ichat rendezvous

Question

Level 1

9 points

ichat rendezvous

Can ichat rendezvous allow someone who is not on the same network as you get access to your computer? Such as, can a key logging type program utilize ichat rendezvous to send a person screen shots, etc.? The person in question had access to my computer prior and I think he may have set something up on my computer to record stuff and send it to him. I took the computer to the apple store and the firewall was ON and nothing was checked. When I got it home and it connected to my network, firewall was OFF and the ichat rendezvous was checked. The activity monitor also showed ichat agent even when I wasn't in ichat.

Is it possible to use ichat rendezvous for something like this? if so, If I ensure in the sharing preferences that the firewall is turned on and show the ichat rendezvous as unchecked, and then lock the lock, will that stop stuff from going out? Or am I in deeper trouble here.

Anyone have any ideas on what is happening?

thanks

iMac, Mac OS X (10.3.9)

Posted on Jun 29, 2007 6:13 AM

Reply

Answer 1

Jun 30, 2007 1:16 PM in response to BettySF

Hi Betty,

If you took it to a store a simple way of testing file sharing would have been with/through iChat.

Turning your firewall On for you and only allowing iChat Rendezvous I would see as quite responsible.

Rendezvous would have to be allowed over a Virtual Private Network and that would almost certainly need access to your Modem to set up ports or enable your Mac on other ports to the Rendezvous ones.

If you have no other Macs at home then in iChat Rendezvous can be turned Off. (in iChat > Preferences > Accounts tell it not to Login at iChat start).

I don't think you have anything to worry about.

9:16 PM Saturday; June 30, 2007

Reply

Answer 2

BettySF Author

Level 1

9 points

Jul 2, 2007 7:36 AM in response to Ralph-Johns-UK

The person did have access to my computer, modem, everything. I have since moved and changed accounts with the internet service provider and also have new email addresses but I have the same modem. I took it with me. Do you think I'm still vulnerable if someone set something up such as a key logging program?

Reply

Answer 3

Jul 2, 2007 2:17 PM in response to BettySF

Hi BettySF,

I doubt it very much.

You could check in Activity Monitor (Applications/Utilities and check the applications that are running.

The ones without icons run in the background, as do so of the ones that do like iChatAgent but they are few and far between.

These arw the top ones of mine in 10.4.10

253 pmTool
252 Activity Monitor
238 AppleSpell
231 Firefox
230 Mail
223 textexpanderd
222 UniversalAccessApp
221 MicrosoftMouseHelper
220 MicrosoftKeyboardHelper
219 LittleSnitchDaemon
216 mdimport
213 TabletDriver
210 Finder Ralph
209 SystemUIServer
208 Dock
203 pbs
202 mdimport
201 httpd
200 httpd
198 slpd
183 loginwindow
181 ATSServer
179 automount
171 mds
169 AppleFileServer
163 automount
160 rpc.lockd
148 nfsiod
130 ntpd
127 coreservicesd
126 cupsd
101 crashreporterd
84 lookupd

Concentrate on the ones higher than where the DOCK shows.
It is also likely to show as owned by you. (your name rather than "root" or "Nobody")

10:14 PM Monday; July 2, 2007

Reply

Answer 4

BettySF Author

Level 1

9 points

Jul 3, 2007 3:53 AM in response to Ralph-Johns-UK

Ralph,
I notice you have little snitch daemon. Would you recommend that program for sniffing out key logging software? I have been getting a HUGE run around trying to get someone to help me find out if the key logger is even on there. I even called applecare and they acted like they didn't know what I was talking about. I took it to the apple store and they looked for stuff visually, even though i told them key logger would be invisible. Noone seems to know much about the key loggers that are compatible with Mac. Windows techs act like they have so many programs to detect this stuff with windows software but not mac. If you have little snitch, i'd appreciate anything you can tell me about it.

Thanks in advance,
BettySF

Reply

Answer 5

Jul 3, 2007 12:36 PM in response to BettySF

Hi BettySF,

Little Snitch will tell you if any app is calling out/home.

