Author Topic: Scan Volume Net?  (Read 10010 times)

0 Members and 1 Guest are viewing this topic.

macmomma08

  • Guest
Scan Volume Net?
« on: September 02, 2009, 12:28:10 PM »
Hey,

I went to do a virusscan last night, and in addition to the Mac HD there was a little drive that showed up in the list that was colored blue with three little white figures holding hands called 'net' that was also in the scan list.

I'd never seen this before so I restarted the computer and it didn't show up after the reboot, but I wanted to know what it was. A unsecured network somewhere?

Thanks

Offline zilog

  • Avast team
  • Advanced Poster
  • *
  • Posts: 957
  • or #f0; daa; add a,#a0; adc a,#40
Re: Scan Volume Net?
« Reply #1 on: September 02, 2009, 02:49:49 PM »
Hey,

I went to do a virusscan last night, and in addition to the Mac HD there was a little drive that showed up in the list that was colored blue with three little white figures holding hands called 'net' that was also in the scan list.

I'd never seen this before so I restarted the computer and it didn't show up after the reboot, but I wanted to know what it was. A unsecured network somewhere?

Thanks

Hallo,
the menu just shows the mounted volumes (same info could be retrieved using mount, or by lookng into standard mountpoint - /Volumes directory).
Just type it from terminal, when this one appears again, to be able to get better info, than an icon..
regards,
pc
May's Law: Software efficiency halves every 18 months, compensating Moore's Law. (David May, INMOS)

macmomma08

  • Guest
Re: Scan Volume Net?
« Reply #2 on: September 02, 2009, 03:41:21 PM »
I'm not at home right now so I can't try that yet, but this morning when I got on my computer it was showing up again. I checked my Mac HD for any devices, because I know sometimes I get this weird blue one that Mac Support said was some kind of unsecured network, and I thought that must be causing it, but it wasn't there.

Also, I didn't have anything else mounted to my computer (no cds, or external hard drives, I haven't even downloaded like any of those .dmg that you use to install stuff apart from the Little Snitch one lately).

Also, Little Snitch didn't ask me about any incoming/outgoing connections...I tried to google the symbol, and it turns out it is a shared symbol. But my concern is, why is it there at all? Why can't I see it in my devices folder?

I didn't go to any crazy websites or anything, just my regular ones. I don't understand why this is popping up in Avast!.

Also, as far as I know I am not connected to a network, I certainly didn't set any up. I mean, I'm hooked up to wireless internet, but I don't think that would cause a symbol that looks like people networking, would it?

This is making me worried >.<;

macmomma08

  • Guest
Re: Scan Volume Net?
« Reply #3 on: September 03, 2009, 12:08:50 AM »
I tried to do the mount thing you suggested, but it just kept saying 'volume is in the directory'. Dunno what that means.

Anywho, I went to about this mac and went to more info and I saw there are two volumes under networking, home and net. I called Mac Support and they said these are normal and I should only be concerned if I see more there that I didn't put there.

He also went over shared checklist with me to make sure that all my shared stuff was turned off, and it was, so he was thinking maybe someone tried to connect to my network, and I could see them, but they couldn't connect because of my password.

Also, they recommended I switch from WEP to WPA2 for more protection so I did that too, just in case. I'm hoping it doesn't pop up again (it's gone right now), but since now I know how to see my volumes I will be able to tell if it's something different or not.

The mac dude said he was pretty sure that there was nothing to worry about though. :)

Edit: It popped up again, so this time I tried to scan it and got error 60. I told it to reveal in finder, and it said it was at /net and had two files server: file://localhost/net/localhost & file://localhost/net/broadcast host

And then when I looked in my finder, there was that stupid little unsecuried network called your-viu5vcdub5 (the one I had called mac about before). So I think this is definitely just someone with unsecured internet that my mac sees but doesn't interact with. There were no other volumes listed up in my volumes under network.
« Last Edit: September 03, 2009, 01:17:11 AM by macmomma08 »

Offline .: Mac :.

  • Avast Überevangelist
  • Ultra Poster
  • *****
  • Posts: 5093
Re: Scan Volume Net?
« Reply #4 on: September 03, 2009, 02:01:50 AM »
Can you take a screenshot of this icon? (Command+Shift+3 will take a screenshot then upload it somewhere like photobucket). Id like to see exactly what you are seeing.
"People who are really serious about software should make their own hardware." - Alan Kay

Offline zilog

  • Avast team
  • Advanced Poster
  • *
  • Posts: 957
  • or #f0; daa; add a,#a0; adc a,#40
Re: Scan Volume Net?
« Reply #5 on: September 03, 2009, 08:16:50 AM »
I tried to do the mount thing you suggested, but it just kept saying 'volume is in the directory'. Dunno what that means.

