Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

detect key logger, screen capture, spyware on mac @linc davis

Linc or any other forensics master - can you guys take a look if there is anything strange on this mac? I run the terminal commands you recommended. Please. Appreciated.


drazeks-MacBook-Pro-2:~ drazek$ kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}'

drazeks-MacBook-Pro-2:~ drazek$ sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix)|edu\.mit|org\.(amavis|apache|cups|isc|ntp|postfi x|x)/{print $3}'


WARNING: Improper use of the sudo command could lead to data loss

or the deletion of important system files. Please double-check your

typing when using sudo. Type "man sudo" for more information.


To proceed, enter your password, or type Ctrl-C to abort.


Password:

com.adobe.versioncueCS4

com.microsoft.office.licensing.helper

com.google.keystone.daemon

com.oracle.java.Helper-Tool

com.adobe.fpsaud

drazeks-MacBook-Pro-2:~ drazek$ launchctl list | sed 1d | awk '!/0x|com\.apple|edu\.mit|org\.(x|openbsd)/{print $3}'

com.google.Chrome.92332

com.adobe.CS4ServiceManager

org.mozilla.firefox.49164

jp.co.canon.cijscannerregister.86368

com.microsoft.Word.56832

com.google.keystone.system.agent

com.jdibackup.ZipCloud.autostart

com.oracle.java.Java-Updater

com.getdropbox.dropbox.80120

com.rpatechnology.mobilemouse.61944

com.jdibackup.ZipCloud.notify

com.adobe.dreamweaver-10.0.40360

com.divx.update.agent

com.microsoft.autoupdate.fba.86652

com.divx.dms.agent

drazeks-MacBook-Pro-2:~ drazek$ ls -1A /e*/mach* {,/}L*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/Bu,P*P,Priv,Qu,Scripti,Servi,Spo,Sta} * L*/Fonts 2> /dev/null

/Library/Components:


/Library/Extensions:

ACS6x.kext

ATTOCelerityFC8.kext

ATTOExpressSASHBA2.kext

ATTOExpressSASRAID2.kext

ArcMSR.kext

CalDigitHDProDrv.kext

EPSONUSBPrintClass.kext

HighPointIOP.kext

HighPointRR.kext

PromiseSTEX.kext

SoftRAID.kext


/Library/Frameworks:

AEProfiling.framework

AERegistration.framework

Adobe AIR.framework

AudioMixEngine.framework

DivX Toolkit.framework

DivXInstallerUtilities.framework

EWSMac.framework

NyxAudioAnalysis.framework

PluginManager.framework

TSLicense.framework

iLifeFaceRecognition.framework

iLifeKit.framework

iLifePageLayout.framework

iLifeSQLAccess.framework

iLifeSlideshow.framework

iTunesLibrary.framework


/Library/Input Methods:


/Library/Internet Plug-Ins:

Default Browser.plugin

DivX Web Player.plugin

Flash Player.plugin

Flip4Mac WMV Plugin.plugin

Flip4Mac WMV Plugin.webplugin

JavaAppletPlugin.plugin

LogitechHarmony.plugin

OVSHelper.plugin

Quartz Composer.webplugin

QuickTime Plugin.plugin

SharePointBrowserPlugin.plugin

SharePointWebKitPlugin.webplugin

Silverlight.plugin

SnagitSafariScroller.webplugin

flashplayer.xpt

googletalkbrowserplugin.plugin

iPhotoPhotocast.plugin

nsIQTScriptablePlugin.xpt

o1dbrowserplugin.plugin


/Library/Keyboard Layouts:


/Library/LaunchAgents:

com.adobe.CS4ServiceManager.plist

com.divx.dms.agent.plist

com.divx.update.agent.plist

com.google.keystone.agent.plist

com.oracle.java.Java-Updater.plist


/Library/LaunchDaemons:

com.adobe.fpsaud.plist

com.adobe.versioncueCS4.plist

com.google.keystone.daemon.plist

com.microsoft.office.licensing.helper.plist

com.oracle.java.Helper-Tool.plist


/Library/PreferencePanes:

Flash Player.prefPane

Flip4Mac WMV.prefPane

JavaControlPanel.prefPane

VersionCueCS4.prefPane


/Library/PrivilegedHelperTools:

com.microsoft.office.licensing.helper


/Library/QuickLook:

GBQLGenerator.qlgenerator

iBooksAuthor.qlgenerator

iWork.qlgenerator


/Library/QuickTime:

AppleIntermediateCodec.component

AppleMPEG2Codec.component


/Library/ScriptingAdditions:

Adobe Unit Types.osax


/Library/Spotlight:

GBSpotlightImporter.mdimporter

LogicPro.mdimporter

Microsoft Office.mdimporter

iBooksAuthor.mdimporter

iWork.mdimporter


/Library/StartupItems:


/etc/mach_init.d:


/etc/mach_init_per_login_session.d:


/etc/mach_init_per_user.d:


Library/Address Book Plug-Ins:

SkypeABDialer.bundle

SkypeABSMS.bundle


Library/Fonts:

eurof35.ttf

eurof36.ttf

eurof55.ttf

eurof56.ttf

eurof75.ttf

eurof76.ttf


Library/Frameworks:

EWSMac.framework


Library/Input Methods:

.localized


Library/Internet Plug-Ins:

CitrixOnlineWebDeploymentPlugin.plugin

ZoomUsPlugIn.plugin


Library/Keyboard Layouts:


Library/LanguageModeling:

da-dynamic.lm

de-dynamic.lm

en-dynamic.lm

es-dynamic.lm

fr-dynamic.lm

it-dynamic.lm

nb-dynamic.lm

nl-dynamic.lm

pt-dynamic.lm

sv-dynamic.lm

tr-dynamic.lm


Library/LaunchAgents:

com.apple.CSConfigDotMacCert-drazek@me.com-SharedServices.Agent.plist

com.apple.FolderActions.enabled.plist

com.apple.FolderActions.folders.plist

com.jdibackup.ZipCloud.autostart.plist

com.jdibackup.ZipCloud.notify.plist


Library/PreferencePanes:


Library/Services:

.localized

drazeks-MacBook-Pro-2:~ drazek$ osascript -e 'tell application "System Events" to get name of every login item' 2> /dev/null

iTunesHelper, Mobile Mouse Server, BitTorrent, Dropbox, Google Chrome

drazeks-MacBook-Pro-2:~ drazek$

MacBook Pro, iOS 8.4.1

Posted on Sep 12, 2015 8:17 AM

Reply
Question marked as Best reply

Posted on Sep 16, 2015 9:19 AM

competitor/business partners knows what only I should know .. not sure if this is the explanation you're looking for


I can send all the littlesnitch processes that it picks up .. will that be sufficient to diagnose/eliminate any possibility of spyware?

