# Jump/redirect virus on Mac



## Spacebox

Hi everyone, I have this annoying virus on my mac which redirects my results on Google to another site. I'm running on OSX using Firefox. 
What is this? Any easy fixes? Thanks in advance!


----------



## sinclair_tm

Well, I can tell you it's not a virus, but instead it's a browser hijack. The first thing is to open Safari, and see if it does the same thing. If it does, then it's in the system cache, if not, then it's only in FireFox. If it does happen in Safari, then goto the Safari menu and select "Reset Safari..." and in the resulting box, make sure everything has a check mark, and then click on reset. That should fix it. If it's only FireFox, then you need to find where within FireFox there is a option to empty the cache, cookies, and any other stored data, and do it.


----------



## macthorough

...in firefox 3 clearing the cache is under the Tools >clear private data. 

Next I would see if the issue occurs in multiple users, so I would create a test account and see if I can reproduce the issue.


----------



## Spacebox

Thanks for the posts.
Safari has no problems but I have reset it anyway and cleared all private data on Firefox. The only thing unchecked on both were passwords, could that be the problem?
Firefox is still the same with no change on the redirect.
I'll try the test account tomorrow....


----------



## macthorough

I would clear "ALL" private data including passwords.

If the test account works normally then I would do the following...

Go to the following folders and blow away any files that say Mozilla or Firefox. 

\user\library\preferences\

in the preferences folders and files you see files named ...plist

\user\library\caches\

If the test account does have the problem reinstall Firefox.


----------



## macthorough

oh yeah troubleshoot you firfox add-ons

...disable or remove any add-on/plug-ins one at a time to see if any are causing the issue.


----------



## Spacebox

I have cleared all private data including passwords. No change.
Tried reinstalling Firefox, no change there either!!!
I feel like ditching Firefox altogether.

Disaster, last night after a restart, the computer has reverted to basic settings..!! The dock is empty of my programs, all custom settings have gone and most upsetting of all my mail has vanished. When restarting the program it prompts new set up! All my files appear to be intact though, I'm hoping that I can save my mail files?
If I had a PC I'd be convinced that I have a virus. 
Any ideas guys??:sigh:


----------



## macthorough

What did you do before you restarted? Did you change or reinstall anything? If you put something in the trash do not empty the trash you might need it back.

I doubt you have a virus, but if you think you do download a virus program trail and do a scan.


----------



## sinclair_tm

Did you create a new user account, as that is what it sounds like is going on. Open your hard drive, then the folder users. There you will find a folder for all users on the computer and a shared folder. The folders are named after the user short name. The current user is the folder that looks like a house. If the house isn't your account, then your stuff is fine, and you just need to log into your account.


----------



## macthorough

We need to back track here a little... i hope you did not rename your home folder aka the folder with the house on it... what did you do before you restarted?


----------



## Spacebox

All I have done was to dump files in caches and preferences as recommended. I also trashed Firefox out of utilities and downloaded a fresh version. All my bookmarks had turned up though? Still the redirect problem.
Before restarting, I noticed mail behaving weirdly. That was the reason for the restart. Prior to that there was no change to anything I can think of. 
The first thing that came to mind was the users account. Its under my name so no relief from that!.
However I have come across my mail files:smile: The thing is the new mail program does not want to import them. I go to file, import mailboxes, mail for mac osx, and chose my original pop mail files which are emlx files. All that happens is that no mac osx files found.:sigh: Anything else I can do?

How do I do a virus/system check on a mac?

Thanks for your help again.


----------



## macthorough

1 did you dump the whole preferences folder or just the Mozilla or Firefox files in the preferences folder?

2 did you dump the whole caches folder or just the Mozilla or Firefox files in the caches folder?

3 why is Friefox installed in your Utilities folder? Applications may not work properly if they are not installed in the Applications folder.

4 Let's, look at mail after this issue is fixed, (one thing at a time) please.


----------



## Spacebox

1/ I dumped only the Firefox files in preferences folder
2/ Only the plist files in the Firefox/catches folder
3/ Sorry Firefox in Applications folder is what I meant to say.

Netscape has the same problem as Firefox now but a lot worse, it blocks the previous page and sticks. I have to start the search from scratch in a new tab to over ride it.


----------



## macthorough

Did you create another admin user to test firefox? Same problem in the test other user too?
Repair permissions with disk utility which is in the utilities folder.


----------



## macthorough

What site does you browser redirect to?


----------



## Dark_chivalry

I have this problem too.

I've wiped all prefs with "mozilla", "firefox", "safari", or "explorer" in their name. Same with caches.

The problem afflicts multiple admin-level users.

I deleted everything to do with Firefox, Safari, and IE. They ALL exhibited the same behaviour.

