Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Little Snitch and Pro Book 'gift'

I was gifted a reconditioned, like new by all appearances, pro book OS X.7


The device works very well, impressive speed etc. Only one time start up was frozen and I maneuvered by it with a Pram reset on start up. This happened the very first time I restarted it and I never gave it any thought since it cleared right up.


Now here's my question.


I am demoing LS. I note that in the mDNSR section, a local iphone is making a connection, I assume, with my laptop.


This iphone is owned by the gift giver.


What does this mean?

I do no syncing, and I never will own a cellphone, ever.


My thoughts are that the iphone is simply showing up because airport is being contacted by the iphone user. Not necessarily is the iphone talking to my pro book, or is it? I cannot fathom any reason for an iphone to be popping up on my LS display. It is almost always popping up when the iphone user/gift giver is nearing my bunker, home, etc.


Help, please. 2 days of my life trying to sort this out. This is my first apple community post. I dread the answer but must have one.

MacBook Pro, Mac OS X (10.7)

Posted on Feb 28, 2012 10:52 PM

Reply
42 replies

Feb 28, 2012 11:12 PM in response to sasscunstein

I assume LS is posting a dialog asking you whether you want to block the connection once, until quit, or forever and telling you which process is attempting the connection. So maybe it is something the previous owner left running machine. Look at the process name. If it is part of some application then the next step would be to remove the application and find out what's launching it (maybe your Login Items).


Also you might want to look at your Network preferences for defined services that shouldn't be there.

Feb 28, 2012 11:37 PM in response to X423424X

I thank you for your time.


I am a noob. This is my only computer, no ipads etc. I just killed my 10 year old TV shaped apple, saving the plastic logo as Steve Jobs died, and affixed it to my grinder, on the lid.... I was having to prod the guts with a drumstick to start it, and one time I felt current crawl through the wood. In those days, I did suspect foul play, spyware, but the expired browser, 2 years gone, was only working because someone allowed it to work. I figured it was so old that no one would bother doing anything tricky, and I wouldn't have cared if the whole world did watch what I did or looked upon, unless, oddly, that it was the same person that gifted me the macbook. That would be very disconcerting. But I digress.


Snitch has never once asked if I want to allow or disallow anything. Mind you, it is a free demo.

I hardly understand code. I did remove two rules of the 54 (unallow mobileme) and saw the same iphone flash on for just a couple of moments in the LS mDNSR column. With 'allow mobileme', the iphone is there for many minutes at a time.


My problem is a bit wider than I worded it. I am suspecting I was given a loaded computer for monitoring purposes, but I am an adult, and not employed by the person who gave me the mac book.


In getting a possible answer to my initial query, I can start to figure out the extent of the real issue here. In other words, it may be hardwired. It may have undectectable software on it. As we know, spyware is commonplace because ~ well, just look at how it's advertised. Cheating spouses, *****, etc....


I am trying to see why xxx's iphone routinely shows up. Usually the colors are green in the two bar graphics, but I thought I saw red as well. In the apple 'activity monitor', red means outgoing, green means incoming. I am assuming the same code holds true for LS.

Feb 28, 2012 11:40 PM in response to sasscunstein

I hardly understand code. I did remove two rules of the 54 and saw the mobileme flash on a couple of times in the LS mDNSR column. With 'allow mobileme', the iphone is there for many minutes at a time.


This is off the main topic (problem) but I am confused. You say you are using Little Snitch in demo mode. That is the same as non-demo except it is time limited. I purchased LS and use it. It is one of the "must haves" for my machine. I've used it for years. What is confusing is I have no idea what your are talking about when you refer to a LS "mDNSR column". The only columns in the LS main window are Application, Dot (for lock column), Rule, and a column for notes. So I am wondering what you are looking at.


Here's what the top portion of the LS main window looks like on my machine:


User uploaded file


Are you sure you aren't using Hands Off? It's similar to LS but I am not familiar with it.


In other words, it may be hardwired. It may have undectectable software on it. As we know, spyware is commonplace because ~ well, just look at how it's advertised. Cheating spouses, *****, etc....


Nothing that can be configured is "hardwired". That previous owner had to add whatever he added. There is no "spyware" on macs. A trojan or two, but that's another story.

Feb 28, 2012 11:50 PM in response to X423424X

The transparent monitor pop up for LS has several rows indicating activity, among the more active is the mDNSR. That is where the iphone shows up. mDNSR is also known as Bonjour. If you hit the triangle arrow, with your cursor, the pop up will drop down, showing mDNSR is among the more active, always shuttling info to and fro for a fewip addresses commonly known as internet protocol (a California company). No problem with that.


What are you saying? No parent or boss could place monitor software (think child monitor) on a mac? Then why are there several supposed 'undetectable' versions for sale, and for mac?

Feb 29, 2012 12:18 AM in response to X423424X

Ok. It is certainly 'Little Snitch' I am using. There are sites which show what every root function of apple stand for, albeit in language we may not be familiar with. Here's one:


http://triviaware.com/macprocess/all


The ones in red mean caution, such as Abk, a mac keylogger. If a keylogger isn't spyware, I don't know what is.


Just another internet rumor, I suppose, but here goes. Hardwiring is possible, but doubtful. In any event, I'm not about to take apart this machine unless it needs a battery, which lasts 7 hours, as advertised. Sometimes more.


Fact: you can buy 'spyware' in multiple forms, perfectly legal, since your employees might be 'stealing company time'. Or you 'child' might be chatting away with pedobear. They proudly state that it's like having a camera on your child's screen, taking screenshots, even passwords, effortlessly, and most sellers state it is 'undetectable'.


