afroSamurai

Q: unknown shared pc on finder

Hi everybody,

 

A couple of days ago i have been seen a unknow shared pc on my finder, so i try some things to remove it from there:

 

- 1st: i changed the wireless network password

- 2nd: i restore the airport express and reconfigured it

- 3rd: i put my network in acces control mode and listed all my MAC adress of all my devices there

 

In all cases the unknown pc still there.

 

Somebody may help me to remove it from my finder or know wich device is it

iMac, OS X Mavericks (10.9.1)

Posted on Jan 6, 2014 6:10 AM

Close

Q: unknown shared pc on finder

  • All replies
  • Helpful answers

Previous Page 2 of 4 last Next
  • by Linc Davis,

    Linc Davis Linc Davis Jan 7, 2014 5:51 PM in response to afroSamurai
    Level 10 (207,926 points)
    Applications
    Jan 7, 2014 5:51 PM in response to afroSamurai

    Launch the Network Utility application. Select the Netstat tab and then the button marked

     

    Display routing table information

     

    Click the Netstat button, or press the return key. After a delay, some text will appear in the window. Copy it into a reply to this message. Please post the text, not a screenshot.

  • by afroSamurai,

    afroSamurai afroSamurai Jan 7, 2014 6:10 PM in response to Linc Davis
    Level 1 (1 points)
    Jan 7, 2014 6:10 PM in response to Linc Davis

    Hi Linc,

     

    Follow the request information, so right now the PC is not on my Finder (Network)

     

     

    Routing tables

     

    Internet:

    Destination        Gateway            Flags        Refs      Use   Netif Expire

    default            10.0.1.1           UGSc          147        7     en1

    10.0.1/24          link#5             UCS             2        0     en1

    10.0.1.1           0:24:36:99:c7:bc   UHLWIir       148      420     en1    721

    10.0.1.3           38:f:4a:7f:f7:bb   UHLWI           0        0     en1    347

    10.0.1.5           localhost          UHS             0        0     lo0

    25                 link#8             UC              1        0    ham0

    127                localhost          UCS             0        0     lo0

    localhost          localhost          UH              4       99     lo0

    169.254            link#5             UCS             0        0     en1

     

    Internet6:

    Destination        Gateway            Flags         Netif Expire

    localhost          localhost          UHL             lo0

    2620:9b::          link#8             UC             ham0

    2620:9b::1900:54c5 7a:79:19:0:54:c5   UHL             lo0

    fe80::%lo0         localhost          UcI             lo0

    localhost          link#1             UHLI            lo0

    fe80::%en1         link#5             UCI             en1

    fcg.local          d8:30:62:4d:76:d1  UHLI            lo0

    fe80::%ham0        link#8             UCI            ham0

    fcg.local          7a:79:19:0:54:c5   UHLI            lo0

    ff01::%lo0         localhost          UmCI            lo0

    ff01::%en1         link#5             UmCI            en1

    ff01::%ham0        link#8             UmCI           ham0

    ff02::%lo0         localhost          UmCI            lo0

    ff02::%en1         link#5             UmCI            en1

    ff02::%ham0        link#8             UmCI           ham0

  • by Linc Davis,

    Linc Davis Linc Davis Jan 7, 2014 6:33 PM in response to afroSamurai
    Level 10 (207,926 points)
    Applications
    Jan 7, 2014 6:33 PM in response to afroSamurai

    If it's not there now, there's nothing to see. Repeat when it is there.

  • by afroSamurai,

    afroSamurai afroSamurai Jan 7, 2014 6:40 PM in response to Linc Davis
    Level 1 (1 points)
    Jan 7, 2014 6:40 PM in response to Linc Davis

    Ok i will repeat this again when i see the PC on Finder.

     

    Just on thing, i don't know this MAC Adress 7a:79:19:0:54:c5 that is showing in table. it is something that could  be on my network?

  • by Linc Davis,Solvedanswer

    Linc Davis Linc Davis Jan 7, 2014 6:58 PM in response to afroSamurai
    Level 10 (207,926 points)
    Applications
    Jan 7, 2014 6:58 PM in response to afroSamurai

    I just noticed that you're using Hamachi. That's where the mystery PC is: on the Hamachi VPN. Hamachi is dangerous if you're not careful. One of the few real network intrusions I've seen on this site happened that way.