16 replies

Sep 16, 2015 10:29 AM in response to drazek73

This is a technical support forum. We are not psychic. Maybe your email account was compromised. We don't know.


Try running Etrecheck and posting the results. It gives a good starting point, including lists of processes running and killed.


For someone to install a key logger, they would have to have physical access to the machine. It looks like you may have a bit-torrent client running. Not smart. Virtually never used for 'legal' purposes.

Sep 17, 2015 9:44 AM in response to KiltedTim

etrecheck results below .. how do I find what installed bit-torrent? it's nowhere in the applications



EtreCheck version: 2.4.2 (142)

Report generated 9/17/15, 12:38 PM

Download EtreCheck from http://etresoft.com/etrecheck


Click the [Click for support] links for help with non-Apple products.

Click the [Click for details] links for more information about that line.


Hardware Information: (What does this mean?)

MacBook Pro (13-inch, Mid 2010) (Technical Specifications)

MacBook Pro - model: MacBookPro7,1

1 2.4 GHz Intel Core 2 Duo CPU: 2-core

10 GB RAM Upgradeable

BANK 0/DIMM0

8 GB DDR3 1067 MHz ok

BANK 1/DIMM0

2 GB DDR3 1067 MHz ok

Bluetooth: Old - Handoff/Airdrop2 not supported

Wireless: en1: 802.11 a/b/g/n

Battery: Health = Normal - Cycle count = 348 - SN = W00474LH4D3BA


Video Information: (What does this mean?)

NVIDIA GeForce 320M - VRAM: 256 MB

Color LCD 1280 x 800


System Software: (What does this mean?)

OS X 10.10.3 (14D136) - Time since boot: about 3 hours


Disk Information: (What does this mean?)

Hitachi HTS545025B9SA02 disk0 : (250.06 GB) (Rotational)

EFI (disk0s1) <not mounted> : 210 MB

Macintosh HD (disk0s2) / : 249.20 GB (49.22 GB free)

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB


MATSHITADVD-R UJ-898 ()


USB Information: (What does this mean?)

Apple Inc. Built-in iSight

Apple Internal Memory Card Reader

Apple Inc. BRCM2046 Hub

Apple Inc. Bluetooth USB Host Controller

Apple Computer, Inc. IR Receiver

Apple Inc. Apple Internal Keyboard / Trackpad


Gatekeeper: (What does this mean?)

Mac App Store and identified developers


Kernel Extensions: (What does this mean?)

/Library/Extensions

[loaded] at.obdev.nke.LittleSnitch (4246 - SDK 10.8) [Click for support]


Launch Agents: (What does this mean?)

[running] at.obdev.LittleSnitchUIAgent.plist [Click for support]

[loaded] com.adobe.CS4ServiceManager.plist [Click for support]

[running] com.divx.dms.agent.plist [Click for support]

[loaded] com.divx.update.agent.plist [Click for support]

[loaded] com.google.keystone.agent.plist [Click for support]

[loaded] com.oracle.java.Java-Updater.plist [Click for support]


Launch Daemons: (What does this mean?)

[running] at.obdev.littlesnitchd.plist [Click for support]

[loaded] com.adobe.fpsaud.plist [Click for support]

[loaded] com.adobe.versioncueCS4.plist [Click for support]

[loaded] com.google.keystone.daemon.plist [Click for support]

[loaded] com.microsoft.office.licensing.helper.plist [Click for support]

[loaded] com.oracle.java.Helper-Tool.plist [Click for support]


User Launch Agents: (What does this mean?)

[failed] com.apple.CSConfigDotMacCert-[...]@me.com-SharedServices.Agent.plist [Click for details]

[failed] com.jdibackup.ZipCloud.autostart.plist [Click for support] [Click for details]

[failed] com.jdibackup.ZipCloud.notify.plist [Click for support] [Click for details]


User Login Items: (What does this mean?)

iTunesHelper UNKNOWN Hidden (missing value)

Mobile Mouse Server Application (/Applications/Mobile Mouse Server.app)

BitTorrent UNKNOWN (missing value)

Dropbox Application (/Applications/Dropbox.app)

Google Chrome Application Hidden (/Applications/Google Chrome.app)


Internet Plug-ins: (What does this mean?)

LogitechHarmony: Version: 1.0.0.1 [Click for support]

o1dbrowserplugin: Version: 5.41.0.0 - SDK 10.8 [Click for support]

OVSHelper: Version: 1.1 [Click for support]

Default Browser: Version: 600 - SDK 10.10

Flip4Mac WMV Plugin: Version: 2.3.8.1 [Click for support]

Silverlight: Version: 5.1.20125.0 - SDK 10.6 [Click for support]

FlashPlayer-10.6: Version: 18.0.0.232 - SDK 10.6 [Click for support]

DivX Web Player: Version: 3.3.1.17 - SDK 10.10 [Click for support]

Flash Player: Version: 18.0.0.232 - SDK 10.6 [Click for support]

QuickTime Plugin: Version: 7.7.3

googletalkbrowserplugin: Version: 5.41.0.0 - SDK 10.8 [Click for support]

iPhotoPhotocast: Version: 7.0 - SDK 10.7

SharePointBrowserPlugin: Version: 14.4.9 - SDK 10.6 [Click for support]

JavaAppletPlugin: Version: Java 8 Update 60 build 27 Check version


User internet Plug-ins: (What does this mean?)

