Spyware / Trojan ???

S

snowrider

Membre actif
14 Janvier 2005
790
22
Swiss
bonjour
depuis quellque jours j'ai en permance un download de 2 -3 K/sec avec os X 10.3.9

je le voit grace a menumeters

ce qui est bizarre c'est que je l'ai aussi instantanéement au re demarage sans que safari , mail ou n'importe quoi soit lancé.

j'aimerais bien savoir ce qui se passe ..

de plus little snitch ne m'a pas envoyé d'alerte donc je ne comprends pas

en plus j'ai activé le firewall !

si quelqu'un a une idée ?
 
Peut-être as-tu des widgets Konfabulator ou Dashboard ? Peut-être as-tu installé cette saleté de RealPlayer ?
Ouvre ton moniteur d'activité pour identifier tous les processus présents.

Au pire, réinitialise la base de Little Snitch : sans doute un programme que tu as déjà autorisé fait du trafic. Tu pourras ainsi t'en rendre compte.
 
1) fait une liste de tes processus avec le moniteur d'activité et poste-la, histoire de voir si quelque chose nous donnera de l'inspiration
2) réinitialise LittleSnitch pour voir qui demande à sortir
3) éventuellement, regarde dans "/etc/hostconfig" pour voir quels sont les services usuels ouverts
 

