2

I was recently using someone else's iMac and came across some rather strange behaviour. Searches (from google and yahoo at least, I didn't test other search engines) were being redirected. After searching, then clicking on a link in the search led to a new window being opened with some redirected link in it (the redirection went through a few variations before settling on the final link). Going back to the original window and clicking on the link a second time led to the correct site. This happened with both Safari and Firefox (I didn't test other browsers).

Searching on the internet suggested that this was a piece of malicious code, but I couldn't find it in the process lists. The key symptoms were:

  1. Turning off javascript removed the problem.
  2. Creating a whole new account removed the problem (for the new account).
  3. Booting in safe mode did not remove the problem.
  4. There was no obvious process that the original account (with the problem) was running that wasn't being run by the new account (without the problem).

So guessing that there was some malicious javascript somehow cached on the machine, I tried deleting everything that looked cache-like (in particular, in ~/Library/Cache - if I remember right). That seemed to fix it, but the owner told me that the next day it was back again. I couldn't find a "get rid of all temporary files, no I really mean all temporary files" command.

My real question is: can someone identify the problem and tell me what steps to tell the machine's owner to do to get rid of it?

(Note that I'm no longer in front of that machine, unfortunately, so further diagnostic tests will be tricky; add in to the mix the fact that the owner is not a computer ... nerd.)

Perhaps a more answerable question (if the above isn't answerable) is: what steps are needed to clean out temporary files from a user's area on an apple? I'd prefer concrete steps rather than "download (and pay for) iKillTempFiles".

Lastly, I don't know the versions of the software involved, but I suspect they were all fairly old.

Improve this question
1
  • Please retag appropriately - I don't know the local tags and nothing particular came up in the suggestions.
    – Andrew Stacey
    Jul 13, 2011 at 22:03

5 Answers 5

Reset to default
2

Sounds like a DNS changer of sorts. could maybe try running a scan with clamXav if your not too familiar with what files are legit and what ones are malicious.

where I found the dodgy DNSchanger file and instal.pkg ~/Library/Internet Plug-Ins /Library/Receipts

Only clearing the cached files wont get rid of malware. It might only do half the job.

Here are some links, feel free to use them.. or not. :)

http://www.howtogeek.com/howto/38793/how-to-switch-mac-os-x-to-use-opendns-or-google-dns/ - When trouble shooting the issue, I noticed that the auto DNS settings in sys prefs were different to what our routers DNS address was.

Open DNS address: 208.67.222.222 & 208.67.220.220 google DNS addres: 8.8.8.8 & 8.8.4.4

http://www.macupdate.com/app/mac/15850/clamxav/ - read up on some of the user feedback before you try.

  • bottom line is - be aware of what your are accepting and installing on your machine.
Improve this answer
1

One thing to try. Use the empty cache menu item, then quit and restart the browser.

Improve this answer
1
  • Do you mean "empty cache" from the browser menu? If so, I tried that and it didn't work. Moreover, that doesn't fit with the fact that it happens on two different browsers.
    – Andrew Stacey
    Jul 14, 2011 at 18:58
0

Some free web sites use Javascript redirecting to get you to read their ads. Without that, people just skipped the ads, meaning these sites produced no income!

Improve this answer
1
  • True, but I don't see the relevance for this case. The javascript was in place on the search webpage, not the final destination.
    – Andrew Stacey
    Jul 14, 2011 at 18:59
0

Did you ceck to see if the user is revisiting a site that is reinfecting the computer after you clear the cache? I suggest that as you said clearing the cache fixed it temporarily.

Improve this answer
0

Some things I would try to solve the problem:

  1. Clean temporary files with an app like CCleaner (free) or CleanMyMac.
  2. Run a Mac antivirus program. Lifehacker has a nice roundup of them here.
  3. If the previous steps fail, take the safe route, backup your data, format your drive, and reinstall OS X from scratch (Lion guide from Apple, Snow Leopard guide from Apple).

Some other notes:

  • I agree with the other answers, sounds like a DNS change. Try the DNS settings suggested by Miro.
  • Safari and Firefox use different cache files, so it is unlikely that it is the issue.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .