3

I use Little Snitch (https://www.obdev.at/products/littlesnitch/index.html) to monitor background network traffic. When an application tries to connect to the internet for the first time, Little Snitch pops up a dialog box that asks me whether I want to allow the connection. Most of the time it's pretty obvious what the process is, and I either Allow or Deny network access. But I'm stumped by this process:

Little Snitch blocking a connection by the AppArt process to application-stats.com

What is AppArt? What is application-stats.com? And why does the former want to connect to the latter?

2
  • 1
    Probably malware. malwareurl.com/listing.php?domain=application-stats.com
    – tubedogg
    Commented Oct 17, 2016 at 17:31
  • Thank you! I think I've managed to fix it, traced the process through Activity Manager -- not sure why I didn't think of doing that before. Will write up what I did as an answer below.
    – Jim
    Commented Oct 19, 2016 at 11:42

1 Answer 1

3

Following @tubedogg's comment above, I think I've fixed this:

  • http://www.malwareurl.com/listing.php?domain=application-stats.com identifies the domain as Malware
  • Double-clicking the "AppStats" process in Activity Monitor and then clicking the "Open Files and Ports" tab reveals that something is running from /Users/jim/Library/Application Support/Spigot/AppStats
  • Searching "Spigot" then takes us here, which gives removal instructions: http://www.thesafemac.com/arg-spigot/
  • I didn't find any weird browser extensions in Firefox, Safari, or Chrome (the directory in Application Support included a file with a name that referenced a .xpi file, so I'm guessing the problem may have been something to do with an old Firefox extension) but I did remove the following directories and files: ~/Library/LaunchAgents/com.applicationstats.AppStats.plist, ~/Library/LaunchAgents/com.appart.AppArt.plist, ~/Library/Application Support/Spigot/
1
  • I found this on my computer as well. Also I've seen other people posted question about this file on Apple Support site. I'm wondering if there's anyway to report this malware to antivirus professionals.
    – Lucius Hu
    Commented Mar 4, 2017 at 7:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .