I use Little Snitch to monitor outgoing connections. In the last week or so it's started warning me many times a day that something called "PubSubAgent" wants to connect to various addresses that I've never heard of. I tried a Web search for "PubSubAgent" and learned that apparently it has to do with managing RSS feeds and syncing same via .Mac. In 10.5, anyway; I haven't found anything about its function in 10.6. Anyway, in my 24 years using Macs I've never had anything to do with any RSS feeds or with .Mac in any of its incarnations, so I don't know what this is about, but it's driving me nuts.
Mostly it wants to connect to a website named macmouse.com, which turns out to be some kind of Mac dealer/club in Hawaii. If I put the cursor over that address in the LS alert, it'll sometimes show a whole list of URLs "with the same IP address". I've seen up to six addresses in that list, all of them looking like they're connected to the Hawaii place. Then sometimes it'll show macmouse.com only, with no alternatives. Then it showed an alternative as 2153788.sites.myregisteredsite.com, which seems to be a vendor of Web addresses; after I went to look a that site, then PubSubAgent started wanting to connect to it instead of macmouse.com. Then it brought up a completely new one, www.kabsoft.com, which is vendor of "Judaic software". And now, after looking at that site, PubSubAgent wants to go there. I've never had anything to do with these places.
Here it goes again, wanting to connect to www.kabsoft.com, listing macmouse.com and 2153788.sites.myregisteredsite.com as alternatives with the same IP address. I could just tell LS to Deny Forever, but I'd like to know what's going on. Besides, PubSubAgent will probably just come up with another URL it wants to connect to. (It also occasionally wants to go to some Google address.) I've shut down Safari and everything else and Restarted my Mac, but after a while PubSubAgent just starts up again. There is a set of about a dozen Web pages I keep open all the time, but I had the same set open two weeks ago and I'd never heard of PubSubAgent then, so it seems unlikely this behavior has to do with any of them. I tried throwing out ~/Library/Preferences/com.apple.PubSubAgent.plist and ~/Library/Caches/com.apple.PubSubAgent/Cache.db, but they just got recreated.
Being a Mac user, I have no real experience with malware, but this behavior looks awfully suspicious—though the sites PubSubAgent wants to connect to do seem to be legit. Can anyone tell me (a) just what PubSubAgent is up to, and (b) what I can or should do about it?