CitrixOnlineWebDeploymentPlugin: Version: 1.0.105 [Click for support]

ZoomUsPlugIn: Version: 3.5.21488.0723 - SDK 10.10 [Click for support]


3rd Party Preference Panes: (What does this mean?)

Adobe Version Cue CS4 [Click for support]

Flash Player [Click for support]

Flip4Mac WMV [Click for support]

Java [Click for support]


Time Machine: (What does this mean?)

Auto backup: YES

Volumes being backed up:

Macintosh HD: Disk size: 249.20 GB Disk used: 199.98 GB

Destinations:

TOSHIBA EXT [Local]

Total size: 999.86 GB

Total number of backups: 5

Oldest backup: 2014-09-19 04:06:05 +0000

Last backup: 2014-11-25 20:08:53 +0000

Size of backup disk: Excellent

Backup size 999.86 GB > (Disk size 249.20 GB X 3)


Top Processes by CPU: (What does this mean?)

16% WindowServer

16% firefox

4% DivXMediaServer

2% Little Snitch Network Monitor

2% Google Chrome Helper(17)


Top Processes by Memory: (What does this mean?)

2.12 GB Google Chrome Helper(16)

1.43 GB firefox

1.24 GB com.apple.WebKit.WebContent(12)

936 MB kernel_task

236 MB Safari


Virtual Memory Information: (What does this mean?)

388 MB Free RAM

9.62 GB Used RAM (1.62 GB Cached)

0 B Swap Used


Diagnostics Information: (What does this mean?)

Sep 17, 2015, 08:52:32 AM Self test - passed

Sep 16, 2015, 10:58:54 PM ~/Library/Logs/DiagnosticReports/filezilla_2015-09-16-225854_[redacted].crash

Sep 17, 2015 2:50 PM in response to drazek73

BitTorrent is a broken login item.

System Preferences > Users & groups, select your account & edit the login items. Remove all UNKNOWN ones, they may be left over from old installs that have been removed, as such they are harmless - the item they want to launch can't be found.


Also remove the 3 failing times from /Users/YOURUSERNAME/Library/LaunchAgents/ delete the 3 files that are listed in the 'User Launch Agents' above.

Again these are probably harmless, just old junk (.Mac closed down years ago).


You seem convinced that the Mac is the only way this data could have been lost. If you are 100% sure that is the case just stop using it. Purchase a replacement HD & reinstall OS X via a known good network (or better get a new Mac, pass this onto the professionals). Avoid migrating any data from the 'compromised' disk(s).


Consider that routers can be compromised, Wifi Can be cracked if using older encryption, other network devices can be exploited too… When you start to think about all the possibilities your head can spin - which is why you need professional help to resolve this correctly. Contact a security firm or law enforcement if you have apparent evidence of a crime.


Personally I suspect there may be other simpler explanations, such as employees who said the wrong thing or you may be assuming the competitors know more than they actually do. Bluffing & choosing words carefully can gather more info than you may like to consider. Also consider how many industries can be a 'community', could your customers or suppliers have passed the info on, either accidentally or deliberately? All online web services are potentially vulnerable too, do you use online backup? How good is the Dropbox password? Do you use 2 factor/ 2 step authentication on any important sites?


Your reports don't show anything alarming to me, you haven't provided the evidence from Little Snitch. It is possible that could just be normal parts of the OS doing it's thing.


I'm not trying to convince you are wrong, just hoping that you have thought through all the possibilities & other sources for information to leak. Using a 'compromised' machine is not really a good idea - if 'attackers' really can see what you are doing maybe they have seen this & hidden themselves deeper or cleaned out any evidence.


Your Mac looks like many others that have been used for a number of years, junk accumulates when you migrate from one OS to another.

Sep 17, 2015 2:54 PM in response to Drew Reece

this is good stuff .. you put some sanity back into me at least 😉


i'll try to do all you recommended


here is the littlesnitch info btw .. 'network monitor' and 'all rules' down below it


apsd

/System/Library/PrivateFrameworks/ApplePushService.framework/apsd

Total: 75.8 kB sent, 111 kB received

Summary of 5 connections


Skype

/Applications/Skype.app

Total: 126 MB sent, 227 MB received

Summary of 1091 connections


discoveryd

/usr/libexec/discoveryd

Total: 190 kB sent, 556 kB received

Outgoing to 8.8.8.8, Port dns (53), Protocol UDP (17), 190 kB sent, 556 kB received


Safari

/Applications/Safari.app

Total: 195 kB sent, 1.94 MB received

Summary of 10 connections


Firefox

/Applications/Firefox.app

Total: 64.4 MB sent, 267 MB received

Summary of 473 connections


Google Chrome

/Applications/Google Chrome.app

Total: 10.3 MB sent, 30.1 MB received

Summary of 107 connections


Safari via Safari Networking

/Applications/Safari.app

/System/Library/StagedFrameworks/Safari/WebKit.framework/Versions/A/XPCServices/ com.apple.WebKit.Networking.xpc

Total: 3.38 MB sent, 36.7 MB received

Summary of 136 connections


Dropbox

/Applications/Dropbox.app

Total: 420 kB sent, 529 kB received

Summary of 13 connections


syncdefaultsd

/System/Library/PrivateFrameworks/SyncedDefaults.framework/Support/syncdefaultsd

Total: 152 kB sent, 179 kB received

Summary of 2 connections


Mobile Mouse Server

/Applications/Mobile Mouse Server.app

Total: 0 B sent, 0 B received

Summary of 2 connections


Dashboard

/System/Library/CoreServices/Dock.app/Contents/Resources/DashboardClient.app

Total: 1.84 kB sent, 3.42 kB received

Outgoing to wu-calculator.apple.com (17.171.43.55), Port http (80), Protocol TCP (6), 1.84 kB sent, 3.42 kB received


ntpd

/usr/sbin/ntpd

Total: 2.02 kB sent, 2.02 kB received

Outgoing to time.apple.com (17.253.84.253), Port ntp (123), Protocol UDP (17), 2.02 kB sent, 2.02 kB received


