Telnet Randomly turns on

Discussion in 'macOS' started by Me1000, Jan 27, 2007.

  1. Me1000 macrumors 68000

    Me1000

    Joined:
    Jul 15, 2006
    #1
    Like the title says, then it takes up about 95% of one core of my processor!

    Anyone know why? its about the 5th time its done it...
     

    Attached Files:

  2. setatakahashi macrumors newbie

    Joined:
    Dec 28, 2003
    #2
    Go to a terminal window and run ps -ef | grep telnet and paste here the results.
     
  3. Me1000 thread starter macrumors 68000

    Me1000

    Joined:
    Jul 15, 2006
    #3
    This is what i got...
     
  4. setatakahashi macrumors newbie

    Joined:
    Dec 28, 2003
    #4
    Hmm, try ps aux | grep telnet
     
  5. Me1000 thread starter macrumors 68000

    Me1000

    Joined:
    Jul 15, 2006
    #5
    I didnt get anything back...

     
  6. MacsRgr8 macrumors 604

    MacsRgr8

    Joined:
    Sep 8, 2002
    Location:
    The Netherlands
    #6
    Telnet (incoming) is off by default on Mac OS X, are your sure you haven't turned it on?
    Here's Apple's documentation about enabling Telnet access.

    But using Telnet as a "client" is on. Sometimes you can use Telnet to configure your DSL modem, or network printers etc.
    Maybe some software you have installed uses Telnet to connect to some network device...?
     
  7. Queso macrumors G4

    Joined:
    Mar 4, 2006
    #7
    Strange. If it were a backdoor on your Mac, the process would show as telnetd (the telnet server) rather than telnet. It worries me that this may be a process calling itself telnet, but not actually be the OSX telnet client. The built-in one should never get up to those CPU cycle levels.
     
  8. Me1000 thread starter macrumors 68000

    Me1000

    Joined:
    Jul 15, 2006
    #8
    Well im almost positive ive never turned it on, especially if you have go through all that!


    if it happens again, is there anyway to get some more info on what is running?
     
  9. setatakahashi macrumors newbie

    Joined:
    Dec 28, 2003
    #9
    The next time that you experience this problem, open a terminal window and type ps auxl

    Then you'll see in the first column the user running the process (USER), the Process ID (PID), Parent Process ID(PPID) and command used to start it (COMMAND).

    USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME UID PPID CPU PRI NI WCHAN COMMAND

    Pick the PPID from the telnet process. This number will tell you which process started telnet. Type ps aux | grep <PPID of telnet> .

    Tell us what process was starting telnet, ok? :)
     
  10. Me1000 thread starter macrumors 68000

    Me1000

    Joined:
    Jul 15, 2006
    #10
    ok, its a rare problem, but it has happened several times.

    I normally just quit it from activity monitor...
    But I dont like it when others are worried! :eek:
     
  11. mkrishnan Moderator emeritus

    mkrishnan

    Joined:
    Jan 9, 2004
    Location:
    Grand Rapids, MI, USA
    #11
    Mmm, it *is* strange. What do you have running on this Mac? The telnet process looks like it's owned by *YOU* in the first picture.... not that it couldn't be someone hacking you, but that seems unlikely. More likely is that you have some program or something that is launching a script periodically, and the telnet task is being invoked for some weird reason to act the script out.
     
  12. Tinhead macrumors member

    Joined:
    Oct 25, 2004
    #12
    Mail Widget?

    I had a similar problem a while back. It turned out to be a mail widget that I used (and still use) that, for some reason, launched telnet. Usually it was terminated, but sometimes it remained. See if tapping F12 creates instances of telnet, that's how I realized it was connected with dashboard somehow.
     
  13. MacsRgr8 macrumors 604

    MacsRgr8

    Joined:
    Sep 8, 2002
    Location:
    The Netherlands
    #13
    Tinhead's is the most plausable.

    A widget could easily generate Telnet traffic, and for the user still be "invisible"

    Please check this possibility out, Me1000! :)
     
  14. Me1000 thread starter macrumors 68000

    Me1000

    Joined:
    Jul 15, 2006
    #14
    It could be that, but i goto my dashboard a lot, and this doesnt happen that often!

    I just went to dashboard, but it didnt come on in activity monitor; but I didnt have nay mail either.

    I do have a mail widget though!
     
  15. Tinhead macrumors member

    Joined:
    Oct 25, 2004
    #15
    Try tapping F12 repeatedly and rapidly, see if that makes telnet appear. It does not matter whether or not you have new mail in your inbox.
     
  16. Me1000 thread starter macrumors 68000

    Me1000

    Joined:
    Jul 15, 2006
    #16
    I tried it for about a minute, and nothing happened! I was looking at activity monitor the whole time too
     
  17. Me1000 thread starter macrumors 68000

    Me1000

    Joined:
    Jul 15, 2006
    #17
    OK it turned on again, I just restarted my macbook
    Updated iTunes (7.1.1 I think)

    Ran the
    ps auxl telnet

    but I dont understand any of it








    This time it's a little different in activity monitor it is running twice!
     
  18. Me1000 thread starter macrumors 68000

    Me1000

    Joined:
    Jul 15, 2006
    #18
    When I double click on the telnet app in the activity monitor the first line on "open files and ports" is
    /Users/randy/Library/Widgets/MailWidget.wdgt

    I removed the widget from dashboard, and restarted the dashboard with this widget

    http://www.apple.com/downloads/dashboard/developer/quitdock.html

    but it is still running both cores at 100%
     
  19. setatakahashi macrumors newbie

    Joined:
    Dec 28, 2003
    #19
    The PID 501 started the telnet (the PPID of telnet is 501) and telnet is consuming near 100% of your CPU time. But the listing doesn't have any PID with this number (501) :( .
     
  20. dr_lha macrumors 68000

    Joined:
    Oct 8, 2003
    #20
    501 is the UID of "randy", not the PID. 501 is the standard UID of the main user on Mac OS X. What is happening here is that the MailWidget uses telnet to communicate with POP and IMAP servers to enquire about email. This is mainly due to the fact that the program is poorly written.

    However, the important thing is it's nothing nefarious. I.e. its not a hack/exploit or virus.
     
  21. setatakahashi macrumors newbie

    Joined:
    Dec 28, 2003
    #21
    You're right. PPID is 1.
     

Share This Page