What could cause 1000's of failed login attempts from my IP address

craig stewart wrote:

I have ClamXav and ran that and it did find a suspicious file called called hide.php It has been quarantined though and the problem persists.

I'm not familiar with that being any sort of known OS X malware. What was the infection name and original location of the file?

my next thought is that someone has hacked my wifi and is using my connection. I have reset my router password and rebooted it to disconnect anything that was connected

You need to be using WPA2 security on your WiFi network with a strong password. Anything less than that can be hacked with readily available software in a matter of minutes.

craig stewart wrote:

Hi

I don't have the original location of the file unfortunately, but the infection name was hide.php and the file name was 59955ff59e7d5908a2b24eaafa5f3909.php

Took me awhile, but I found three that are PHP.Hide, PHP.Hide-1 and PHP.Hide-2. If any of those are correct I can tell you what signature it's looking for. They are fairly old, added to the database in 2010-05-29, so it's doubtful that it's a false positive. In any case, since the infection name does not contain the letters "OSX" it's not likely to have affected your computer.

You can check the scan log and probably find out where it originated from:

• In ClamXav open the Scan Log by clicking the icon on the tool bar
• When the "clamXav-scan.log" window opens, you will only be looking at the only the most recent results
• Select Find->Find from the Edit menu or type Command-F
• Type "FOUND" in all caps and without the quotes in the Find box
• Uncheck the "Ignore case" box and hit enter
• Click the "Next" button or type Command-G until you find what you are looking for
• If it doesn't show up in the most recent results, use the "▲ Earlier|" button in the lower right corner of the window to move back through the log.

There is a faster way to do this with a Terminal command, but I would need to know if you were using ClamXav from the App Store or a web site and if the latter whether the ClamXav application found it during a manual scan or if it was Sentry that located it.

It's way past my bed time here, so I'll have to get back to you tomorrow on this.

Anything more to report on this?

Glad everything is back to normal and I strongly suspect your router had been compromised. Check with the manufacturer to see if there is a firmware update when you get a chance.

Again, I can give you a much faster way of locating what was found if you can let me know either the exact title of the Scan Log window or what version of ClamXav found it (App Store or web site and if the latter was it the app itself or Sentry).

Otherwise I'll leave you to your busy time.