Browser hijacking

Question

Level 1

0 points

Browser hijacking

Hi, I'm writing this for my landlord who has a powerbook. He uses it for god knows what, but I suddenly heard screams from his room and it turned out that he kept getting forwarded to spam sites whenever he entered a url in the browser. This is an easy problem to fix in windows, but seem a bit more difficult with mac. I installed macscan and scanned the computer: Nothing. I figured it could be his network so we tried a 3g modem, same problem. It's not every time he enters a url but often. It's lottery pages, and ***** enlargement he gets sent to. I have tried googling browser hijacking in mac, but couldn't really find any useful tools. Anyone know a clever way to fix this? He is glooming in his room, afraid to touch the computer. Kind regards Didrik Smidt-Nielsen

powebook, Mac OS X (10.4.11)

Posted on Feb 10, 2010 2:19 AM

Reply

Answer 1

Best reply

Klaus1

Level 9

52,749 points

Feb 10, 2010 2:47 AM in response to Didriksmidt

Welcome to the forums!

If you allow a Trojan to be installed, the user's DNS records can be modified, redirecting incoming internet traffic through the attacker's servers, where it can be hijacked and injected with malicious websites and pornographic advertisements. The trojan also installs a watchdog process that ensures the victim's (that's you!) DNS records stay modified on a minute-by-minute basis.

You can read more about how, for example, the OSX/DNSChanger Trojan works here:

http://www.f-secure.com/v-descs/trojanosxdnschanger.shtml

SecureMac has introduced a free Trojan Detection Tool for Mac OS X. It's available here:

http://macscan.securemac.com/

The DNSChanger Removal Tool detects and removes spyware targeting Mac OS X and allows users to check to see if the trojan has been installed on their computer; if it has, the software helps to identify and remove the offending file. After a system reboot, the users' DNS records will be repaired.

(Note that a 30 day trial version of MacScan can be downloaded free of charge from:

http://macscan.securemac.com/buy/

and this can perform a complete scan of your entire hard disk. After 30 days free trial the cost is $29.99. The full version permits you to scan selected files and folders only, as well as the entire hard disk. It will detect (and delete if you ask it to) all 'tracker cookies' that switch you to web sites you did not want to go to.)

It is the tracker cookies you/he needs to get rid of.

Reply