CalendarAgent

/System/Library/PrivateFrameworks/CalendarAgent.framework/Executables/CalendarAg ent

Total: 281 kB sent, 290 kB received

Summary of 4 connections


ocspd

/usr/sbin/ocspd

Total: 15.4 kB sent, 121 kB received

Summary of 7 connections


AddressBookSourceSync

/System/Library/Frameworks/AddressBook.framework/Versions/A/Helpers/AddressBookS ourceSync.app

Total: 108 kB sent, 313 kB received

Summary of 6 connections


com.apple.geod.xpc

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/c om.apple.geod.xpc

Total: 16.9 kB sent, 1.17 MB received

Summary of 4 connections


UserEventAgent

/usr/libexec/UserEventAgent

Total: 0 B sent, 0 B received

Outgoing to captive.apple.com (23.76.86.232), Port http (80), Protocol TCP (6), 0 B sent, 0 B received


GoToMeeting v7.2.4

/Users/drazek/Applications/GoToMeeting (3277).app

Total: 16.7 MB sent, 95.4 MB received

Summary of 31 connections


CitrixOnlineLauncher

/Users/drazek/Library/Application Support/CitrixOnline/CitrixOnlineLauncher.app

Total: 4.47 kB sent, 14.6 MB received

Summary of 2 connections


helpd

/System/Library/PrivateFrameworks/HelpData.framework/Versions/A/Resources/helpd

Total: 15.3 kB sent, 4.03 MB received

Outgoing to help.apple.com (23.76.88.139), Port https (443), Protocol TCP (6), 15.3 kB sent, 4.03 MB received


locationd

/usr/libexec/locationd

Total: 6.56 kB sent, 49.9 kB received

Outgoing to gs-loc.apple.com (17.167.194.149), Port https (443), Protocol TCP (6), 6.56 kB sent, 49.9 kB received


Google Software Update

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resour ces/GoogleSoftwareUpdateAgent.app

Total: 1.48 kB sent, 4.88 kB received

Outgoing to history.l.google.com (64.233.171.100), Port https (443), Protocol TCP (6), 1.48 kB sent, 4.88 kB received


Google Software Update via ksfetch

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resour ces/GoogleSoftwareUpdateAgent.app

/private/tmp/KSOutOfProcessFetcher.501.I5ci1K_TwCwqo1sKvc0siaBbJTw=/ksfetch

Total: 1.67 kB sent, 5.20 kB received

Outgoing to history.l.google.com (64.233.171.100), Port https (443), Protocol TCP (6), 1.67 kB sent, 5.20 kB received


GoogleSoftwareUpdateDaemon via ksfetch

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ GoogleSoftwareUpdateDaemon

/private/tmp/KSOutOfProcessFetcher.0.I5ci1K_TwCwqo1sKvc0siaBbJTw=/ksfetch

Total: 3.43 kB sent, 10.5 kB received

Outgoing to history.l.google.com (64.233.171.100), Port https (443), Protocol TCP (6), 3.43 kB sent, 10.5 kB received


plugin-container

/Applications/Firefox.app/Contents/MacOS/plugin-container.app

Total: 289 B sent, 226 B received

Outgoing to pixel2.moatads.com (52.21.158.40), Port 843, Protocol TCP (6), 23 B sent, 113 B received

Outgoing to pixel2.moatads.com (52.21.158.40), Port http (80), Protocol TCP (6), 266 B sent, 113 B received


bird

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/b ird

Total: 4.06 kB sent, 12.9 kB received

Outgoing to setup.icloud.com (17.167.138.45), Port https (443), Protocol TCP (6), 4.06 kB sent, 12.9 kB received


Microsoft AutoUpdate

/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app

Total: 5.61 kB sent, 119 MB received

Summary of 2 connections


Safari via Safari Web Content

/Applications/Safari.app

/System/Library/StagedFrameworks/Safari/WebKit.framework/Versions/A/XPCServices/ com.apple.WebKit.WebContent.xpc

Total: 47.5 kB sent, 496 kB received

Summary of 30 connections


EtreCheck

/Users/drazek/Downloads/EtreCheck.app

Total: 688 B sent, 38.8 kB received

Summary of 3 connections


Safari via com.apple.Safari.SearchHelper.xpc

/Applications/Safari.app

/System/Library/StagedFrameworks/Safari/Safari.framework/Versions/A/XPCServices/ com.apple.Safari.SearchHelper.xpc

Total: 5.44 kB sent, 19.5 kB received

Outgoing to clients2.google.com (74.125.228.225), Port https (443), Protocol TCP (6), 5.44 kB sent, 19.5 kB received


cloudd

/System/Library/PrivateFrameworks/CloudKitDaemon.framework/Support/cloudd

Total: 41.4 kB sent, 432 kB received

Summary of 4 connections


fpsaud

/Library/Application Support/Adobe/Flash Player Install Manager/fpsaud

Total: 884 B sent, 5.83 kB received

Outgoing to fpdownload.macromedia.com (23.76.68.127), Port https (443), Protocol TCP (6), 884 B sent, 5.83 kB received


nbagent

/System/Library/PrivateFrameworks/Noticeboard.framework/Versions/A/Resources/nba gent.app

Total: 862 B sent, 5.38 kB received

Outgoing to swscan.apple.com (17.146.232.12), Port https (443), Protocol TCP (6), 862 B sent, 5.38 kB received


SubmitDiagInfo

/System/Library/CoreServices/SubmitDiagInfo

Total: 22.5 kB sent, 3.76 kB received

Outgoing to radarsubmissions.apple.com (17.148.88.63), Port https (443), Protocol TCP (6), 22.5 kB sent, 3.76 kB received


