DNS Changer-like trojan?
I've stumbled upon some sort of virus/trojan/malware, and nothing seems capable of getting rid of it. I've tried MacScan, ProtectMac, and iAntiVirus, emptying the cache/history/cookies/etc. of all my browsers, as well as resetting my router, and none of these attempts have fixed it. (iAntiVirus is running a full scan right now, but I'm not hopeful; a quick scan found nothing and the software's update feature wouldn't work.)
The malware appears to operate like the DNS Changer trojan, but it only goes into effect occasionally. It happens in Safari and Firefox, for sure, and Chrome, iirc. Maybe once or twice an hour, a window will pop up, usually directed to "google-analytics.com" Sometimes it will start at "search.gugle.com" and then redirect to search. and results.google-analytics.com. Most often it gets stuck here, at the analytics.com address, but it will occasionally continue redirecting until the page ends up at something obviously scammish. The pop-up seems to be triggered by a random click; I cannot discern any specific websites or links that trigger it, except bit.ly, which loads, and then immediately redirects (without a pop-up) and hangs.
A name-server grep pulls 10.0.2.1, so nothing seems to be odd there, and this is why I assume it's not actually the DNS Changer trojan.
I'm currently running a daisy-chain of computers all sharing one internet connection, which tells me that it's my computer, because only it and the computer after me suffer from the problem. The modem is attached via ethernet to an iMac, which is wirelessly forwarding internet to my MacBook, which is forwarding internet via ethernet to a MacMini used as a mediacenter. The problem has only occurred, that I have seen, on the MacBook and MacMini. Curiously, the bit.ly redirect only occurs on the MacBook, not the mini.
That's all the information I can think of that's relevant. If anybody can help me, it would be much appreciated.
Message was edited by: senseabove
The malware appears to operate like the DNS Changer trojan, but it only goes into effect occasionally. It happens in Safari and Firefox, for sure, and Chrome, iirc. Maybe once or twice an hour, a window will pop up, usually directed to "google-analytics.com" Sometimes it will start at "search.gugle.com" and then redirect to search. and results.google-analytics.com. Most often it gets stuck here, at the analytics.com address, but it will occasionally continue redirecting until the page ends up at something obviously scammish. The pop-up seems to be triggered by a random click; I cannot discern any specific websites or links that trigger it, except bit.ly, which loads, and then immediately redirects (without a pop-up) and hangs.
A name-server grep pulls 10.0.2.1, so nothing seems to be odd there, and this is why I assume it's not actually the DNS Changer trojan.
I'm currently running a daisy-chain of computers all sharing one internet connection, which tells me that it's my computer, because only it and the computer after me suffer from the problem. The modem is attached via ethernet to an iMac, which is wirelessly forwarding internet to my MacBook, which is forwarding internet via ethernet to a MacMini used as a mediacenter. The problem has only occurred, that I have seen, on the MacBook and MacMini. Curiously, the bit.ly redirect only occurs on the MacBook, not the mini.
That's all the information I can think of that's relevant. If anybody can help me, it would be much appreciated.
Message was edited by: senseabove
MacBook Black, Mac OS X (10.6.3)
