Greetings
While diagnozing network issues I found that my Mac is generating enormous traffic to the internet. 'Activity monitor' showed nothing on tx/rx usage.
I used wireshark to find out and 100-200 packets/sec were sent being consantly sent to server hosted on amazon.
My first tought : I got hacked.
So I blocked all IPs in this block on the router and started searching.
The only thing I did with my mac recently was Flash update to 17 and latest OSX 10.10.3 + server.
I verified that flash was dled from correct URL that is dmdownload.adobe.com.
I used backdoor.flashback removal tools and even got norton on mac .... to check things out. Norton found nothing and installed all 'updated'.
I narrowed it down to /usr/libexec/nsurlsessiond as location of PID that is generating this requests to amazon which then upload 'some' data from Mac.
I have read that this might be icloud drive process and I had it enabled so I did switch it off. Nothing.
Process is started immedietly after launching safari.
Anyone has got a clue about this ? Norton does not detect it at all, probably as it disguises itself under safari.
PS. As for now I'm safe as I blocked all traffic to/from that destination.
Thank you