I was guessing that my gift computer was simply synced to the iphone, which is ever in hand, and which would allow free access to my (or not 'mine') mac book....but it may be more, it may be nothing at all. You see, if you sync your iphone to your computer, you are allowed to go into both devices, is this correct? Hence my initial query: what does xxx's iphone showing up in the transparentn pop up mean? Is this normal?

Feb 29, 2012 12:36 AM in response to sasscunstein

sasscunstein wrote:


Snitch has never once asked if I want to allow or disallow anything. Mind you, it is a free demo.

As you were told, the demo version of LS differs only in that it is time-limited.


The mDNSResponder process (a Mac OS X process) does not do only Bonjour; under SL it is also used for unicast DNS. The activity you describe is not unusual. You can check LS's rules, and set mDNSResponder requests to be handled manually, if you so wish.

I am suspecting I was given a loaded computer for monitoring purposes

Mac spyware does exist. However, you have not provided any evidence that there is spyware installed on your MBP.


Be that as it may, if you've received a used Mac, the best thing and the first thing to do -- whether or not you suspect the existence of spyware -- is to re-format the drive and re-install the OS from scratch; then install your own software. This way you eliminate not only the issue of spyware, but a great many other possible sources of trouble (incompatible .kexts, corrupt fonts, and on and on).

Feb 29, 2012 12:42 AM in response to X423424X

User uploaded file


Since I just now refreshed the expired demo LS, I copied this empty image of the pop up I was talking about, before the iphone shows up. I have it checked on 'always stay visible'


This is what you get if you hit the arrow in the upper left corner of the pop up, and then click on mDNSR responder, In a few moments, there will be rows showing the xxx's iphone, even at this late hour. I have spent a lot of time watching it, and crawling through web resources. guess what? This thread won't survive. My question is simply too straightforward. This is a Little Snitch pop up, you have seen this?


Well, you cannot copy a screeshot, apparently, of the transparent pop up, sorry. I implore you to do the two steps on your pop up (Yes, I am using Little Snitch)

Feb 29, 2012 1:01 AM in response to fane_j

Hi, appreciate that. I only heard of the reformatting thing as the most drastic of measures, as spoken by mac users. I didn't think it would be necessary.Is not 'reconditioned' as good as new? ie., wouldn't apple clean it out before refurbishing it??? As far as I am concerned, I don't care if the whole planet knows what I do. I just don't want the gift giver to be aware. No one deserves a full description of what I am enduring herein.


I cannot give evidence of spyware existing, because I am not tech savvy. I assumed LS would tell me.


Instead, seeing that phone, and no one else's, makes me wonder why it is there, unless the pro book was purchased by the giver and then set up, in advance, with syncing, or something 'undetectable'. Why would 'undetectable' software be detectable, as in 'evidence'? I guess my next stop will be the apple store, and some gently worded prompts that won't cause me to be handled like some bum. I am not spending money. I am simply trying to get answers.


Movie recommendation of the hour: The Fly 2 starring Eric Stoltz. I hope this sort of levity is welcome here.


The green camera light was on for days before I realized what it meant. I had to reset pram, as suggested on another forum, to get photobooth (and camera) to quit. So, maybe the machine does indeed need reformatting. Here's another thing I saw. The person who gave me this book is hard of hearing, and several times I saw the person scramble to knock down her screen as I approached. That struck me as curious, since the person never ever does anything 'bad' with a computer, like I do. Tis a Jesus thing. The wiped screen had a light blue tint, like a light blue sky. I never saw that sort of behavior before. I saw that screen color on one of the spyware supplier sites, though, very pretty blue. Hi there, you're up late.


command shift 4.

Feb 29, 2012 1:05 AM in response to sasscunstein

sasscunstein wrote:


Is not 'reconditioned' as good as new? ie., wouldn't apple clean it out before refurbishing it???

Did you get this MBP from Apple, or from someone else?


Re-formatting the drive has nothing to do with refurbishing or reconditioning. It has to do with eliminating any files or software which might cause you problems.

Feb 29, 2012 1:19 AM in response to fane_j

It came from apple, with an extended warranty and tech support. Admittedly, I am suspicious. But being suspicious doesn't mean that I will find anything amiss, or even that anything amiss exists.


That it came from apple does not mean that it wasn't formatted for child monitoring of the highest quality, for the smartest 'child', between hands. I don't have time to learn code. I may have to find the time, a shame, really. There are better things to be doing.

Feb 29, 2012 1:24 AM in response to X423424X

Thank you , X. I guess I'll consult, and do just that. But I want all my bookmarks and stuff saved.


If this laptop materialized 20 years ago people would think it was a spaceship. It is very pretty. Sorry to be finding inherent ugliness in my experience with it. I cannot help my suspicions that it was formatted by the bestower.


I saw one of these, the large 17 inch version, hit a wood floor from 3 feet and there was not a scratch on it. It works, and it happened before apple developed the magnetic attachment for the power cord. Very thoughtful.

Feb 29, 2012 1:32 AM in response to sasscunstein

sasscunstein wrote:


It came from apple, with an extended warranty and tech support.

Then I misunderstood what you meant by 'gifted'.

That it came from apple does not mean that it wasn't formatted for child monitoring

Friend. Take a break. Relax. Learn to use your Mac. Enjoy the experience.


If I were a doctor, I'd prescribe for you something along the lines of the prescription his 'medical man' gave Jerome K Jerome:


1 lb beefsteak, with

1 pt bitter beer every 6 hours.

1 ten-mile walk every morning.

1 bed at 11 sharp every night.

And don't stuff up your head with things you don't understand.

Little Snitch and Pro Book 'gift'

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.