Adobe Dreamweaver CS4

/Applications/Adobe Dreamweaver CS4/Adobe Dreamweaver CS4.app

Total: 1.30 kB sent, 44.6 kB received

Outgoing to djnf6e5yyirys.cloudfront.net (54.230.39.52), Port http (80), Protocol TCP (6), 1.30 kB sent, 44.6 kB received


mapspushd

/System/Library/CoreServices/mapspushd

Total: 882 B sent, 4.79 kB received

Outgoing to gspe35-ssl.ls.apple.com (23.76.86.219), Port https (443), Protocol TCP (6), 882 B sent, 4.79 kB received


com.apple.iCloudHelper.xpc

/System/Library/PrivateFrameworks/AOSKit.framework/Versions/A/XPCServices/com.ap ple.iCloudHelper.xpc

Total: 4.29 kB sent, 18.7 kB received

Summary of 2 connections


storeaccountd

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/sto reaccountd

Total: 2.58 kB sent, 34.7 kB received

Summary of 2 connections


fmfd

/usr/libexec/fmfd

Total: 3.42 kB sent, 5.32 kB received

Outgoing to p05-fmfmobile.icloud.com (17.172.100.55), Port https (443), Protocol TCP (6), 3.42 kB sent, 5.32 kB received


SafariDAVClient

/System/Library/PrivateFrameworks/BookmarkDAV.framework/Versions/A/Helpers/Safar iDAVClient

Total: 4.13 kB sent, 12.5 kB received

Outgoing to p05-bookmarks-current.edge.icloud.apple-dns.net (17.248.135.211), Port https (443), Protocol TCP (6), 4.13 kB sent, 12.5 kB received


Microsoft AU Daemon

/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft AU Daemon.app

Total: 2.48 kB sent, 72.1 kB received

Outgoing to www.microsoft.com (23.218.210.155), Port http (80), Protocol TCP (6), 2.48 kB sent, 72.1 kB received


AppleIDAuthAgent

/System/Library/CoreServices/AppleIDAuthAgent

Total: 1.01 kB sent, 4.59 kB received

Outgoing to setup.icloud.com (17.167.138.45), Port https (443), Protocol TCP (6), 1.01 kB sent, 4.59 kB received


findmydeviced

/usr/libexec/findmydeviced

Total: 0 B sent, 0 B received

Outgoing to p05-fmip.icloud.com (17.172.100.49), Port https (443), Protocol TCP (6), 0 B sent, 0 B received


CFNetworkAgent

/System/Library/Frameworks/CFNetwork.framework/Versions/A/Support/CFNetworkAgent

Total: 460 B sent, 2.08 kB received

Outgoing to configuration.apple.com (23.76.86.143), Port http (80), Protocol TCP (6), 460 B sent, 2.08 kB received


SpotlightNetHelper

/System/Library/PrivateFrameworks/ParsecUI.framework/Versions/A/Support/Spotligh tNetHelper.app

Total: 125 kB sent, 1.80 MB received

Summary of 4 connections


identityservicesd via IMRemoteURLConnectionAgent.xpc

/System/Library/PrivateFrameworks/IDS.framework/identityservicesd.app

/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURL ConnectionAgent.xpc

Total: 237 B sent, 5.24 kB received

Outgoing to init.ess.apple.com (184.29.104.217), Port http (80), Protocol TCP (6), 237 B sent, 5.24 kB received



action: allow

direction: incoming

process: any

owner: system

destination: local-net

port: any

protocol: any

help: Local Network is an alias for your home or company network. Technically speaking, it covers all networks your computer is physically connected to (e.g. via Wi-Fi, ethernet cable, dial-up connection, etc). The represented address ranges are updated with every change of your network configuration.


action: allow

direction: incoming

process: any

owner: system

destination: any

port: any

protocol: 17

help: UDP packets are used for data where delays are not acceptable, e.g. streaming multimedia data. This rule allows all system processes to receive UDP data packets.


action: allow

direction: incoming

process: any

owner: system

destination: any

port: any

protocol: 1

help: ICMP data packets are used to propagate information relating to the network itself, e.g. whether a host is unreachable or whether a remote port is not ready to receive connections. This rule allows all system processes to receive ICMP data packets.


action: allow

direction: incoming

process: any

owner: me

destination: local-net

port: any

protocol: any

help: Local Network is an alias for your home or company network. Technically speaking, it covers all networks your computer is physically connected to (e.g. via Wi-Fi, ethernet cable, dial-up connection, etc). The represented address ranges are updated with every change of your network configuration.


action: allow

direction: incoming

process: any

owner: me

destination: any

port: any

protocol: 1

help: ICMP data packets are used to propagate information relating to the network itself, e.g. whether a host is unreachable or whether a remote port is not ready to receive connections. This rule allows all user processes to receive ICMP data packets.


action: allow

direction: incoming

process: any

owner: me

destination: any

port: any

protocol: 17

help: UDP packets are used for data where delays are not acceptable, e.g. streaming multimedia data. This rule allows all user processes to receive UDP data packets.


action: allow

direction: outgoing

process: /System/Library/PrivateFrameworks/ApplePushService.framework/apsd

owner: system

destination: domain push.apple.com

port: any

protocol: any

help: Part of Apple’s PushService framework.


action: deny

direction: outgoing

process: /usr/sbin/nmbd

owner: system

destination: 192.168.32.1

port: any

protocol: any


action: allow

direction: incoming

process: /Applications/Skype.app/Contents/MacOS/Skype

owner: me

destination: any

port: any

protocol: any


action: deny

direction: outgoing

process: /usr/libexec/XProtectUpdater

owner: system

destination: 184.24.154.224

port: 80

protocol: 6


action: allow

direction: outgoing

process: any

owner: system

destination: domain icloud.com

port: 443

protocol: 6

help: This rule is necessary if you want to use iCloud services.


action: allow

direction: outgoing

process: any

owner: system

destination: local-net

port: any

protocol: any

help: Local Network is an alias for your home or company network. Technically speaking, it covers all networks your computer is physically connected to (e.g. via Wi-Fi, ethernet cable, dial-up connection, etc). The represented address ranges are updated with every change of your network configuration.


action: allow

direction: outgoing

process: /System/Library/CoreServices/AppleIDAuthAgent

owner: me

destination: identity.apple.com

port: 443

protocol: 6

help: AppleIDAuthAgent is used to check whether Apple-ID certificates are valid.


