Did someone make Adware for Safari!!? Getting pop-ups!!

Thanks for your help. Here is the response from the TV station:

"This actually looks like it would be an advertisement associated with
us...but that's not anything we've added to our code. You may have
installed some toolbar or something within your browser which is causing
these types of popups no matter what website you're on.

Please try to use a different browser JUST to see if the popups keep
coming up. This will tell you if it's something in your browser or not.
If it is, you may want to look at disabling any recent add-ins or
plugins you may have installed in that browser.

Thank you,
Matthew Koenigs
Systems Manager, Interactive
Waterman Broadcasting Corp.
http://www.nbc-2.com



-----Original Message-----
From: Doug Thompson <edited by host>
Sent: Wednesday, September 10, 2008 9:20 AM
To: Matthew Koenigs
Subject: Re: Web TechnicalQuestion

Hi Matthew,
Here are two screen shots. On one I command clicked the pop-up so we can
see the url.

Okay, I started using Firefox and no popups! Now I'm back on Safari today and I'm getting the same exact type of pop-ups regardless of what site I go too! Not on every click but just randomly when I click. Maybe every 3 to 7 clicks or something. I'm getting this no matter what site. Could it be my service provider Embarq doing it somehow?/Users/dougthompson/Desktop/Picture 5.png

I never got a chance to test changing the DNS Servers because the pop-ups suddenly stopped. But I noticed a big slow down in my web surfing. Pages loading really slow so I started researching and actually changed my DNS Servers to openDNS (your suggestion) I actually changed my router first and then I saw those same openDNS numbers come up in my computer so I thought all was well. I tried surfing and it was still slow so I went back into network prefs and the servers back to 85.255.115.27 and 85.255.112.217!! I'm just leaning about this stuff so I don't know if that's normal. Anyway I hit the plus button and add the OpenDNS numbers to the list. The 85.255.112.217 were greyed out so I couldn't hit the minus button and remove them. I found that interesting because the OpenDNS site says to write down and delete the old numbers.
By accident I noticed that I have this message showing up every minute in my Console Messages log:
com.apple.launchd[1] (0x10bfb0.cron5126): Could not setup Mach task special port 9: (os/kern) no access

So I started looking into that and found this in a forum:

"I did a bit of research, and there don't appear to be any figuring out exactly WHY cron is generating an error for launchd, but it does appear to match each time a cron job is run. On my system it was happening every minute.

However, the reason cron was running every minute, was to run the following script:

* * * * \"/Library/Internet Plug-Ins/QuickTime.xpt\">/dev/null 2>&1

The '* * * * *' says to run every minute, and the script is a trojan, which may or may not affect your internet connection. It attempts to redirect your DNS (domain name service) to a pair of servers in eastern europe.

If you have this entry in your crontab, or particularly in your root crontab, delete the script, and another script in the same directory 'plugins.settings', then delete the crontab entry. If you want more info, do a google search on 'QuickTime.xpt' and you've find more than you ever wanted to know.

To check for the crontab entry, use 'sudo crontab -l' (that's a lowercase "L") from a terminal, and if the entry is there, and nothing else, just delete the crontab file via 'sudo crontab -r' and if there are other lines you wish to keep, use 'sudo crontab -e' to edit the crontab file. Knowledge of 'vi' or 'emacs' may be required to edit the file. If you don't know what any of this means, please ask for help from a local Mac expert, a unix expert, or your local Apple Store's Genius Bar.

Hope this helps someone. I'm glad I took the time to sort this out."

So now I'm wondering if I have a trojan or if those DNS numbers were from embarq?

By the way. Changing to the DNS servers you gave did indeed fix my speed. Again I'm not sure about the pop-ups because they mysteriously stopped anyway.

Wow! Looks like I had the DNSchanger trojan!!! Unbelievable! I used the free utility to clean it out:

http://www.versiontracker.com/dyn/moreinfo/macosx/33696