alors au boot dans la console


Nov 17 17:02:30 localhost syslogd: kernel boot file is /mach_kernel
Nov 17 17:02:30 localhost kernel: standard timeslicing quantum is 10000 us
Nov 17 17:02:30 localhost kernel: vm_page_bootstrap: 253707 free pages
Nov 17 17:02:30 localhost kernel: mig_table_max_displ = 68
Nov 17 17:02:30 localhost kernel: IOKit Component Version 7.9:
Nov 17 17:02:30 localhost kernel: Wed Mar 30 20:07:52 PST 2005; root(rcbuilder):RELEASE_PPC/iokit/RELEASE
Nov 17 17:02:30 localhost kernel: Copyright (c) 1982, 1986, 1989, 1991, 1993
Nov 17 17:02:30 localhost kernel: The Regents of the University of California. All rights reserved.
Nov 17 17:02:30 localhost kernel:
Nov 17 17:02:30 localhost kernel: using 2621 buffer headers and 2621 cluster IO buffer headers
Nov 17 17:02:30 localhost kernel: AppleCPUThermo couldn't parse platform functions
Nov 17 17:02:30 localhost kernel: USBF: 15.727 AppleUSBOHCI[0x1a57000]::start OHCI controller will be unloaded across sleep
Nov 17 17:02:30 localhost kernel: USBF: 15.791 AppleUSBOHCI[0x1b41000]::start OHCI controller will be unloaded across sleep
Nov 17 17:02:30 localhost kernel: Local FireWire GUID = 0x110600:0x3243
Nov 17 17:02:30 localhost kernel: Local FireWire GUID = 0xa95ff:0xfe93bf5a
Nov 17 17:02:30 localhost kernel: Security auditing service present
Nov 17 17:02:30 localhost kernel: BSM auditing present
Nov 17 17:02:30 localhost kernel: From path: "/pci@f4000000/ata-6@D/@0:9,\mach_kernel", Waiting on <dict ID="0"><key>IOPathMatch</key><string ID="1">IODeviceTree:/pci@f4000000/ata-6@D/@0:9</string></dict>
Nov 17 17:02:30 localhost kernel: Got boot device = IOService:/MacRISC2PE/pci@f4000000/AppleMacRiscPCI/ata-6@D/AppleKauaiATA/ATADeviceNub@0/IOATABlockStorageDriver/IOATABlockStorageDevice/IOBlockStorageDriver/IBM-IC35L090AVV207-0 Media/IOApplePartitionScheme/Untitled@9
Nov 17 17:02:30 localhost kernel: BSD root: disk0s9, major 14, minor 11
Nov 17 17:02:31 localhost kernel: Jettisoning kernel linker.
Nov 17 17:02:31 localhost kernel: Resetting IOCatalogue.
Nov 17 17:02:31 localhost kextd[85]: registering service "com.apple.KernelExtensionServer"
Nov 17 17:02:34 localhost kernel: Matching service count = 0
Nov 17 17:02:36 localhost kernel: AppleRS232Serial: 0 0 AppleRS232Serial::start - returning false early, Connector or machine incorrect
Nov 17 17:02:36 localhost kernel: rtclock timebase_callback: late old 1000000000 / 41656969 new 1000000000 / 41656700
Nov 17 17:02:39 localhost kernel: UniNEnet: Ethernet address 00:0a:95:93:bf:5a
Nov 17 17:02:41 localhost kernel: IOFireWireIP: FireWire address 00:11:06:00:00:00:32:43
Nov 17 17:02:41 localhost kernel: IOFireWireIP: FireWire address 00:0a:95:ff:fe:93:bf:5a
Nov 17 17:02:41 localhost SystemStarter: Bienvenue sur Macintosh.
Nov 17 17:02:41 localhost lookupd[148]: lookupd (version 324.13) starting - Thu Nov 17 17:02:41 2005
Nov 17 17:02:41 localhost diskarbitrationd[114]: disk2s9 hfs 27E7A080-6837-3F67-A8F3-F1DC1A0D0DA5 Macintosh Music /Volumes/Macintosh Music
Nov 17 17:02:42 localhost diskarbitrationd[114]: disk0s9 hfs E11B4938-FE20-38BF-837C-8D3474E46C76 Macintosh HD /
Nov 17 17:02:42 localhost diskarbitrationd[114]: disk1s10 hfs 0E67BE9B-0185-3C0F-A57F-7B254F329DDF Macintosh HD 150 /Volumes/Macintosh HD 150
Nov 17 17:02:42 localhost ConsoleMessage: Loading Little Snitch
Nov 17 17:02:42 localhost ConsoleMessage: Starting SecurityServer
Nov 17 17:02:42 localhost ConsoleMessage: Starting Apple Multicast DNS Responder
Nov 17 17:02:42 localhost ConsoleMessage: Starting kernel event agent
Nov 17 17:02:42 localhost ConsoleMessage: Starting timed execution services
Nov 17 17:02:42 localhost SystemStarter: Loading Little Snitch
Nov 17 17:02:42 localhost ConsoleMessage: Initializing network
Nov 17 17:02:42 localhost SystemStarter: Starting SecurityServer
Nov 17 17:02:42 localhost SystemStarter: D?marrage du r?pondeur DNS multi-diffusion Apple
Nov 17 17:02:43 localhost mDNSResponder[204]: mDNSResponder-58.8.1 (Jan 31 2005 21:11:41) starting
Nov 17 17:02:43 localhost SystemStarter: D?marrage de l?agent d??v?nement du kernel
Nov 17 17:02:43 localhost ConsoleMessage: Checking disks
Nov 17 17:02:43 localhost SystemStarter: D?marrage des services ? ex?cution diff?r?e
Nov 17 17:02:43 localhost SystemStarter: Initialisation du r?seau
Nov 17 17:02:43 localhost SystemStarter: V?rification des disques
Nov 17 17:02:44 localhost kernel: UniNEnet::monitorLinkStatus - Link is up at 100 Mbps - Full Duplex
Nov 17 17:02:44 localhost configd[113]: executing /System/Library/SystemConfiguration/Kicker.bundle/Contents/Resources/set-hostname
