<table cellspacing="0" cellpadding="0" border="0" ><tr><td valign="top" style="font: inherit;">It's a gremlin!. . . Or maybe H1N1, bird, swine, west nile flu. Seriously, it'd probably drive me nuts. <br><br>Alan, Is there an off chance a third party thing in your System Preferences panel is the culprit?<br>Does it appear in all the user accounts? Can you make a new user account, and see if it appears? <br><br>-A.<br><br>--- On <b>Mon, 11/30/09, Jon Thompson <i><jthompson-lists@dmevolve.com></i></b> wrote:<br><br>From: Jon Thompson <jthompson-lists@dmevolve.com><br>Subject: Re: [DM-MUG] Finder Issue (Trojan)<br>To: "Des Moines Mac Users Group" <dmmug@dmmug.org><br>Date: Monday, November 30, 2009, 12:09 PM<br><br><div id="yiv2143337905">My gut instinct is that it is NOT a virus, however, I wanted to eliminate that as a possibility, which Alan has done. This behavior is a normal behavior of Wide Area Bonjour, which is regulated by
your DNS server. I have intentionally configured DNS servers to do this exact thing. However, I have yet to figure out how exactly it is populating the dynamic bookmarks without your prior knowledge, which is what I believe it is doing.<div>
<br></div><div>-- <br>Jon Thompson<br>Evolve<br><a rel="nofollow" target="_blank" href="http://www.dmevolve.com">www.dmevolve.com</a><br>
<br><br><div class="gmail_quote">On Mon, Nov 30, 2009 at 10:34 AM, AB <span dir="ltr"><<a rel="nofollow" ymailto="mailto:anastasia_prittee@yahoo.com" target="_blank" href="/mc/compose?to=anastasia_prittee@yahoo.com">anastasia_prittee@yahoo.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
</blockquote><table border="0" cellpadding="0" cellspacing="0"><tbody><tr><td style="font-family: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; font-size: inherit; line-height: inherit; font-size-adjust: inherit; font-stretch: inherit; -x-system-font: none;" valign="top">My gut instinctively pegged it for a virus/trojan.... but I've never had one on a Mac. I'd still send a report to the URLs popping up, because it's bad for their reputation, assuming they are a legitimate business. If it's the same URL popping up in the Shared Devices list in the Sidebar, there's the FBI Internet Crimes website you can file a report at in full detail. I did that after I got phishing emails from banks I don't even bank at.<br>
<br>Can you use Time Machine to restore it to an earlier date?<br><br><br>--- On <b>Mon, 11/30/09, Alan Maupin <i><<a rel="nofollow" ymailto="mailto:alan.maupin@gmail.com" target="_blank" href="/mc/compose?to=alan.maupin@gmail.com">alan.maupin@gmail.com</a>></i></b> wrote:<br>
<br>From: Alan Maupin <<a rel="nofollow" ymailto="mailto:alan.maupin@gmail.com" target="_blank" href="/mc/compose?to=alan.maupin@gmail.com">alan.maupin@gmail.com</a>><br>Subject: Re: [DM-MUG] Finder Issue<br>To: "Des Moines Mac Users Group" <<a rel="nofollow" ymailto="mailto:dmmug@dmmug.org" target="_blank" href="/mc/compose?to=dmmug@dmmug.org">dmmug@dmmug.org</a>><br>
Date: Monday, November 30, 2009, 9:23 AM<br><br><div>Yes still there.<div><br><div><div>On Nov
30, 2009, at 10:13 AM, Jon Thompson wrote:</div><br>I wasn't concerned with the trojan being on your computer as so much as the trojan modifying your DNS settings, which are tied with the mDNS that you see in the Shared list.<br>
Am I correct in you saying that the items are still there?<br clear="all">
-- <br>Jon Thompson<br>Evolve<br><a rel="nofollow" target="_blank" href="http://www.dmevolve.com/">www.dmevolve.com</a><br>
<br><br><div class="gmail_quote">On Mon, Nov 30, 2009 at 10:02 AM, Alan Maupin <span dir="ltr"><<a rel="nofollow" target="_blank" href="http://mc/compose?to=alan.maupin@gmail.com">alan.maupin@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
</blockquote><div style="word-wrap: break-word;">Jon here is a newer article that mentions the trojan spoke of in the previous article you sent, with an updated look at Snow Leopards defense: <a rel="nofollow" target="_blank" href="http://blogs.zdnet.com/security/?p=4139">http://blogs.zdnet.com/security/?p=4139</a><div>
<br><div><div><div>On Nov 30, 2009, at 8:51 AM, Jon Thompson wrote:</div><br></div><div><div><blockquote type="cite">Alan,<div><br></div><div>Try running the commands in this article, as these types of things could appear if you are using a DNS server that is not one given to you by your ISP.<div>
<br><div><a rel="nofollow" target="_blank" href="http://www.macworld.com/article/60823/2007/10/trojanhorse.html">http://www.macworld.com/article/60823/2007/10/trojanhorse.html</a></div>
<div><br></div><div>I'm giving you this as a precaution, as well as to eliminate it as a possibility.<br clear="all">-- <br>Jon Thompson<br>Evolve<br><a rel="nofollow" target="_blank" href="http://www.dmevolve.com/">www.dmevolve.com</a><br>
