[AlekseyZubkov]

Tonight in the windmill thread WW suggested I go to Google Earth, and since I hadn't been there for a long time I decided it was a good idea. The site wanted me to download the program, so I did.

After it downloaded, I went to the Downloads folder to click/install it. That's when I got worried. I have a MacBook. When I plug in a camera, my iPhone, etc., it is listed on the left margin, with a kind of "equal" sign that I can click on. Well, on that screen was something/someone connected to my computer via FTP. I wish I would have written down the name, but the last name was something like Steinberg.

Have I been hacked? Is this one of those programs that steals passwords, etc? I clicked to disconnect it, and now I can't find it, so I'm 'assuming' it's gone. I do have Norton on my computer, but I disabled it a long time ago because it slowed the machine so much, and I felt Mac-safe. Not feeling so safe right now.

Suggestions as to what is was, and what I should do???

I've been in DR 2 months, and thank God I haven't done any online banking. Of course, I'm now dying to check my accounts, but don't dare.

Am I overreacting? Never have seen anything like that before.

Help!

[yK2VgoEI]

You haven't been hacked. You can just see them as they are on the same wireless/network and they have a shared folder or open machine.

You mentioned FTP, how do you know this, what appeared on the screen.

[AlekseyZubkov]

Hi Robert,

It clearly said it was connected via FTP.

I'm on a Claro USB 'stick', in the middle of nowhere, probably very few computers anywhere near me [if any!!!], and the person's name was certainly not Dominican.

I'm so mad at myself for not writing down exactly what it said before I clicked "disconnect".

[Unrersvar]

Calmate...you are worrying needlessly. You are fine.

[yK2VgoEI]

Hi Robert,

It clearly said it was connected via FTP.

I'm on a Claro USB 'stick', in the middle of nowhere, probably very few computers anywhere near me [if any!!!], and the person's name was certainly not Dominican.

I'm so mad at myself for not writing down exactly what it said before I clicked "disconnect".

Did it connect under "Shared" in the left margin?

Without more details, not much else I can do. You can always install software like "Little Snitch" that monitors all your In/Out traffic and you can block certain protocols, people, sites, IP's etc.

[AlekseyZubkov]

I have never seen or heard of this running on a Mac.
I also had a good look at Google and couldn't find this being an issue for Mac.

Are you sure the trojan.maljava wasn't a false positive. This sounds like typical Norton scare tactics!
I'm not sure of anything Robert. A box popped up during the scan and said computer was infected with that, and I clicked "repair" and it then marked it "deleted".

Nortons own site does not list this trojan effecting Mac OS.

Trojan.Maljava | Symantec

Are you running Boot Camp, VMWare or Parallels to run Windows on your Mac?
None of the above. I have no Windows anything on the Mac.


One thing you might want to do is turn on your Mac firewall, that will kill off the port scans etc,
I did turn the Norton Firewall back on soon as the scan was done.

Mac OS X 10.5 Help: Protecting your computer with a firewall

Thanks for the info and the link Robert!

[AlekseyZubkov]

I'm running Norton right now, I had turned off the firewall because MagicJack wouldn't work with it. It found [so far] an attack [Named PortScan], applicaion: /mach_kernal, from an IP address in VietNam [172.43.1.135], which it has disabled.

Is this a concern?

[AlekseyZubkov]

Uh-Oh.... I'm starting to feel guilty..

Sorry Grace, I didn't mean to start anything.

I hope it works out.....

Hey, I'm glad it happened, I now have a clean machine. Otherwise I was vulnerable, and would have jumped into online banking soon as I returned home.

Everything happens for a reason.

[yK2VgoEI]

I have never seen or heard of this running on a Mac.
I also had a good look at Google and couldn't find this being an issue for Mac.

Are you sure the trojan.maljava wasn't a false positive. This sounds like typical Norton scare tactics!

Nortons own site does not list this trojan effecting Mac OS.

Trojan.Maljava | Symantec

Are you running Boot Camp, VMWare or Parallels to run Windows on your Mac?


One thing you might want to do is turn on your Mac firewall, that will kill off the port scans etc,

Mac OS X 10.5 Help: Protecting your computer with a firewall

[Lenkapuppia]

Try a netstat -a from a command prompt. It will show all open connections

[farmarrl]

FTP is File Transfer Protocol. It's generally used to upload files from a computer to a web server in a clear text fashion.

I think you're fine. I find it odd you'd get a "connected via FTP" message. Even torrents don't use FTP.

[AlekseyZubkov]

It took 2 hours to run Norton - came up that my Mac was also infected with trojan.maljava. I googled it and it sounds very nasty. I'm thinking that might be what I stumbled on last night. ???????

From now on I guess I need to be a vigilant with the Mac as I am with our PC.

Be careful out there.

[pharmablogger]

Uh-Oh.... I'm starting to feel guilty..

Sorry Grace, I didn't mean to start anything.

I hope it works out.....

[luspikals]

Downloading Google Earth from the Google website will introduce no viruses, I'm sure of that. I'm equally sure that Norton isn't the best thing to use on a Mac. I've tried most of them and VirusBarrier seems to take the cake for me. Admittedly I didn't try Kaspersky Lab United States | Antivirus Computer Security before I committed to VirusBarrier (although that is the one I use on my PC).

Nice that you cleaned up the Mac, tho. Not good having nasty critters running around. Not that it would have infected you but, possibly, you'd have given it to someone else on the less-than-useful-operating-system called Windows.