How To Detect / Clean a possible Botnet?

Question

How To Detect / Clean a possible Botnet?

Hello I just receive a message from Time Warner Cable today telling me they have "detected signs of botnet traffic being transmitted from a device connected to the cable modem on your Time Warner Cable Internet connection." I really do hope they are wrong.

I have 3 macs here on El Capitan, one Time Capsule and one airport express, and a couple of Apple TVs/ipads/iphones and one Epson printer. I am focusing on the macs.. and wondering what is the best way to go about detecting and removing anything that is part of this possible botnet? It is my understanding that bots are not viruses.. or would a simple anti-virus program work? I've never trusted any of those programs and always saw them as incomplete or part of a scare tactic cash grab. I also didn't want a resource hogging program scanning the computer all day all the time like I used to have on a windows machine quite some time ago. But if I really have to in this case, I want to know what the Mac Pros use when there is a problem of any sort like this.

I use one machine mainly and it was at one point yesterday using a more than the usual CPU. By the way I briefly went to the secrity and privay preference pane on this mac about 30 minutes ago and at first it wouldn't even open. I got an error message saying something like "it wasn't available" or something to that effect. I had to launch it several times before it would successfully open.

Before anyone asks:

1. Yes I have a fairly long complicated wi-fi password (WPA2 i believe)

2. I don't see anything else on the network except the devices owned here

3. All devices are updated to the latest OS

4. None have any sort of anti-virus installed

Mac mini, OS X El Capitan (10.11.1), null

Posted on Jun 8, 2016 3:34 PM

Reply

Answer 1

cdhw

Level 4

3,594 points

Jun 8, 2016 4:22 PM in response to Jacqueline Hutchins

Are you sure that the email purporting to come from TWC is genuine and not a phishing attempt? Are any websites you are asked to visit really Time Warner sites, e.g. If so...

I approve of your attitude to antivirus programs, steer well clear of them. Installing AV doesn't fix a problem on a Mac, it gives you another problem.

Are you running any torrents?

Use Activity Monitor to check the amount of network traffic and try to identify the process(es) responsible by looking at the sent/received bytes columns.

C.

Reply

Answer 2

Jun 8, 2016 8:25 PM in response to Jacqueline Hutchins

Hi Jacqueline,

Have you considered or thought about using a program like LittleSnitch to try to track traffic a little better? A shot in the dark but it seems like it would be an extremely useful tool in this case.

https://www.obdev.at/products/littlesnitch/index.html

I wish you luck with your botnet issue!

Regards,

DroneRush.

Reply

Answer 3

Jun 8, 2016 5:01 PM in response to cdhw

You know come to think of it, I'm not _absoutely_ sure it is from Time Warner cable. The email does come from "donotreply@twcable.com"

And the link embedded inthe message goes to twcc.com. The site is pretty extensive about botnets etc with links to purchase McAffee pro.

There is also an 855 number which called, i stopped when I got to the pin part of my account questions because I forgot it. For the most part it seemed like the real deal. Either way your question is a good one to ask in a situation like this.

No I do have any torrents running. However I did click a headline link on reddit yesterday which automatically downloaded a file without my consent. I only intented to read the article. So I deleted it. It was related to some marketplace app for bitcoin. Not sure if this is related or not.

Thanks for the info. I am monitoring traffic now with the activity monitor

Reply

Answer 4

Jul 26, 2016 9:33 AM in response to Jacqueline Hutchins

I received this email this morning as well from the same donotreply@twcable.com address and I do not believe it is actually twc emailing us but was wondering what you found out.

Reply

Answer 5

Lexiepex

Level 6

14,108 points

Jul 26, 2016 9:42 AM in response to Jacqueline Hutchins

This is a scam. Nothing to do with Time Warner.

Don't install Little Snitch or Antivirus or whatever....

Easy to get rid of it:

Quit Safari from the menu,

Start Safari while holding the Shift key, it opens normal,

in Safari Preferences select "Clear History..." and Clear History and Website Data,

Then in Safari Preferences, set your Homepage, when it has changed.

That's it.

Reply