<br><br><div class="gmail_quote">On Mon, Nov 30, 2009 at 2:13 AM, Alan Maupin <span dir="ltr"><<a rel="nofollow" target="_blank" href="http://mc/compose?to=alan.maupin@gmail.com">alan.maupin@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div style="word-wrap: break-word;">AB thank you very much for this information. You are quite the internet sleuth!<div><br></div><div><br><div><div><div><div>On Nov 29, 2009, at 7:21 PM, AB wrote:</div>
<br></div></div></div></div></div></blockquote></div></div></div></div></blockquote><div><div><div class="gmail_quote"><div style="word-wrap: break-word;"><div><div><div><div><table border="0" cellpadding="0" cellspacing="0"><tbody><tr><td style="font-family: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; font-size: inherit; line-height: inherit; font-size-adjust: inherit; font-stretch: inherit;" valign="top">
When typing in <a rel="nofollow" target="_blank" href="http://wildfire.gigya.com/">wildfire.gigya.com</a> I got a "directory not listed" message, see screenshot.<br>
I went to the <a rel="nofollow" target="_blank" href="http://gigya.com/">gigya.com</a> website. It is a social media and content management internet based company with offices in CA, NY, and Israel. <br><br>Perhaps they can investigate their own security on their servers since the discussion thread mentioned it was a leak in the respective company's network servers.<br>
<br>here's the contact info for them. <br><br>Whether you have a comment, a bug to report,<span style="font-weight: bold;"></span><br><span style="font-weight: bold;"></span>
or a press or business inquiry, please use the following contact information. <br>
We will get back to you as soon as possible.<br>
<br>
Liza Hausman, Gigya
<br>
650.353.4178 Office
<br>
<br>
Mark Naples, WIT
<br>
215.893.0581 Direct<br>
646.265.7372 Cell
<h5>Customer Support and Product Feedback Inquiries:<a rel="nofollow" target="_blank" href="http://mc/compose?to=support@gigya-inc.com"> support@gigya-inc.com</a></h5>
<h5>Sales related inquiries:<a rel="nofollow" target="_blank" href="http://mc/compose?to=sales@gigya-inc.com"> sales@gigya-inc.com</a></h5>
<h5>Partner and Business Development Inquiries:<a rel="nofollow" target="_blank" href="http://mc/compose?to=bizdev@gigya-inc.com"> bizdev@gigya-inc.com</a></h5>Questions Relating to Terms of Use and/or our Privacy Policy:
<a rel="nofollow" target="_blank" href="http://mc/compose?to=privacy@gigya-inc.com">privacy@gigya-inc.com</a>
<h3>Our offices</h3>
<h5>Palo Alto Office (Corporate Headquarters)</h5>
855 El Camino Real<br>
Building 4, Suite 290<br>
Palo Alto, CA 94301<br>
650.353.7230
<h5>New York Office. </h5>
817 Broadway, 10th Floor<br>
New York, NY 10003-4709<br>
646.722.8137<br>
<h5>Tel Aviv Office </h5>
132 Begin road<br>
Azrieli round tower (13 floor)<br>
Tel Aviv, Israel 67021<br>
+972.73.7852400<br><br>--- On <b>Sun, 11/29/09, Victoria L. Herring <i><<a rel="nofollow" target="_blank" href="http://mc/compose?to=vlh@herringlaw.com">vlh@herringlaw.com</a>></i></b> wrote:<br>
<br>From: Victoria L. Herring <<a rel="nofollow" target="_blank" href="http://mc/compose?to=vlh@herringlaw.com">vlh@herringlaw.com</a>><br>Subject: Re: [DM-MUG] Finder Issue<br>To: "Des Moines Mac Users Group" <<a rel="nofollow" target="_blank" href="http://mc/compose?to=dmmug@dmmug.org">dmmug@dmmug.org</a>><br>
Cc: <a rel="nofollow" target="_blank" href="http://mc/compose?to=alan.maupin@gmail.com">alan.maupin@gmail.com</a><br>Date: Sunday, November 29, 2009, 5:57 PM<br><br><div>you can go to <a rel="nofollow" target="_blank" href="http://Apple.com/">Apple.com</a> and set up a phone support call and explain the whole problem in the message so the person you speak to has an idea of the reason for the support call. Seems easier than going out to the Apple Store - maybe a first step.
<br>I certainly don't know but if you are having things show up in the finder window you might go to the Prefs for Finder and check on what is listed as contents on sidebar =- I don't know what Neighborhood would be other than perhaps you have Bluetooth or Bonjour enabled??? And they/it are picking up signals??<br>
<br><div class="gmail_quote">On Thu, Nov 26, 2009 at 3:33 PM, Alan Maupin <span dir="ltr"><<a rel="nofollow">alan.maupin@gmail.com</a>></span> wrote:<br>
The problem is located in Finder application, on the Shared menu, under the submenu All: random named URL's are showing up and are listed as Neighborhood.<br>
<br>
The most recent URL to show up is "<a rel="nofollow" target="_blank" href="http://wildfire.gigya.com/">wildfire.gigya.com</a>"<br>
<br>
It does not go away with a reboot.<br>
<br>
Does anyone know what causes this issue? Is it a security issue?<br>
<br>
<br>
Thanks in advance,<br>
Alan<br></div>
</div></td></tr></tbody></table></div></div></div></div></div></div></div></div><div><div><div class="gmail_quote"><div style="word-wrap: break-word;"><div><div><div><div><br>
</div></div><span><Screen shot 2009-11-29 at 6.11.32 PM.png></span>_______________________________________________<br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></td></tr></tbody></table></div></div>
</div></td></tr></table><br>