Virus, Worm, other Malware?

Question

Virus, Worm, other Malware?

Situation: We live in the country and are stuck with Hughesnet satellite. Hughesnet has a "Fair Access Policy" and we are only allowed to download 200MB per 24 hours. This is fine and we never go over the 200 MB. Software updates can be done late night when there is a download as much as you want period.
If you go over the 200MB Hughesnet drops you to dial-up speed for 24 hours. I pay pretty close attention to our usage, and we are very consistent.

All of a sudden, starting a day or two ago, we are downloading a ton. About 1MB every 2-3 minutes when a web browser ap is open even if I am not visiting any sites. I can log onto the Hughesnet Modom and monitor usage, and a just watched the usage climb and I was not doing any surfing. If I am visiting sites, it is worse. If I turn off the airport on the computer, it no longer does this, so I think it is safe to assume the modem and my time capsule are not the culprits. It is something in the computer.

We use Firefox and Safari. Both have had the latest updates. I have turned off all syncing and do not have any updates running. Before all of this happened I had been using openoffice to open some .doc files from faculty at school. These are trusted sources. Have not installed any applications.

This is bizarre. Is there a way to get a virus or worm or something without ever opening a file? My wife is all over Facebook, but she says she has not opened any files from Facebook. Can facebook plant something in a browser via a vulnerability?

I guess the answers to those questions does not matter. I just need to figure out how to stop the crazy consumption of MB during routine email and browsing. Obviously something is running in the background and it is pulling in data. Uploads have remained the same, it is only downloads.

Thanks. I hope the collective brain trust can help my figure this one out.

It is very strange

MacBook Pro 2.26GHz, 2GB 1067 MHz DDR3, Mac OS X (10.6.4), iMac G5 1.9Ghz 1.5GB SDRAM

Posted on Sep 26, 2010 12:17 AM

Reply

Answer 1

etresoft

Level 9

56,716 points

Sep 26, 2010 5:51 AM in response to Matthew Calzia

You do not have any malware. What you have is an automatic software update mechanism (either from the operating system or some 3rd party software) that is trying to download updates in the background.

To verify, an excellent tool would be Little Snitch: http://www.obdev.at/products/littlesnitch/index.html

It is probably Software Update. Run System Preferences > Software Update and check the settings for automatic download.

Reply

Answer 2

Sep 26, 2010 6:49 AM in response to etresoft

Etresoft, is correct. Get Little Snitch, I've been using it for years. You can block programs individually from connecting to the internet and if you enable the display you can see which programs are connecting to the internet in real time. It would make it easier to determine which software program is trying to perform an update. I highly recommend this program.

Reply

Answer 3

Sep 26, 2010 8:39 AM in response to Paul Conaway

Thanks. I did download Little Snitch and that has stopped the megabyte drain; however, I still have no idea why it was happening as nothing out of the ordinary has come up with Little Snitch. I guess I am happy the random downloading has stopped but I wish I knew what program was trying to do it in the background.

Thanks.

Reply

Answer 4

etresoft

Level 9

56,716 points

Sep 26, 2010 10:03 AM in response to Matthew Calzia

Matthew Calzia wrote:
Thanks. I did download Little Snitch and that has stopped the megabyte drain; however, I still have no idea why it was happening as nothing out of the ordinary has come up with Little Snitch. I guess I am happy the random downloading has stopped but I wish I knew what program was trying to do it in the background.

It may be that the download has now completed. Keep an eye on it. It could happen again.

Since you do have a strictly metered connection, you may want to adjust Little Snitch's settings. By default, it is configured to allow many system operations. Little Snitch trusts Apple, but they don't know about your 200 MB limit. You might need to adjust those settings. Look for rules that have padlocks on them. If nothing else, those padlocks will give you hints about what might be happening.

Reply

Answer 5

lancia

Level 1

62 points

Sep 26, 2010 5:47 PM in response to Matthew Calzia

Wow, im so sorry, I cant imagine being in your shoes with those kinds of restrictions.

I just restarted my computer and within 3 min I had used 1MB of data received, checking it with Activity Monitor, its in the Applications folder(use finder). The dashboard updated the weather for my town, I got the word of the day, safari launched and updated the thumbnails for my top sites, mail checked for new emails. Lol, just while Ive been typing this i have used another 1MB 🙂

Lots of things can be turned down or off.
Go To:
Apple/System Preferences/System/Software Update-------Uncheck the "Check for updates" box, just remember to go back here at night during "freetime" Hughesnet gives you, and manually check for updates.
Also in System uncheck the "Set date and time automatically"
Obviously using an iDisk in Mobile Me would contribute to internet usage.
Go To:
iTunes/System Preferences/General and Uncheck the "Auto...retrieve cd names from the internet" box, and uncheck the "Check for software updates automatically"
Go To:
Mail/General/Check for new messages/ and set it to Manually
Go To:
Safari/Preferences/General....and have new windows open with an "empty page", new tabs open with an "empty page" and dont use a "home page", chances are you will just load a page you dont really need. Like I said the "Top Sites" little web page icons get updated all the time, you prolly cant afford this feature.

Lol, now I am at 5MB now and I havent been "on the internet" yet. Hope this help gets you started in the right direction.

Reply

Answer 6

CMCSK

Level 6

11,452 points

Sep 26, 2010 5:52 PM in response to Matthew Calzia

Is there a way to get a virus

There are no viruses for os x.

Reply

Answer 7

babowa

Level 9

78,568 points

Sep 26, 2010 6:06 PM in response to Matthew Calzia

Excellent advice from lancia - I've always had mine set to exactly those "limitations" - for instance, I've never understood the need for a "loaded with ads" homepage - when I start the browser, I usually want to go somewhere specific without the need to wait for ads to load.

In any case, if you have any third party applications, also check their preferences and uncheck any "automatically download updates" or similar. And, if you use Google (Gmail or Google Earth) or have an email account with Yahoo, do NOT be swayed to allow them to install all sorts of superfluous "toolbars" or the like - they will cause quite a bit of totally unnecessary internet usage.

Reply

Answer 8

Sep 26, 2010 8:27 PM in response to etresoft

Thanks, I am diligent about keeping an eye on it and this Little Snitch is just the tool to help me.

I appreciate your help, and everyone else's. Being comfined to 200MB is interesting, but it is the price of country life I guess. Hopefully we get some fiber or WiMax out here soon!

Thanks Again.

Reply

Answer 9

Sep 27, 2010 3:58 AM in response to Matthew Calzia

oops did not realize this was a few years agon.

Message was edited by: Charles Gloor

Reply

Answer 10

etresoft

Level 9

56,716 points

Sep 27, 2010 5:44 AM in response to Charles Gloor

Charles Gloor wrote:
oops did not realize this was a few years agon.

What do you mean? This is an active discussion thread. Are you seeing something funky in your post times? If you, please report that in the Apple Discussions Feedback forum: http://discussions.apple.com/forum.jspa?forumID=1076

And then let us know what you were thinking about this topic.

Reply