless/
Re: [WISPA] Mt and Macintosh virus
If it's a novice user you'd want to do something like sudo netstat -a > ~/myconnections.txt Then have them email ~/myconnections.txt (note this is the *nix method, I don't know if Mac has a ~ for their home directory. Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 Those who don't understand UNIX are condemned to reinvent it, poorly. --- Henry Spencer On Fri, Mar 27, 2009 at 2:21 PM, D. Ryan Spott wrote: > Have your customer run this in a terminal window (the terminal window is > found in Applications/Utilities): > > sudo netstat -a > > Have the customer copy and paste EVERYTHING (they will have to scroll > up)! into an email and send it to you. Take a look and see what apps are > making these connections. > > ryan > > Scott Piehn wrote: > > We are seeing something from our Macintosh users only, they are > establishing 200 - 1000 connections in IP/Firewall/Connections. Connection > source is port 80. Some go to Google, yahoo, and RIPE Network in Amsterdam, > etc. > > > > Had one user run a virus scan, said came up clean > > . > > > > anyone else seeing this or know what is going on > > > > > > Scott Piehn > > > > > > > > > WISPA Wants You! Join today! > > http://signup.wispa.org/ > > > > > > > WISPA Wireless List: wireless@wispa.org > > > > Subscribe/Unsubscribe: > > http://lists.wispa.org/mailman/listinfo/wireless > > > > Archives: http://lists.wispa.org/pipermail/wireless/ > > > > > > > WISPA Wants You! Join today! > http://signup.wispa.org/ > > > > WISPA Wireless List: wireless@wispa.org > > Subscribe/Unsubscribe: > http://lists.wispa.org/mailman/listinfo/wireless > > Archives: http://lists.wispa.org/pipermail/wireless/ > WISPA Wants You! Join today! http://signup.wispa.org/ WISPA Wireless List: wireless@wispa.org Subscribe/Unsubscribe: http://lists.wispa.org/mailman/listinfo/wireless Archives: http://lists.wispa.org/pipermail/wireless/
Re: [WISPA] Mt and Macintosh virus
Have your customer run this in a terminal window (the terminal window is found in Applications/Utilities): sudo netstat -a Have the customer copy and paste EVERYTHING (they will have to scroll up)! into an email and send it to you. Take a look and see what apps are making these connections. ryan Scott Piehn wrote: > We are seeing something from our Macintosh users only, they are establishing > 200 - 1000 connections in IP/Firewall/Connections. Connection source is port > 80. Some go to Google, yahoo, and RIPE Network in Amsterdam, etc. > > Had one user run a virus scan, said came up clean > . > > anyone else seeing this or know what is going on > > > Scott Piehn > > > > WISPA Wants You! Join today! > http://signup.wispa.org/ > > > WISPA Wireless List: wireless@wispa.org > > Subscribe/Unsubscribe: > http://lists.wispa.org/mailman/listinfo/wireless > > Archives: http://lists.wispa.org/pipermail/wireless/ > WISPA Wants You! Join today! http://signup.wispa.org/ WISPA Wireless List: wireless@wispa.org Subscribe/Unsubscribe: http://lists.wispa.org/mailman/listinfo/wireless Archives: http://lists.wispa.org/pipermail/wireless/
Re: [WISPA] Mt and Macintosh virus
My guess is that the Mac users don't tell the connections to close correctly. From what everyone keeps saying it should have the same TCP stack as some *nix kernel, but I have always felt it different. If you kill their connections, do they come right back? Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 Those who don't understand UNIX are condemned to reinvent it, poorly. --- Henry Spencer On Fri, Mar 27, 2009 at 2:06 PM, Scott Piehn wrote: > We are seeing something from our Macintosh users only, they are > establishing 200 - 1000 connections in IP/Firewall/Connections. Connection > source is port 80. Some go to Google, yahoo, and RIPE Network in Amsterdam, > etc. > > Had one user run a virus scan, said came up clean > . > > anyone else seeing this or know what is going on > > > Scott Piehn > > > > > WISPA Wants You! Join today! > http://signup.wispa.org/ > > > > WISPA Wireless List: wireless@wispa.org > > Subscribe/Unsubscribe: > http://lists.wispa.org/mailman/listinfo/wireless > > Archives: http://lists.wispa.org/pipermail/wireless/ > WISPA Wants You! Join today! http://signup.wispa.org/ WISPA Wireless List: wireless@wispa.org Subscribe/Unsubscribe: http://lists.wispa.org/mailman/listinfo/wireless Archives: http://lists.wispa.org/pipermail/wireless/