action: allow

direction: outgoing

process: /System/Library/Frameworks/CFNetwork.framework/Versions/A/Support/AssetCacheLoc atorService

owner: system

destination: any

port: any

protocol: any

help: On Sep 13, 2015, AssetCacheLocatorService tried to establish a connection to lcdn-locator.apple.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /System/Library/PrivateFrameworks/AssistantServices.framework/assistantd

owner: me

destination: domain apple.com

port: 443

protocol: 6

help: This rule is necessary if you want to use Apple’s dictation services.


action: allow

direction: outgoing

process: /usr/sbin/automount

owner: system

destination: any

port: any

protocol: any

help: Automount is responsible for on-demand mounting of remote file systems. This rule enables automount to access file servers outside your local network.


action: deny

direction: outgoing

process: /usr/libexec/automountd

owner: system

destination: any

port: any

protocol: any

help: On Sep 12, 2015, automountd tried to establish a connection to bittorrent.app on port 111 (sunrpc). The request was denied via connection alert.


action: deny

direction: outgoing

process: /usr/libexec/crsud

owner: system

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /usr/libexec/discoveryd

owner: system

destination: any

port: 53

protocol: any

help: discoveryd is the central service in OS X that maps computer names to Internet addresses.


action: allow

direction: outgoing

process: /Library/Application Support/Adobe/Flash Player Install Manager/fpsaud

owner: system

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS /GoogleSoftwareUpdateDaemon

owner: system

destination: any

port: any

protocol: any

help: On Sep 12, 2015, GoogleSoftwareUpdateDaemon via ksfetch tried to establish a connection to tools.google.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /System/Library/PrivateFrameworks/HelpData.framework/Versions/A/Resources/helpd

owner: me

destination: domain apple.com

port: 443

protocol: 6

help: helpd downloads dynamic content for Apple's HelpViewer. If you disable this rule, HelpViewer search won't work.


action: allow

direction: outgoing

process: /Library/Little Snitch/Little Snitch Agent.app/Contents/MacOS/Little Snitch Agent

owner: me

destination: ***.obdev.at

port: 80

protocol: any

help: This rule allows Little Snitch’s connection alert to request more information about a connection from Objective Development’s Research Assistant Database. You can safely disable this rule if you don’t use this feature.


action: allow

direction: outgoing

process: /usr/libexec/locationd

owner: system

destination: any

port: any

protocol: any

help: On Sep 12, 2015, locationd tried to establish a connection to cl2.apple.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /sbin/mount_nfs

owner: system

destination: any

port: any

protocol: any

help: The mount_nfs utility performs file system mounts from Network File System (NFS) servers. This rule allows mount_nfs to access file servers outside your local network.


action: allow

direction: outgoing

process: /usr/libexec/mount_url

owner: system

destination: any

port: any

protocol: any

help: The mount_url tool performs file system mounts of WebDAV servers and other remote file systems that can be specified as URL. This rule allows mount_url to access such servers over the Internet.


action: allow

direction: outgoing

process: /usr/libexec/nsurlsessiond

owner: system

destination: any

port: any

protocol: any

help: On Sep 13, 2015, nsurlsessiond tried to establish a connection to swcdn.apple.com on port 80 (http). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /usr/sbin/ntpd

owner: system

destination: any

port: 123

protocol: 17

help: ntpd is the network time daemon that synchronizes your clock with a network time server.


action: allow

direction: outgoing

process: /usr/sbin/ocspd

owner: system

destination: any

port: any

protocol: any

help: ocspd is the “Online Certificate Status Protocol” daemon that processes certificate validation. Verisign is one of the common providers of Internet certificates so it’s one of the services the ocspd process will contact for certificate updates and verification.\n\nFor more detailed information please refer to http://en.wikipedia.org/wiki/X.509


action: allow

direction: outgoing

process: /usr/bin/sntp

owner: system

destination: any

port: 123

protocol: 17

help: sntp is the network time daemon that synchronizes your clock with a network time server.


action: allow

direction: outgoing

process: /System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated

owner: system

destination: any

port: any

protocol: any

help: On Sep 13, 2015, softwareupdated tried to establish a connection to p01-swscan.apple.com.akadns.net on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /System/Library/CoreServices/SubmitDiagInfo

owner: system

destination: any

port: any

protocol: any

help: On Sep 13, 2015, SubmitDiagInfo tried to establish a connection to radarsubmissions.apple.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: any

owner: me

destination: domain icloud.com

port: 443

protocol: 6

help: This rule is necessary if you want to use iCloud services.


action: allow

direction: outgoing

process: /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteUR LConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent

owner: me

destination: domain apple.com

port: any

protocol: any

help: IMRemoteURLConnectionAgent.xpc is part of Apple’s messaging/chat services.


action: allow

direction: outgoing

process: /Library/Little Snitch/Little Snitch Agent.app/Contents/MacOS/Little Snitch Agent

owner: me

destination: domain apple.com

port: any

protocol: any

help: This rule allows Little Snitch to determine the current geographic location when a network is joined. This information is only saved if “Save location of networks” is enabled in the preferences.


action: allow

direction: outgoing

process: /Applications/Skype.app/Contents/MacOS/Skype

owner: me

destination: domain skype.com

port: any

protocol: any


action: allow

direction: outgoing

process: /Applications/Skype.app/Contents/MacOS/Skype

owner: me

destination: domain skype.net

port: any

protocol: any


action: allow

direction: outgoing

process: any

owner: me

destination: local-net

port: any

protocol: any

help: Local Network is an alias for your home or company network. Technically speaking, it covers all networks your computer is physically connected to (e.g. via Wi-Fi, ethernet cable, dial-up connection, etc). The represented address ranges are updated with every change of your network configuration.