It will also tell you about incoming stuff as well.

Asking in Panther or even Tiger forums may get a more geeky type of answer. But I see you have posted in Panther.

8:35 PM Tuesday; July 3, 2007

Reply

Answer 6

BettySF Author

Level 1

9 points

Jul 10, 2007 2:15 PM in response to Ralph-Johns-UK

Ralph,
Do you have any idea why ichat agent would appear in my activity monitor when I'm not even in ichat? It happens every now and then. Why would that be?

Reply

Answer 7

Jul 10, 2007 2:42 PM in response to BettySF

Hi BettySF,

Yes I would.

<hr>

When iChat starts up it not only starts the iChat app but alos the support app iChatAgent. If you go on to start a Video chat it also starts up vcencoder

Now when you Log out of AIM a Video chat if started can continue. ( a partial shut down of iChat if you like) vcencoder continues.

Shutting down iChat shuts down the iChat app but for some reason iChatAgent continues for a period and shuts down on it's own later. It does make for faster restarts of iChat but it is difficult to see why it does it this way.

In essence it just does stay open after you quit iChat.

10:42 PM Tuesday; July 10, 2007

Reply

Answer 8

BettySF Author

Level 1

9 points

Jul 11, 2007 8:14 PM in response to Ralph-Johns-UK

What if I don't even log onto ichat though? ichat agent appears in my activity monitor every once in a while for no reason. I don't even use AIM or ichat.

Reply

Answer 9

Jul 12, 2007 1:23 PM in response to BettySF

Hi Betty,

When you have started up iChat in the past have you made the Menu icon get shown ?

Is there a little speech bubble to the right hand side of the menu bar ?

IN System Preferences > Accounts >(your account) > Login Items tab is iChat Listed ?

9:23 PM Thursday; July 12, 2007

Reply

Answer 10

Jul 12, 2007 3:00 PM in response to Ralph-Johns-UK

Thanks for the points.

11:00 PM Thursday; July 12, 2007

Reply

Answer 11

BettySF Author

Level 1

9 points

Jul 16, 2007 6:05 PM in response to Ralph-Johns-UK

I'm not sure what you mean by menu icon. I don't think so. when I chat, there is a little bubble with the words in it, if that's what you mean. Do you mean Startup Items instead of "Login Items"? If so, ichat is not listed.

Reply

Answer 12

Jul 17, 2007 11:51 AM in response to BettySF

HGi Betty,

Open iChat.
Go to Preferences > General Section.
The third item down is Show Status in Menu Bar.

This puts a little speech bubble icon in the menu bar, towards the right on the Date and Time side (And Spotlight)

Is this active ?

7:51 PM Tuesday; July 17, 2007

Reply

Answer 13

BettySF Author

Level 1

9 points

Jul 17, 2007 5:04 PM in response to Ralph-Johns-UK

Actually I have 5 boxes to check

When ichat opens, automatically log in
When i quit ichat, set my status to offline
use groups in buddy list
use shapes to indicate status
show status in menu bar

The first two are checked. The one with "set my status to offline" is greyed out like I can't uncheck it.

Reply

Answer 14

Jul 18, 2007 5:19 AM in response to BettySF

Hi,

It seems it has moved in different iChat versions.

It is the last of those you list.

1:19 PM Wednesday; July 18, 2007

Reply

Answer 15

Marplot

Level 1

0 points

Sep 27, 2007 3:33 PM in response to BettySF

Hi Betty! There is a program called MacScan that is designed to detect, isolate and remove spyware, keystroke loggers, trojan horses, and bring awareness to remote administration applications which could have been maliciously or inadvertently installed on your Macintosh. You use to be able to download for free for a 30 day trial. I would recommend trying out this program to determine if you have a keystroke logger. It will at least set you mind at ease. The website is: http://macscan.securemac.com/

Good Luck! Best regards!

Reply