Compromised Mac's

[trward79]

I was wondering if anyone has ever seen this in their log files?

RemoteVNC[315]: Processing Remote Connection
RemoteVNC[315]: Connecting to server: 217.128.96.213
RemoteVNC[315]: Connection Accepted
RemoteVNC[315]: Desktop Sharing Started

Or does anyone know what this is?

 

[thejadedmonkey]

I was wondering if anyone has ever seen this in their log files?

RemoteVNC[315]: Processing Remote Connection
RemoteVNC[315]: Connecting to server: 217.128.96.213
RemoteVNC[315]: Connection Accepted
RemoteVNC[315]: Desktop Sharing Started

Or does anyone know what this is?

That almost looks like you're trying to connect to a remote server. Do you use VNC? Otherwise I'd check in settings, sharing, remote desktop, (options?) and see if you have vnc enabled.

 

[DeepIn2U]

That almost looks like you're trying to connect to a remote server. Do you use VNC? Otherwise I'd check in settings, sharing, remote desktop, (options?) and see if you have vnc enabled.

my thoughts exactly. Seems like users are connecting to said terminals; something a security implementation should limit by default (or have restrictions on) utilizing admin account - if its a business Mac. I'd try to change the Mac name first just before disabling it to see reactions.