On a fresh install of FF3, entering the URL "google.ca" or "google.com" displays a giveaway message in the activity bar at the bottom "looking up copy-book.com"

All "google" and "Yahoo" search results seem to redirect through one of a few sites.

copy-book.com
auut.com
smartbizsearch.com

Maybe a few others. Anyway, the pages are always ads, usually containing words from the search field, but are obviously unrelated.

There appears to be some shared application resource called upon by all browsers. IE isn't even mozilla. I tried Flock which I hadn't used in months and it did the same thing right away. It's definitely tied to Google and Yahoo though, as Dogpile and any other lesser-known engines work fine, and even the exact same results as Google go to the right page.


----------



## towerman666

I have exactly the same problem as the two above! Can anyone help. It would be so appreciated.


----------



## sinclair_tm

Did you so the things listed above already?


----------



## Dark_chivalry

One possible culprit is "DNS Changer" which has the dubious fame of being the first Mac-native Trojan. There is a free scanner-killer made to find DNS Changer specifically, and get rid of it.

It's a marketing tool for MacScan, a shareware anti-virus/spyware application for Macs. Basically it's a scan function that looks ONLY for DNS Changer, and rids you of it, then suggests you get MacScan to look for other spyware.


----------



## aardvark35

I have exactly the same probs here plus any banner ads on some websites are replaced with banners for Viagra or chaps parts enlargement!. I have a G4 tower and a Macbook both running identical systems and used on the same websites The probs only occur on the tower .I've done all the stuff mentioned above and run Macscan several times - no difference.


----------



## Macsolver

Hi,

Does indeed sound like the DNS Changer Trojan. Download the free removal tool from:

http://www.versiontracker.com/dyn/moreinfo/macosx/33696

I also recommend using Firefox with the free "NoScript" add on - currently the only combination that can stop "clickjacking" on websites you visit.

http://noscript.net/

Hope this helps.

Regards,

Nick


----------



## aardvark35

Hi Macsolver

Yippeeeeee . I've done that and it's solved the problems. My Mac seems to be back to normal. 

Ta everso.................you're a star!


----------



## soberkebab

Ahh I'm infected with this Trojan and just can't figure it out  
Google redirect with 'copy-book.com' showing up.
I've ran the DNS Changer removal tool and VirusBarrier X5 - both say my system is clean.
Have tried clean re-install of browsers and deleting all internet plugins - no dice.

Followed the instructions from here: http://www.macworld.com/article/60823/2007/10/trojanhorse.html

but the Terminal instructions appear to be invalid when i type them in. 

I do appear to have a 'phantom dns' coming up in my network preferences..

Bleurgh anyone have any recommendations?


----------



## Macsolver

Hi,

Could be that the incorrect DNS settings have been cached by the Mac OS. I would deep clean all caches using Leopard Cache Cleaner (works with Tiger too) to see if that helps:

http://www.versiontracker.com/dyn/moreinfo/macosx/16494

Hope this helps.

Regards,

Nick


----------



## kumokez

I too have the same problem, and have done all the above.
Looking at other forums that are for PC's they seem to be saying it is a DNS and server problem, and start gibbering on about log files etc. 
Could this be the same problem affecting Macs and is their a way to reset DNS etc?


----------



## kumokez

Just followed the post at the top of page from Macsolver and downloaded the free removal tool from:

http://www.versiontracker.com/dyn/moreinfo/macosx/33696

It sorted it out straight away, took no more than a couple of minutes.
Thanks.


----------



## soberkebab

Hi, thanks, unfortunately I'm still stuck with the google redirect with 'copy-book.com' and others showing up.. It seems like it might be the new Trojan Horse OSX.RSPlug.D I'm reading about everywhere.

DNS Changer removal tool, Leopard Cache Cleaner, ClamXav, iAntivirus all come up with no malware or anything to remove... frustrating 'cos it seems like these have worked for many.

Happens in Firefox, Safari, or IE when running Windows thru Parallels. 

Tried setting up a new account user and the problem still exists.

Any suggestions left?? Arg.


----------



## sinclair_tm

Being you are having the problem with IE as well, I think you are having a different problem. The OS in Parallels will not be using the same info as the Mac. It should be getting it's own IP address from the router. I could be wrong. Have you tried a different computer on the same network, or the same computer on a different network?


----------



## soberkebab

It seems as though all the computers in the network have the same problem. Looks to be DNSChanger Malware with a rogue DHCP server... all outlined in this article and fitting the description.

http://isc.sans.org/diary.html?storyid=5434

How would I fix this?? I'm not so great with routers and DNS etc


----------



## sinclair_tm

Please don't pull up threads that are over 3 months old.


----------



## macuser123

I did all of the above and no results until I removed all DNS numbers starting with 85 in the network prefs. After I removed the two (they were not greyed)
it instantly solved the problem. 

The two were...
85.255.114.99 and 85.255.112.129 

Hope this helps someone.


----------



## sinclair_tm

Please don't post in old threads!!!!


----------