  • by afroSamurai,

    afroSamurai afroSamurai Jan 7, 2014 7:06 PM in response to Linc Davis
    Level 1 (1 points)
    Jan 7, 2014 7:06 PM in response to Linc Davis

    Linc,

     

    The Hamachi was for my son use together with Minecraft, so i deleted it right away.

     

    I will monitor if the unknown PC be active on my Finder again.

  • by Kingoftypos,

    Kingoftypos Kingoftypos Jan 7, 2014 7:59 PM in response to afroSamurai
    Level 3 (757 points)
    Jan 7, 2014 7:59 PM in response to afroSamurai

    My g/f's son plays Minecraft too. And I just gave him a 2009 MBP for Christmas. What was this Hamachi and what did it do for Minecraft?

     

    What should I look for on the network? How dangerous is this Hamachi and what not?

     

    KOT

  • by afroSamurai,

    afroSamurai afroSamurai Jan 8, 2014 2:19 PM in response to Linc Davis
    Level 1 (1 points)
    Jan 8, 2014 2:19 PM in response to Linc Davis

    Dear Linc,

     

    I think that the real problem that i had was the Hamachi, after i deleted it the iMac have been conected on wifi and no PC on my network.

     

    So, thank you so much to remember me about the Hamachi, cause i already had deleted the Minecraft, but i forgot it.

     

    Thank you so much.

  • by My Last Confession,

    My Last Confession My Last Confession May 25, 2014 3:44 AM in response to Linc Davis
    Level 1 (60 points)
    May 25, 2014 3:44 AM in response to Linc Davis

    Linc.  Would you mind taking a look at my routing table as well?  I have had for a very long time, two mystery shared items in my finder: "airborne" and  "hpf4ce46535337."  Note on my network I have an iMac, Macbook Air, and HP Photosmart C4780 printer.

     

    Here is my Netstat output:

     

    Routing tables

     

    Internet:

    Destination        Gateway            Flags        Refs      Use   Netif Expire

    default            10.0.1.1           UGSc          407        2     en0

    10.0.1/24          link#4             UCS             6        0     en0

    10.0.1.1           0:24:36:a0:dc:6d   UHLWIir       409 79581743     en0   1159

    10.0.1.2           f4:ce:46:53:53:37  UHLWI           0        1     en0   1014

    10.0.1.3           44:2a:60:fb:c7:30  UHLWIi          1    23285     en0   1196

    10.0.1.4           68:96:7b:bf:c0:3b  UHLWI           0        1     en0   1015

    10.0.1.7           40:30:4:ef:43:8d   UHLWI           0        1     en0   1014

    10.0.1.9           localhost          UHS             0     3964     lo0

    10.0.1.255         ff:ff:ff:ff:ff:ff  UHLWbI          0        4     en0

    127                localhost          UCS             0        0     lo0

    localhost          localhost          UH           1312 11041359     lo0

    169.254            link#4             UCS             1        0     en0

    169.254.83.55      f4:ce:46:53:53:37  UHLSW           0        0     en0

     

    Internet6:

    Destination        Gateway            Flags         Netif Expire

    localhost          localhost          UHL             lo0

    fdd1:f62f:d31f:e66 fe80::bcd5:bebe:f0 Uc            utun0

    fdd1:f62f:d31f:e66 link#8             UHL             lo0

    fe80::%lo0         localhost          UcI             lo0

    localhost          link#1             UHLI            lo0

    fe80::%en0         link#4             UCI             en0

    gabriel-mccarthys- 0:23:df:fe:6f:d6   UHLI            lo0

    gabriel-mccarthys- 0:24:36:a0:dc:6d   UHLWIi          en0

    fe80::%en1         link#5             UCI             en1

    fe80::%utun0       fe80::bcd5:bebe:f0 UcI           utun0

    fe80::bcd5:bebe:f0 link#8             UHLI            lo0

    ff01::%lo0         localhost          UmCI            lo0

    ff01::%en0         link#4             UmCI            en0

    ff01::%en1         link#5             UmCI            en1

    ff01::%utun0       fe80::bcd5:bebe:f0 UmCI          utun0

    ff02::%lo0         localhost          UmCI            lo0

    ff02::%en0         link#4             UmCI            en0

    ff02::%en1         link#5             UmCI            en1

    ff02::%utun0       fe80::bcd5:bebe:f0 UmCI          utun0

  • by tanbeach,

    tanbeach tanbeach Aug 15, 2014 5:34 PM in response to Linc Davis
    Level 1 (0 points)
    Aug 15, 2014 5:34 PM in response to Linc Davis

