I did a "ps -alx" and found the following process. I've seen this guy before. UID = 4294967294 PID = 190 PPID = 2 CPU = 0 PRI = 31 NI = 0 VSZ = 27996 RSS = 780 WCHAN = - STAT = Ss TT = ?? TIME = 0:04.88 COMMAND = /usr/sbin/mDNSResponder According to Apple developer docs, this "Multicast DNS Responder" is there for Rendezvous and "is built into Mac OS X 10.3.x. mDNSResponder listens for and responds to DNS-formatted query packets sent via IP Multicast to UDP port 5353". So it looks legitimate, but why such a strange user ID? The system is usually UID=0.