Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I think my MacBook Pro might be hacked. The reason I found out about the stackoverflow.com website is because I did a netstat search in Terminal. My browser was closed but nevertheless it showed this:

tcp4       0      0  macintosh.lan.50419    stackoverflow.co.http  LAST_ACK

among other things. I have never visited this website in my life.

Also netstat results show things that I think might be not right. Also I have been trying to figure this out for the past hours and recently (maybe 20 minutes ago) my screen went black for like a second or two and this never happens.

Anybody know whats wrong?

share|improve this question

migrated from stackoverflow.com Feb 5 '11 at 16:54

This question came from our site for professional and enthusiast programmers.

    
Have you tried Anti-Virus software (yes, there's software like that for Mac, too)? –  andre_roesti Feb 5 '11 at 16:53
    
thank you for your answer but the strange thing i have never visited this website in my life I am certain of that and it didnt show up on an earlier netstat search –  user66222 Feb 5 '11 at 17:00
    
@Worried - your question was posted on Stack Overflow, here, and was migrated here because it was off-topic on SO. You might not have visited this site before, but you've visited a site in the network before. –  DMA57361 Feb 5 '11 at 17:01
1  
it doesn´t matter if it is truncated it now shows the same results in netstat with the .co –  user66222 Feb 5 '11 at 17:16
1  
@oKtosiTe, the truncated "fixed column width" is far more obvious when not seeing just a single line of the output. –  Arjan Feb 5 '11 at 18:01

3 Answers 3

LAST_ACK simply means that a connection to the specified server was recently closed. It's perfectly normal that it might remain for a few minutes after closing your browser.

share|improve this answer
1  
Doesn't "The reason i found this website is because..." sounds like he had never heard about this website before? –  WarrenFaith Feb 5 '11 at 16:56
    
@oKtosiTe: Except that the output of netstat could be truncated. "stackoverflow.co" isn't a valid domain name. –  Cody Gray Feb 5 '11 at 17:16
1  
@Cody: It is, actually. .co is the top level domain for Colombia. –  oKtosiTe Feb 5 '11 at 17:20
    
@oKtosiTe: Oh, maybe it is. It looks like they're selling .co domains globally now. Who knew. Either way, it's unlikely the netstat output indicates anything other than stackoverflow.com. It looks like stackoverflow.co is just a squatter hoping Stack Overflow Internet Services will buy it from him. –  Cody Gray Feb 5 '11 at 17:24
    
Indeed it does. @CodyGray –  oKtosiTe Feb 5 '11 at 17:27

The output of netstat shows you reversed DNS addresses: a name based on an IP address. However, multiple names might exist for the same IP address.

Like both superuser.com, gaming.stackexchange.com and stackoverflow.com refer to the same IP address: 64.34.119.12. But:

dig -x 64.34.119.12

...shows that this primarily maps to stackoverflow.com, even though

dig superuser.com

...shows the very same IP address.

So you probably visited one of the Stack Exchange sites?

Running netstat -n will show you IP addresses rather than (assumed) host names.

It might even be on the same server but that is not relevant here.

share|improve this answer

How about link pre-fetching as an explanation?

share|improve this answer
    
Good thinking! (Though I'm not sure if that only applies to getting DNS records, or also really fetches content. The first won't show in the output of netstat, I think. The latter would indeed.) –  Arjan Feb 5 '11 at 18:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.