    Hi - I am having the exact same issue as the other user.  I'm attaching my routing table info below.  The extra pc that is showing up in my devices folder is epson6ec5d8 .  I have an epson printer but this shows up under the printer name and will go away when I turn the printer off.  I can't get the epson6ec5d8 device ever to go away.  Do you have any suggestions on what this is and how to get rid of it? 

     

    Thank you!

     

     

    Routing tables

     

    Internet:

    Destination        Gateway            Flags        Refs      Use   Netif Expire

    default            broadcom.home      UGSc           17        0     en1

    127                localhost          UCS             0        0     lo0

    localhost          localhost          UH              4     8007     lo0

    169.254            link#5             UCS             0        0     en1

    192.168.1          link#5             UCS             5        0     en1

    broadcom.home      f8:e4:fb:d7:91:5e  UHLWIir        18   333956     en1   1177

    192.168.1.2        localhost          UHS             0       11     lo0

    192.168.1.9        0:1c:b3:bd:66:12   UHLWI           0        1     en1    257

    epson6ec5d8        ac:18:26:6e:c5:d8  UHLWI           0       33     en1   1183

    luciens-ipod       64:b9:e8:19:b8:d   UHLWI           0        0     en1    528

    192.168.1.255      ff:ff:ff:ff:ff:ff  UHLWbI          0       50     en1

     

    Internet6:

    Destination        Gateway            Flags         Netif Expire

    localhost          localhost          UHL             lo0

    fe80::%lo0         localhost          UcI             lo0

    localhost          link#1             UHLI            lo0

    fe80::%en1         link#5             UCI             en1

    fe80::21c:b3ff:feb 0:1c:b3:bd:66:12   UHLWIi          en1

    apple-tv-2.local   9c:20:7b:89:6c:a2  UHLWIi          en1

    kali-reeds-compute 10:9a:dd:9e:eb:62  UHLI            lo0

    ff01::%lo0         localhost          UmCI            lo0

    ff01::%en1         link#5             UmCI            en1

    ff02::%lo0         localhost          UmCI            lo0

    ff02::%en1         link#5             UmCI            en1

  • by the3boysnme,

    the3boysnme the3boysnme Aug 23, 2014 6:25 AM in response to Csound1
    Level 1 (0 points)
    Aug 23, 2014 6:25 AM in response to Csound1

    I don't know if I am too late with this or not, but I had an unknown PC showing in my finder too. I went into Preferences > Sharing and changed the computer name to something other than default  to --------.local. Since I don't have anyone on my network that I have allowed to share it doesn't effect anything. (I hope). But the minute I made the change, the pc disappeared. I could be completely wrong, but nothing else has been effected like my router, printer or other devices in the house. Granted this is my personal computer, and that may not be the case for others on this chain. Bottom line is the PC is gone.

  • by kikiben,

    kikiben kikiben Oct 17, 2014 9:34 AM in response to the3boysnme
    Level 1 (0 points)
    Oct 17, 2014 9:34 AM in response to the3boysnme

    I just discovered a PC on Finder today. I am more concerned about where it came from than anything. Is this a potential security breach? I went and turned off sharing under System Preferences and it's gone.  Now what I believe is my Network Printer (just local to my house) also went away. Should I be concerned?

     

    Thanks,

    Valerie

  • by eharlow,

    eharlow eharlow Oct 18, 2014 7:07 PM in response to Linc Davis
    Level 1 (0 points)
    Oct 18, 2014 7:07 PM in response to Linc Davis

    I am also having the same problem as tanbeach.

