Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #67763

Re: Process names

Show all headers | View raw

In article
<chine.bleu-AA3959.23323819122014@news.eternal-september.org>, Siri
Crews <chine.bleu@yahoo.com> wrote:

> > > > I was wrong. They are so quick to appear and disappear that I thought I
> > > > had read them as root. They are instead ??? user. It is tricky to get a
> > > > screengrab of one due to the speed and being random. I did get one as
> > > > shown in the top entry of this screengrab.
> > > > http://s12.postimg.org/aspu6wkgd/Process_Viewer.jpg
> 
> MacOSX allows file names like that, but I've never heard of anything from
> Apple 
> running with a name like that. User ??? means the uid isn't a defined on your 
> Mac: unix allows you to use uids that are undefined to a username, but it's
> not 
> normal. This can happen for things like cp -p, tar -x -p, or running from a 
> network volume with different usernames.
> 
> It looks highly suspiciuous to me, like you've picked up a parasite on your 
> journeys through the intertubeworks.
> 
> I would suggest disconnecting your Mac from everything else, than find out 
> what's starting the process, disable it, then hunt around the internet for to 
> see if it's reported as malware.
> 
> With the activity monitor you can double click a process to inspect it and
> then 
> look through the open files tab. 

Process Viewer with early Mac OS versions doesn't do that. All it does
is display the information in the screengrab. Doubleclicking does not
do anything and there is no more information available from menu
options.



> With Termminal you can use ps -ajx to get
> the 
> same process list.
>     while true
>     do
>         echo =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
>         ps -ajx
>         sleep 1
>     done
> will fill you Terminal with process status every second. Once you see
> something 
> suspicious, you can hit Control-C until it stops. The information is now
> fixed 
> on the Terminal until you clear it, so you can easily copy and paste
> suspicious 
> lines to a text edittor. This is easier than trying to get screen grab at
> just 
> the right moment.
> 
> You can use the Terminal for other unix commands like lsof and netstat to
> track 
> down suspicious activity.

These processes are very quick. With Process Viewer set to 5 second
updates they appear and then disappear at the next update. There is no
real way to track them or see the information. They also seem to be
random and it is not possible to tell when they appear. 

They may not even exist and be just artefacts from a slow computer. The
real process underneath in Process View sometimes has the same CPU and
RAM data.

Back to comp.sys.mac.system | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Process names Mickey MacMouse <mickey@mousehouse.com> - 2014-12-20 14:30 +1300
  Re: Process names Jolly Roger <jollyroger@pobox.com> - 2014-12-20 01:43 +0000
  Re: Process names JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-12-19 21:15 -0500
  Re: Process names Mickey MacMouse <mickey@mousehouse.com> - 2014-12-20 18:17 +1300
    Re: Process names Jolly Roger <jollyroger@pobox.com> - 2014-12-20 05:59 +0000
    Re: Process names Martin Frost me at invalid stanford daht edu <nospam@stanford.edu.invalid> - 2014-12-19 22:38 -0800
      Re: Process names Mickey MacMouse <mickey@mousehouse.com> - 2014-12-20 20:04 +1300
        Re: Process names Siri Crews <chine.bleu@yahoo.com> - 2014-12-19 23:32 -0800
          Re: Process names Mickey MacMouse <mickey@mousehouse.com> - 2014-12-23 13:10 +1300
            Re: Process names Siri Crews <chine.bleu@yahoo.com> - 2014-12-22 16:24 -0800
              Re: Process names Mickey MacMouse <mickey@mousehouse.com> - 2014-12-23 19:15 +1300
                Re: Process names Barry Margolin <barmar@alum.mit.edu> - 2014-12-23 11:16 -0500
                Re: Process names Mickey MacMouse <mickey@mousehouse.com> - 2014-12-24 16:34 +1300
                Re: Process names Jolly Roger <jollyroger@pobox.com> - 2014-12-24 14:49 +0000
                Re: Process names Mickey MacMouse <mickey@mousehouse.com> - 2014-12-25 19:31 +1300
  Re: Process names JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-12-20 03:17 -0500
    Re: Process names Mickey MacMouse <mickey@mousehouse.com> - 2014-12-21 09:48 +1300

csiph-web