Re: Possible security problem?

In article <BF0E2409.12C46%veronique_souchon@hotmail.com>,
 Veronique Souchon <veronique_souchon@hotmail.com> wrote:

> On 28/7/05 4:15 AM, in article
> tomstiller-03EA0F.14154127072005@comcast.dca.giganews.com, "Tom Stiller"
> <tomstiller@comcast.net> wrote:
>
>
> >>>
> >>> Nnbd is part of the samba PC file sharing suite. If you don't need
> >>> samba, turn off "Windows Sharing" in the Sharing System Preferences
> >>> pane. If you need samba, but want to restrict its activities, read up
> >>> on the configuration options in the man page for smb.conf.
> >>>
> >>
> >> Hi Tom
> >>
> >> That is why I mentioned that Samba is not a part of the equation.
> >>
> >> Even so, if it was enabled why would nmbd be sending packets all over
> >> the world? That is what has me intrigued.
> >
> > Sorry, I slipped right by the comment on samba. One question is: why is
> > nmbd running at all? It isn't running on my machine.
>
> This is what is so intriguing Tom. I am not at all expert but I am trying to
> learn. I have purchased several books on OSX and Unix and am struggling a
> bit, but getting more experienced. I have booted the system in verbose mode,
> looked at the the start-up sequence and don't see nmbd starting, but a few
> minutes later it is running. I look at it in the activity monitor and it
> says that the parent process is msinit but I can't FIND msinit. It isn't
> running. It is as though I have a hidden program that is mimicking another
> application or somehow fooling the OS, or at least fooling the Activity
> Monitor. The only google references to msinit are to windows exe files and
> they certainly wouldn't be running on a Mac. VPC wasn't running so they
> wouldn't be running there either.

The Console application is an excellent tool for selecting and examining
log files. You might see if there are any entries in the samba log or
if you can find he launch of nmbd in one of the system logs. Other than
that I have no idea where to look.

I do know that my router is bombarded with connection attempts to ports
1026 and 1027 (I think those are associated with Windows networking)
which I attribute to zombies looking for a host to infect.

-- 
Tom Stiller
PGP fingerprint =  5108 DDB2 9761 EDE5 E7E3 
                   7BDA 71ED 6496 99C0 C7CF