    I have an epson printer, and under my shared file it lists two epsons. One is listed as a printer and one is listed as a PC. I have numerous people on my network, I am living with my grandparents and my mother, but we all have macs.

    When i turned off my epson printer the printer went away but this weird epson PC was still there.

    When i turned file sharing on it went away. I just turned file sharing off an am waiting to see if it comes back.

    When I clicked on the epson PC all that was there was a memory card.

    I did the Netstate and here is my table:

    I have 2 Apple iMacs, a Canon printer, Epson printer, and 2 iPads using my network, also my Macbook Air, and iPhones (2).

    Routing tables

     

    Internet:

    Destination        Gateway            Flags        Refs      Use   Netif Expire

    default            192.168.1.1        UGSc           26        0     en0

    127                localhost          UCS             0        0     lo0

    localhost          localhost          UH              4      751     lo0

    169.254            link#4             UCS             0        0     en0

    192.168.1          link#4             UCS             3        0     en0

    192.168.1.1        c0:3f:e:4:36:1a    UHLWIir        27      531     en0    367

    192.168.1.7        0:16:cb:1:f7:b7    UHLWIi          1       86     en0    733

    192.168.1.14       localhost          UHS             0        0     lo0

    192.168.1.255      ff:ff:ff:ff:ff:ff  UHLWbI          0       35     en0

     

    Internet6:

    Destination        Gateway            Flags         Netif Expire

    localhost          localhost          UHL             lo0

    fe80::%lo0         localhost          UcI             lo0

    localhost          link#1             UHLI            lo0

    fe80::%en0         link#4             UCI             en0

    apple-imac-core-du 0:16:cb:1:f7:b7    UHLWI           en0

    emilys-macbook-air 48:d7:5:c9:d4:1b   UHLI            lo0

    ff01::%lo0         localhost          UmCI            lo0

    ff01::%en0         link#4             UmCI            en0

    ff02::%lo0         localhost          UmCI            lo0

    ff02::%en0         link#4             UmCI            en0

     

    Help please??

  • by OzarkBill,

    OzarkBill OzarkBill Oct 25, 2014 6:04 PM in response to afroSamurai
    Level 1 (0 points)
    Oct 25, 2014 6:04 PM in response to afroSamurai

    I've got this happening now too.

     

    When I click on the shared "user" a bar in the window says its trying to connect to the listed "Shared" user (or whatever this is supposed to represent) but it never connects. When I do a "Get Info" on it, same thing.

     

    In my case the "Shared User" is named "orangejello".

     

    The ethernet on my Mac does not work, so I'm connected with wifi. Yesterday, after I first noticed it, and after poking around a bit trying to get rid of it,  I finally turned the wifi off and back on in the Network Preferences and the "Shared" menu item and the "user" disappeared, but this afternoon it was back again.

     

    This time I poked around the Console log files and didn't really find much of interest, except maybe this in the "Diagnostic and Usage Messages"

     

    10/25/14 4:21:53.481 PM UserEventAgent[150]:

    com.apple.message.domain: com.apple.usage.app_activetime

    com.apple.message.signature: com.apple.ShareKitHelper

    com.apple.message.signature2: com.apple.ShareKitHelper ||| 1.0 (185.2)

    com.apple.message.value: 14161

    com.apple.message.value2: 0

    com.apple.message.value3: 0

    com.apple.message.value4: 0

    com.apple.message.value5: 0

    com.apple.message.value6: 0

    com.apple.message.value7: 0

    com.apple.message.result: NO

    com.apple.message.summarize: YES

    Sender_Mach_UUID: 55428B1C-9198-32BF-80EA-4731081F402E

     

    This would have appeared while I was gone this afternoon.

     

    Personally, I find this pretty freaking creepy and it sure feels like a potential security issue to me.

  • by kikiben,

    kikiben kikiben Oct 27, 2014 9:26 AM in response to OzarkBill
    Level 1 (0 points)
    Oct 27, 2014 9:26 AM in response to OzarkBill

    I agree. I don't like it. On this post, yes I see how to get rid of it but does anyone know why or how it could happen to begin with? That is my concern.

     

    Thank you!

Previous Page 2 of 4 last Next