action: allow

direction: outgoing

process: /System/Library/Frameworks/AddressBook.framework/Versions/A/Helpers/AddressBook SourceSync.app/Contents/MacOS/AddressBookSourceSync

owner: me

destination: any

port: any

protocol: any

help: On Sep 12, 2015, AddressBookSourceSync tried to establish a connection to www.facebook.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Applications/Adobe Dreamweaver CS4/Adobe Dreamweaver CS4.app/Contents/MacOS/Dreamweaver

owner: me

destination: any

port: any

protocol: any

help: On Sep 17, 2015, Adobe Dreamweaver CS4 tried to establish a connection to d3qmoiwwdk0tnn.cloudfront.net on port 80 (http). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Applications/Utilities/Adobe Flash Player Install Manager.app/Contents/MacOS/Adobe Flash Player Install Manager

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /Applications/Utilities/Adobe Utilities.localized/Adobe Updater6/Adobe Updater.app/Contents/MacOS/Adobe Updater

owner: me

destination: any

port: any

protocol: any

help: On Sep 17, 2015, Adobe Updater tried to establish a connection to swupmf.adobe.com on port 80 (http). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Applications/AdWords Editor.app/Contents/MacOS/xulrunner

owner: me

destination: any

port: any

protocol: any

help: On Sep 12, 2015, AdWords Editor tried to establish a connection to blogger.l.google.com on port 80 (http). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /System/Library/CoreServices/AirPort Base Station Agent.app/Contents/MacOS/AirPort Base Station Agent

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /Applications/App Store.app/Contents/MacOS/App Store

owner: me

destination: any

port: any

protocol: any

help: This rule is necessary if you want to use the Mac App Store.


action: allow

direction: outgoing

process: /System/Library/PrivateFrameworks/CalendarAgent.framework/Executables/CalendarA gent

owner: me

destination: any

port: any

protocol: any

help: On Sep 17, 2015, CalendarAgent tried to establish a connection to webdav.facebook.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Users/drazek/Downloads/CCleaner.app/Contents/MacOS/CCleaner

owner: me

destination: any

port: any

protocol: any

help: On Sep 12, 2015, CCleaner tried to establish a connection to piriform.com on port 80 (http). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /System/Library/Frameworks/CFNetwork.framework/Versions/A/Support/CFNetworkAgen t

owner: me

destination: any

port: any

protocol: any

help: On Sep 17, 2015, CFNetworkAgent tried to establish a connection to configuration.apple.com on port 80 (http). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Users/drazek/Library/Application Support/CitrixOnline/CitrixOnlineLauncher.app/Contents/MacOS/Citrix Online Launcher

owner: me

destination: any

port: any

protocol: any

help: On Sep 17, 2015, CitrixOnlineLauncher tried to establish a connection to builds.cdn.citrixonline.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /System/Library/PrivateFrameworks/CloudKitDaemon.framework/Support/cloudd

owner: me

destination: any

port: any

protocol: any

help: On Sep 16, 2015, cloudd tried to establish a connection to configuration.apple.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/ com.apple.geod.xpc/Contents/MacOS/com.apple.geod

owner: me

destination: any

port: any

protocol: any

help: On Sep 12, 2015, com.apple.geod.xpc tried to establish a connection to gsp1.apple.com on port 80 (http). The request was allowed via connection alert.


action: deny

direction: outgoing

process: /usr/libexec/crsud

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /System/Library/CoreServices/Dock.app/Contents/Resources/DashboardClient.app/Co ntents/MacOS/DashboardClient

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /Library/Application Support/DivX/DivXUpdate.app/Contents/MacOS/DivXUpdate

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /Applications/Dropbox.app/Contents/MacOS/Dropbox

owner: me

destination: any

port: any

protocol: any

help: On Sep 17, 2015, Dropbox tried to establish a connection to client.dropbox.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Users/drazek/Downloads/EtreCheck.app/Contents/MacOS/EtreCheck

owner: me

destination: any

port: any

protocol: any

help: On Sep 17, 2015, EtreCheck tried to establish a connection to etresoft.com on port 80 (http). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Applications/FileZilla.app/Contents/MacOS/filezilla

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /Applications/Firefox.app/Contents/MacOS/firefox

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /System/Library/PrivateFrameworks/GameCenterFoundation.framework/Versions/A/gam ed

owner: me

destination: any

port: any

protocol: any

help: On Sep 17, 2015, gamed tried to establish a connection to init.gc.apple.com on port 80 (http). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Applications/Google Chrome.app/Contents/MacOS/Google Chrome

owner: me

destination: any

port: any

protocol: any

help: On Sep 12, 2015, Google Chrome tried to establish a connection to 8.8.8.8 on port 53 (domain). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resou rces/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /Library/Application Support/Google/GoogleTalkPlugin.app/Contents/MacOS/GoogleTalkPlugin

owner: me

destination: any

port: any

protocol: any

help: On Sep 16, 2015, GoogleTalkPlugin tried to establish a connection to stun.l.google.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Users/drazek/Applications/GoToMeeting (3277).app/Contents/MacOS/GoToMeeting

owner: me

destination: any

port: any

protocol: any

help: On Sep 17, 2015, GoToMeeting v7.2.4 tried to establish a connection to egwglobal.gotomeeting.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Applications/iBooks.app/Contents/MacOS/iBooks

via: /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/XPCServices/ com.apple.CommerceKit.TransactionService.xpc/Contents/MacOS/com.apple.CommerceKi t.TransactionService

owner: me

destination: any

port: any

protocol: any

help: On Sep 12, 2015, iBooks via com.apple.CommerceKit.TransactionService.xpc tried to establish a connection to init.itunes.apple.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Applications/iBooks.app/Contents/MacOS/iBooks

owner: me

destination: any

port: any

protocol: any

help: On Sep 12, 2015, iBooks tried to establish a connection to bookkeeper.itunes.apple.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Applications/iPhoto.app/Contents/MacOS/iPhoto

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /Applications/iTunes.app/Contents/MacOS/iTunes

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /Applications/Mail.app/Contents/MacOS/Mail

owner: me

destination: any

port: 995

protocol: 6

help: This rule allows Mail.app to receive emails via the SSL-encrypted Post Office Protocol (POP).


