3

I use Little Snitch (https://www.obdev.at/products/littlesnitch/index.html) to monitor background network traffic. When an application tries to connect to the internet for the first time, Little Snitch pops up a dialog box that asks me whether I want to allow the connection. Most of the time it's pretty obvious what the process is, and I either Allow or Deny network access. But I'm stumped by this process:

Little Snitch blocking a connection by the AppArt process to application-stats.com

What is AppArt? What is application-stats.com? And why does the former want to connect to the latter?

3

Following @tubedogg's comment above, I think I've fixed this:

  • http://www.malwareurl.com/listing.php?domain=application-stats.com identifies the domain as Malware
  • Double-clicking the "AppStats" process in Activity Monitor and then clicking the "Open Files and Ports" tab reveals that something is running from /Users/jim/Library/Application Support/Spigot/AppStats
  • Searching "Spigot" then takes us here, which gives removal instructions: http://www.thesafemac.com/arg-spigot/
  • I didn't find any weird browser extensions in Firefox, Safari, or Chrome (the directory in Application Support included a file with a name that referenced a .xpi file, so I'm guessing the problem may have been something to do with an old Firefox extension) but I did remove the following directories and files: ~/Library/LaunchAgents/com.applicationstats.AppStats.plist, ~/Library/LaunchAgents/com.appart.AppArt.plist, ~/Library/Application Support/Spigot/
  • I found this on my computer as well. Also I've seen other people posted question about this file on Apple Support site. I'm wondering if there's anyway to report this malware to antivirus professionals. – Lucius Hu Mar 4 '17 at 7:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .