Why is prl_naptd in Parallels talking with Russian Advertising Company

C

CarlC1

Bit poster
I have Parallels Desktop 15 for Mac Pro-Edition Version 15.1.3 (47255) and am also running Little Snitch software.

Doing a regular check of little snitch results, process /Applications/Parallels Desktop.app/Contents/MacOS/prl_naptd is talking to adriver.ru (a Russian advertising company).
Hostname: ssp.adriver.ru
IP Address: 81.222.128.213
TCP Port: https (443)
Protocol: TCP
Connected: no
Connects: 2 allowed, 0 denied
First Activity: 3h 30m ago
Last Activity: 3h 30m ago

Why is my Parallels Software talking to a Russian advertising company?
 
sometimes, this is an indication that your system is infected with a malware (trojan/spyware etc.). It talks over https, but that can be for any reason. Your browser could have contacted this website while you were surfing as part of a cross side scripting attack, or it loaded something in the background. If this site gets contacted more often, it might be an issue. This (part of the) logfiles states that it was contacted only once, a few days ago. This would make me say: it was a one-time connection. Keep an eye on it.
 
From what I can tell /Applications/Parallels Desktop.app/Contents/MacOS/prl_naptd is some kind of gateway file for parallels.... when a browser inside parallels accesses an external site it's logged as being accessed by prl_naptd.... I am guessing the ssp.adriver.ru is showing up when the internal browser is viewing something like yahoo.com that links to all sorts of advertising sites.
 
OK, but I have "shared network (recommended)" set and prl_naptd is not only still in use, but is using the 69.1% of my CPU, even though I don't even have a browser open in the VM. (Though I do have a mail client (Outlook) on.)
That can't be right! Anyone from Parallels monitoring these chats?
Please let us know if this really is malware, or we can afford to kill process hogs like this. I've never noticed it taking this much CPU capacity--what's normal and how to fix? Thanks
 
You must log in or register to reply here.
Back
Top