dns hijack

Question

Level 1

6 points

dns hijack

I'm wondering if anyone else has seen this recently.

There is a Mac Pro here at my work running 10.5.3 that appears to have a DNS hijack going on. When I force a DHCP renew, the DNS settings point to our DNS servers. After about 30 seconds or a minute, they change to 85.255.116.30 and 85.255.112.19. This literally happens right in front of my eyes without me clicking on anything. I can't delete them without going to a static IP. Once the DNS settings change, I can't ping internal websites nor a number of external ones (including Apple...heh).

I googled those IP address and a number of pages comes up from anti spyware sites with infected registries on Windows machines. Any ideas? If not, the machine will get reimaged tomorrow but I'd prefer to find a fix incase I see this again.

MacBook Pro, Mac OS X (10.5.3), 15" - 2.2 Ghz

Posted on Jun 23, 2008 3:06 PM

Reply

Answer 1

Best reply

gumsie

Level 4

2,179 points

Jun 23, 2008 3:09 PM in response to oil_fan

What do you think:
http://www.dnschanger.com/

Reply

Answer 2

oil_fan Author

Level 1

6 points

Jun 23, 2008 3:15 PM in response to gumsie

Interesting. I'll give it a try tomorrow morning.

Reply

Answer 3

oil_fan Author

Level 1

6 points

Jun 24, 2008 6:56 AM in response to gumsie

That did it. It yanked off the trojan, I rebooted the machine and the proper DNS settings held. Thanks for the info!!

Reply

Answer 4

gumsie

Level 4

2,179 points

Jun 24, 2008 8:02 AM in response to oil_fan

You mean you actually had one? Dang!
Probably time us Mac users became a little less blasé.

Reply

Answer 5

Jun 24, 2008 8:50 AM in response to oil_fan

Well, now all you have to do is find out who ben surfing **** sites on the mac!

Reply

Answer 6

oil_fan Author

Level 1

6 points

Jun 25, 2008 3:03 PM in response to James Dylan

lol...pretty much. He did admit that he was on a site that something like 'to watch this video, click here'. Brilliant...just brilliant!! heh

Reply

Answer 7

reddart

Level 1

8 points

Jun 28, 2008 4:00 AM in response to oil_fan

I have this happening too, and tried the DNSChanger removal tool. It detected the trojan and supposedly removed it, but I am still getting redirected (and the tool no longer detects it).

Any thoughts? (I have checked Library->internet plug-ins and sudo crontab-l in terminal and do not see anything there)

Reply

Answer 8

reddart

Level 1

8 points

Jun 28, 2008 4:13 AM in response to reddart

OK, after manually removing the bad DNS addresses and "renew DHCP lease", it now works (no redirects)

I didn't know I would need to do this last step after the removal tool .

Reply

Answer 9

oil_fan Author

Level 1

6 points

Jun 28, 2008 7:04 AM in response to reddart

I rebooted after running the tool so it probably reset the DHCP settings for me. But I'm glad you got it removed.

Reply

Answer 10

Jun 28, 2008 7:55 AM in response to gumsie

gumsie wrote:
Probably time us Mac users became a little less blasé.

It was pointless for mac users to boast about no viruses for macs in the first place, because all it takes is one or two folks to write one and then its all over. With the Mac's popularity increasing big-time, it's inevitable that viruses will crop up, so instead of getting sucker-punched the mac community should take proactive steps to ensure robust virus and malware protection software gets developed and implemented.

Reply

Answer 11

gumsie

Level 4

2,179 points

Jun 28, 2008 8:00 AM in response to Topher Kessler

I've always thought that. Too much of, 'Oh this can't happen and that can't happen' will eventually get someone with the necessary skills thinking,
"Is that so? ..........Well we'll see about that!"

Whenever someone sets a challenge, and the statement 'there are no viruses for Macs' is exactly that. Sooner or later someone will rise to that challenge.
We should have kept our mouths shut and remained safe and smug for a little longer.

Reply

Answer 12

Dogcow-Moof

Level 8

36,381 points

Jun 30, 2008 3:27 AM in response to Topher Kessler

Topher Kessler wrote:
It was pointless for mac users to boast about no viruses for macs in the first place, because all it takes is one or two folks to write one and then its all over. With the Mac's popularity increasing big-time, it's inevitable that viruses will crop up, so instead of getting sucker-punched the mac community should take proactive steps to ensure robust virus and malware protection software gets developed and implemented.

Of course the original issue here is not a virus, it's a trojan horse.

1) The user has to visit a questionable video site.
2) The user has to download the "disguised" video codec.
3) The user needs to provide their administrator password to install it.

There's only so much a system can do to protect users from themselves; if you're willing to follow the steps above, you're also willing to install a script that will delete all contents of your hard drive (or put them up on a web site) all because you want to see videos from a questionable provider.

Reply

Answer 13

Sep 15, 2008 9:30 AM in response to oil_fan

I had the same!

Thx for the fix guys - and here's me thinking Mac's had no viruses....

Reply

Answer 14

Dogcow-Moof

Level 8

36,381 points

Sep 15, 2008 2:48 PM in response to cell0maestro

Reread my post above; this is not a virus, it's a Trojan Horse.

It's the difference between your money being stolen from you and you giving your money to a con artist.

One requires explicit action on your part, which you did when you downloaded the original "video codec."

Reply

Answer 15

j.v.

Level 5

4,155 points

Sep 15, 2008 4:20 PM in response to Dogcow-Moof

I'd be interested in knowing from anybody if these dns changer trojan horses were downloaded from more innocuous sites like youtube or facebook or something like that, i.e., has this trojan been reported to extend beyond the category of sites originally classified as the most likely sources of initial penetration into the online community?

I assume that this is one that Apple's most recent client security update cannot adequately combat (i.e., hard to police a user's deliberate actions, smart or...not exactly the best course of action to have followed)?

Reply