Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 6 subscribers
  • Views 8266 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

InterCheck.app is asking me to accept incoming connections

marinnen128

I've been using Sophos Antivirus for Mac Home Edition for a long while, under various OS X versions. Currently running 9.0.11 on Mac OS X version 10.8.5 (Mountain Lion). Today, for the first that I can remember, I've got the popup:

Do you want the application "InterCheck.app" to accept incoming network connections?

I'm wondering if this is legitimate? My concern is if this might be some hack?

Any help is appreciated.

:1018319


This thread was automatically locked due to age.
Parents
  • 0
    marinnen128 wrote:

    Thanks for the suggestion. I ran the command and got the same valid response as you did.

    I wonder if anyone from Sophos would be able to confirm that InterCheck is legitimately suddenly asking to accept the incoming connections and what's their nature?

    You should be suspicious of this. InterCheck does not act as a network server, and you should not normally see prompts like this.

    Caveat: it may be possible (in ways we haven't yet discovered with the normal Apple firewall) to receive that pop-up based on the fact that InterCheck does listen for local communications. And only local, on the same computer, also called "loopback" - never for any external network connections. Several of our components using the loopback address (local network interface, 127.0.0.1) to communicate.

    Knowing that InterCheck is good on disk is a great start but doesn't necessarily guarantee that the copy in memory is good. I'd suggest restarting InterCheck or a reboot.

    :1018447

    ---

    Bob Cook (bob.cook@sophos.com) Director, Software Development

Reply
  • 0
    marinnen128 wrote:

    Thanks for the suggestion. I ran the command and got the same valid response as you did.

    I wonder if anyone from Sophos would be able to confirm that InterCheck is legitimately suddenly asking to accept the incoming connections and what's their nature?

    You should be suspicious of this. InterCheck does not act as a network server, and you should not normally see prompts like this.

    Caveat: it may be possible (in ways we haven't yet discovered with the normal Apple firewall) to receive that pop-up based on the fact that InterCheck does listen for local communications. And only local, on the same computer, also called "loopback" - never for any external network connections. Several of our components using the loopback address (local network interface, 127.0.0.1) to communicate.

    Knowing that InterCheck is good on disk is a great start but doesn't necessarily guarantee that the copy in memory is good. I'd suggest restarting InterCheck or a reboot.

    :1018447

    ---

    Bob Cook (bob.cook@sophos.com) Director, Software Development

Children
No Data
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?