action: allow

direction: outgoing

process: /Applications/Mail.app/Contents/MacOS/Mail

owner: me

destination: any

port: 993

protocol: 6

help: This rule allows Mail.app to receive emails via the SSL-encrypted Internet Message Access Protocol (IMAP).


action: allow

direction: outgoing

process: /Applications/Mail.app/Contents/MacOS/Mail

owner: me

destination: any

port: 587

protocol: 6

help: This rule allows Mail.app to send emails via the authenticated Simple Mail Transfer Protocol (SMTP).


action: allow

direction: outgoing

process: /Applications/Mail.app/Contents/MacOS/Mail

owner: me

destination: any

port: 465

protocol: 6

help: This rule allows Mail.app to send emails via the Simple Mail Transfer Protocol (SMTP) secured using SSL/TLS.


action: allow

direction: outgoing

process: /Applications/Mail.app/Contents/MacOS/Mail

owner: me

destination: any

port: 143

protocol: 6

help: This rule allows Mail.app to receive emails via the Internet Message Access Protocol (IMAP).


action: allow

direction: outgoing

process: /Applications/Mail.app/Contents/MacOS/Mail

owner: me

destination: any

port: 110

protocol: 6

help: This rule allows Mail.app to receive emails via the Post Office Protocol (POP).


action: allow

direction: outgoing

process: /Applications/Mail.app/Contents/MacOS/Mail

owner: me

destination: any

port: 25

protocol: 6

help: This rule allows Mail.app to send emails via the Simple Mail Transfer Protocol (SMTP).


action: allow

direction: outgoing

process: /System/Library/CoreServices/mapspushd

owner: me

destination: any

port: any

protocol: any

help: On Sep 13, 2015, mapspushd tried to establish a connection to gspe35-ssl.ls.apple.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft AU Daemon.app/Contents/MacOS/Microsoft AU Daemon

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft AutoUpdate

owner: me

destination: any

port: any

protocol: any


action: deny

direction: outgoing

process: /Applications/Mobile Mouse Server.app/Contents/MacOS/Mobile Mouse Server

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /System/Library/PrivateFrameworks/Noticeboard.framework/Versions/A/Resources/nb agent.app/Contents/MacOS/nbagent

owner: me

destination: any

port: any

protocol: any

help: On Sep 13, 2015, nbagent tried to establish a connection to swscan.apple.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Applications/Firefox.app/Contents/MacOS/plugin-container.app/Contents/MacOS/pl ugin-container

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.ap p/Contents/MacOS/PubSubAgent

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /Applications/Safari.app/Contents/MacOS/Safari

owner: me

destination: any

port: 443

protocol: 6

help: Port 443 (https) is the default port for secure webservers. With this rule you will be able to connect to typical secure websites with Safari.


action: allow

direction: outgoing

process: /Applications/Safari.app/Contents/MacOS/Safari

owner: me

destination: any

port: 80

protocol: 6

help: Port 80 (http) is the default port for webservers. With this rule you will be able to visit most of the common (non-encrypted) websites with Safari.


action: allow

direction: outgoing

process: /Applications/Safari.app/Contents/MacOS/Safari

via: /System/Library/StagedFrameworks/Safari/WebKit.framework/Versions/A/XPCServices /com.apple.WebKit.Plugin.64.xpc/Contents/MacOS/com.apple.WebKit.Plugin.64

owner: me

destination: any

port: any

protocol: any

help: On Sep 12, 2015, Safari via com.apple.WebKit.Plugin.64.xpc tried to establish a connection to pixel2.moatads.com on port 843. The request was allowed via connection alert.


action: allow

direction: outgoing

process: /Applications/Skype.app/Contents/MacOS/Skype

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /System/Library/CoreServices/Software Update.app/Contents/MacOS/Software Update

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /System/Library/CoreServices/Software Update.app/Contents/Resources/SoftwareUpdateCheck

owner: me

destination: any

port: any

protocol: any


action: allow

direction: outgoing

process: /System/Library/PrivateFrameworks/ParsecUI.framework/Versions/A/Support/Spotlig htNetHelper.app/Contents/MacOS/SpotlightNetHelper

owner: me

destination: any

port: any

protocol: any

help: On Sep 12, 2015, SpotlightNetHelper tried to establish a connection to api.smoot.apple.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/st oreaccountd

owner: me

destination: any

port: any

protocol: any

help: On Sep 17, 2015, storeaccountd tried to establish a connection to init.itunes.apple.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/st oreassetd

owner: me

destination: any

port: any

protocol: any

help: On Sep 13, 2015, storeassetd tried to establish a connection to su.itunes.apple.com on port 443 (https). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/st oredownloadd

owner: me

destination: any

port: any

protocol: any

help: On Sep 13, 2015, storedownloadd tried to establish a connection to a397.phobos.apple.com on port 80 (http). The request was allowed via connection alert.


action: allow

direction: outgoing

process: /System/Library/CoreServices/SubmitDiagInfo

owner: me

destination: any

port: any

protocol: any

Sep 18, 2015 1:14 PM in response to drazek73

There is an awful lot going on there, but I can't see anything that seems abnormal. I can't pretend to know a lot about key loggers & other tools that could be used to extract data but I don't see any signs in that output. The trouble is that the data may have removed before this reporting was started or it may have been a different type of attack, like at a router or hardware keylogger (there are too many ways to speculate).


Many of the connections are from system tools, they are just part of how OS X works these days. It has a network addiction.


I do wonder if Citrix's app could have been used against you - any remote access tool has a lot of power. Ensure your account is secure if you have previously shared passwords or login details for that account.


Wireshark will only help if you know what to look for. Network data is full of many management frames & lots of traffic that is beyond my abilities to diagnose.


I don't think I have an answer you want to hear… basically if you don't trust it, clean install it and/ or get it investigated by a professional. Restoring data after a breach is a major battle, finding out how you have been attacked is equally hard, it becomes even more difficult when you are not even sure if an attack has actually happened.

detect key logger, screen capture, spyware on mac @linc davis

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.