Nov 17 17:02:44 localhost set-hostname[222]: setting hostname to RIEN ICI
Nov 17 17:02:48 localhost kernel: ATY,Pheonix_A: vram [9c000000:04000000]
Nov 17 17:02:48 localhost kernel: ATY,Pheonix_B: vram [98000000:04000000]
Nov 17 17:02:48 localhost SystemStarter: The "HasShadow" window property is obsolete. Use CGSSetWindowShadowAndRimParameters(cid, wid, 0.0,0.0, 0,0, CGSNoShadowStyle) to turn off the window shadow instead. Set a break-point on CGSLogMessage to find out where this property is set.
Nov 17 17:02:48 localhost syslogd: /dev/console: Input/output error
Nov 17 17:02:48 localhost init: kernel security level changed from 0 to 1
Nov 17 17:02:49 localhost DirectoryService[232]: Launched version 1.8.4 (v258.2)
Nov 17 17:02:49 localhost loginwindow[228]: Sent launch request message to DirectoryService mach_init port
Nov 17 17:02:50 localhost configd[113]: posting notification com.apple.system.config.network_change
Nov 17 17:02:50 localhost configd[113]: executing /System/Library/SystemConfiguration/Kicker.bundle/Contents/Resources/enable-network
Nov 17 17:02:50 localhost mach_init[2]: Server 0 in bootstrap d03 uid 0: "/usr/sbin/lookupd": exited as a result of signal 1 [pid 148]
Nov 17 17:02:50 localhost lookupd[234]: lookupd (version 324.13) starting - Thu Nov 17 17:02:50 2005
Nov 17 17:02:50 localhost ConsoleMessage: Starting network time synchronization
Nov 17 17:02:51 localhost configd[113]: executing /System/Library/SystemConfiguration/Kicker.bundle/Contents/Resources/set-hostname
Nov 17 17:02:52 localhost ntpdate[256]: ntpdate [email protected] Fri Sep 12 18:30:10 PDT 2003 (1)
Nov 17 17:02:52 localhost ConsoleMessage: Loading Shared IP extension
Nov 17 17:02:52 localhost /usr/libexec/crashreporterd: get_exception_ports() failed: (ipc/send) invalid destination port
Nov 17 17:02:52 localhost last message repeated 2 times
Nov 17 17:02:52 localhost ConsoleMessage: Starting printing services
Nov 17 17:02:52 localhost ConsoleMessage: Starting network file system
Nov 17 17:02:55 localhost ntpdate[256]: step time server 17.72.133.42 offset 2.494473 sec
Nov 17 17:02:55 localhost ConsoleMessage: Starting Qmaster services
Nov 17 17:02:55 localhost ntpd[309]: ntpd [email protected] Fri Sep 12 18:30:03 PDT 2003 (1)
Nov 17 17:02:55 localhost ntpd[309]: precision = 6 usec
Nov 17 17:02:55 localhost set-hostname[324]: setting hostname to RIEN ICI
Nov 17 17:02:55 localhost automount[337]: automount version 57
Nov 17 17:02:55 localhost automount[340]: automount version 57
Nov 17 17:02:56 localhost ConsoleMessage: Loading IP Firewall extension
Nov 17 17:02:56 localhost SystemStarter: Chargement de l?extension du coupe-feu IP
Nov 17 17:02:57 localhost kernel: IP packet filtering initialized, divert enabled, rule-based forwarding enabled, default to accept, logging disabled
Nov 17 17:02:57 localhost kernel: IPv6 packet filtering initialized, default to accept, logging disabled
Nov 17 17:02:57 localhost kernel: IP firewall loaded
Nov 17 17:02:57 localhost ConsoleMessage: Starting internet services
Nov 17 17:02:57 localhost SystemStarter: D?marrage des services internet
Nov 17 17:02:58 localhost xinetd[366]: 366 {init_services} no services. Exiting...
Nov 17 17:02:59 localhost SystemStarter: D?marrage termin?.
Nov 17 17:03:03 localhost kernel: at_obdev_KUC: at_obdev_KUC_UserClient::setDebugEnabled(0)
Nov 17 17:03:03 localhost kernel: at_obdev_KUC: at_obdev_KUC_UserClient::debug log disabled
Nov 17 17:09:30 localhost /Applications/Safari.app/Contents/MacOS/Safari: *** Warning: ATSUSetFontFallbacks has been deprecated. Use ATSUFontFallbacks objects instead.
***


et dans les process voir lîmage ci joint

et dans host config rien d'anormal non plus

un peu d'aide merci ...
 
Dans la liste de tes processus, certains ont trait au réseau :
- ntpd (pour mettre l'horloge de la machine à "l'heure atomique")
- mDNSResponder (pour les réseaux 'bonjour', anciennement 'Rendez-Vous')
- nfsiod (pour les réseaux NFS)

Personnellement, j'ai les trois (il faut que pense à virer NFS) mais ils ne me générent pas de traffic.
Cela étant, peut-être un de ces processus génère-t-il plus de traffic à cause d'un problème dans la configuration du réseau.
Il te faudrait une application qui traque les émetteurs et récepteurs de paquets. Je n'en connais pas pour l'instant.
 

Sujets similaires

Z
Mon mac freeze puis se reprend tout seul
Réponses
3
Affichages
3K
macOS
pascalformac
P
M
Problème démarrage Mac Os X 10.3.9
Réponses
7
Affichages
3K
macOS
levri
L
Haut Bas