Anywho, I went to about this mac and went to more info and I saw there are two volumes under networking, home and net. I called Mac Support and they said these are normal and I should only be concerned if I see more there that I didn't put there.

He also went over shared checklist with me to make sure that all my shared stuff was turned off, and it was, so he was thinking maybe someone tried to connect to my network, and I could see them, but they couldn't connect because of my password.

Also, they recommended I switch from WEP to WPA2 for more protection so I did that too, just in case. I'm hoping it doesn't pop up again (it's gone right now), but since now I know how to see my volumes I will be able to tell if it's something different or not.

The mac dude said he was pretty sure that there was nothing to worry about though. :)

Edit: It popped up again, so this time I tried to scan it and got error 60. I told it to reveal in finder, and it said it was at /net and had two files server: file://localhost/net/localhost & file://localhost/net/broadcast host

And then when I looked in my finder, there was that stupid little unsecuried network called your-viu5vcdub5 (the one I had called mac about before). So I think this is definitely just someone with unsecured internet that my mac sees but doesn't interact with. There were no other volumes listed up in my volumes under network.
Hallo,
err 60 == timeout. the network volume was mounted, but the connectivity was broken meanwhile.
Please, go to utilities, open Terminal, and type "mount". Then, copy-paste it here.

Also, you can take screenshot (apple+shift+4, then drag an area using LMB).

regards,
pc
May's Law: Software efficiency halves every 18 months, compensating Moore's Law. (David May, INMOS)

macmomma08

  • Guest
Re: Scan Volume Net?
« Reply #6 on: September 05, 2009, 02:12:42 PM »
It finally showed up again, so I typed mount into terminal like you said, but nothing changed:

When it's not there:
dev/dev/disk0s2 on / (hfs, local, journaled)
devfs on /dev (devfs, local)
fdesc on /dev (fdesc, union)
map -hosts on /net (autofs, automounted)
map auto_home on /home (autofs, automounted)

When it's there:
/dev/disk0s2 on / (hfs, local, journaled)
devfs on /dev (devfs, local)
fdesc on /dev (fdesc, union)
map -hosts on /net (autofs, automounted)
map auto_home on /home (autofs, automounted)

Added a screenshot too. Maybe it's just that normal /net folder that was already on my list.

Offline zilog

  • Avast team
  • Advanced Poster
  • *
  • Posts: 957
  • or #f0; daa; add a,#a0; adc a,#40
Re: Scan Volume Net?
« Reply #7 on: September 07, 2009, 11:49:38 AM »
It finally showed up again, so I typed mount into terminal like you said, but nothing changed:

When it's not there:
dev/dev/disk0s2 on / (hfs, local, journaled)
devfs on /dev (devfs, local)
fdesc on /dev (fdesc, union)
map -hosts on /net (autofs, automounted)
map auto_home on /home (autofs, automounted)

When it's there:
/dev/disk0s2 on / (hfs, local, journaled)
devfs on /dev (devfs, local)
fdesc on /dev (fdesc, union)
map -hosts on /net (autofs, automounted)
map auto_home on /home (autofs, automounted)

Added a screenshot too. Maybe it's just that normal /net folder that was already on my list.


Ah,
it's more clear now - it's the net automounter/autofs thing, configured on your machine to sniff for available network volumes exports. Automounter is capable to create a pseudo-directory mapping (that /net), where one can mount network volumes simply by doing "cd some_well_known_ip/export" there. With the default "nobrowse" option, nothing should happen, until you really mount some network volume - but since that, it will appear automatically, when available.

As usually, this is quite underdocumented (see manpages for mount, automount), but this white-paper might be interesting:
http://images.apple.com/business/docs/Autofs.pdf - see the "Hosts Automounts" section.

summary: too much crappy-technology :).
PC
May's Law: Software efficiency halves every 18 months, compensating Moore's Law. (David May, INMOS)

macmomma08

  • Guest
Re: Scan Volume Net?
« Reply #8 on: September 07, 2009, 04:20:52 PM »
Oh okay cool :)

Thanks guys, I was really wondering what that thing was. Especially since it kept going away and coming back lol.