I was recently using someone else's iMac and came across some rather strange behaviour. Searches (from google and yahoo at least, I didn't test other search engines) were being redirected. After searching, then clicking on a link in the search led to a new window being opened with some redirected link in it (the redirection went through a few variations before settling on the final link). Going back to the original window and clicking on the link a second time led to the correct site. This happened with both Safari and Firefox (I didn't test other browsers).
Searching on the internet suggested that this was a piece of malicious code, but I couldn't find it in the process lists. The key symptoms were:
- Creating a whole new account removed the problem (for the new account).
- Booting in safe mode did not remove the problem.
- There was no obvious process that the original account (with the problem) was running that wasn't being run by the new account (without the problem).
~/Library/Cache - if I remember right). That seemed to fix it, but the owner told me that the next day it was back again. I couldn't find a "get rid of all temporary files, no I really mean all temporary files" command.
My real question is: can someone identify the problem and tell me what steps to tell the machine's owner to do to get rid of it?
(Note that I'm no longer in front of that machine, unfortunately, so further diagnostic tests will be tricky; add in to the mix the fact that the owner is not a computer ... nerd.)
Perhaps a more answerable question (if the above isn't answerable) is: what steps are needed to clean out temporary files from a user's area on an apple? I'd prefer concrete steps rather than "download (and pay for) iKillTempFiles".
Lastly, I don't know the versions of the software involved, but I suspect they were all fairly old.