safari spyware?

hello everyone,
i have a 15 inch mbp that i bought about 10 months ago. since then i have moved to china to study, my problem is that for about two months my safari has been acting strangely. every once it a while an add will show up. not as a pop-up but it will start at the bottom of the safari window and gradually move up until it is taking up the whole window besides the address bar, bookmark bar etc. it definitely seems to be an add. in fact its always the same add in chinese. i am positive that i have not visited any illicit sites to cause this. i am also behind a wireless router. my first instinct told me to try firefox and sure enough it does the same thing there. a simple reload of the page always solves the problem but it frequently re-occurs. this is my first mac so im not very savy as to how to fix it or if i can. i tried reinstalling both internet browsers but this has not worked.
any help?
is this malware, spyware?
could this just be because im in china?

macbook pro, 2.4 ghz 15inch

Posted on Sep 17, 2009 4:36 AM

Reply
20 replies

Oct 28, 2009 8:46 PM in response to danielinchina

I have uploaded two examples of the hijacking ads* to the web. Please view them at http://www.mickryan.com/safari/ Sorry about the size of the pics but I have a 24" screen and I didn't want to alter the screen grabs in any way. It can happen to any website not just the two I have shown above. The ads vary for different products and services but are all in Chinese. It only seems to affect Safari. I've been using Firefox for the last 24 hours and I haven't seen any yet.

The first example is on the US Apple homepage as most of you should be familiar with it. So you can see that this is not a banner ad (Apple doesn't have any for 3rd parties) or a pop up (which I have disabled) neither is it something I have navigated to. The second one is for a popular artist's blog Deviant Art which does have legitimate banner ads as you can see below the hijack ad for Dental services. You can visit the real pages www.apple.com and www.deviantart.com to see the genuine pages and how they should behave.

* I've described the situation in detail above but to recap these ads usually appear when I first open Safari. When I say they hijack the page I mean the page below has all its links disabled and the only thing you can click on is the hijack ad itself. The only way to get rid of the hijack ad and is to hit the reload button two or three times. I don't usually see the ads again until I relaunch Safari.

Nov 1, 2009 6:56 PM in response to dbsneddon

Thanks. It is the ISP which is China Telecom. I suspected something like this but wasn't even sure it was possible. Met a friend of mine at the weekend who is a web designer and programmer and he says it's not only possible but has been tried many times in the past including Eircom one of our home country's ISP. But it didn't last long as there was outrage when they tried it. Anyway I've since joined a VPN to get around the Chinese censors which has also cut out the ads. Next month our ISP contract terminates and we will switch ISP also. Thanks for your help.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

safari spyware?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.