Is Mac OS 10.7.3 vulnerable to DNSchanger Trojan malware?

You're asking in the 10.6 area. But why are you asking? Do you suspect you have been infected? This is the second post we've had today about this. The first one ran the MacScan removal tool, but is saying the infection remained.

You are running Lion; this is the Snow Leopard (10.6) forum. This is pretty old stuff, so that's why I'm wondering if there's some new development. This is the trojan removal tool from securemac (macscan) for infections that were cirulating in 2008.

http://macscan.securemac.com/dnschanger-trojan-removal-tool-for-mac-os-x/

XProtect/Quarantine, which is a limited malware screening tool in 10.6, and I'd assume present also in 10.7 Lion, is showing a definition for the OSX.RSPlug.A Trojan Horse, AKA, the DNS Changer Trojan. But that definition, if something new is happening, may not be up to date. That's all I know right now.

All computers are suspectible to trojans if the user intalls it, 10.7.3 is no different, so if you've installed something with your admin password and your having issues, it could be a trojan. But likely did not get on your machine without your assistance.

The site you linked too shows a all green light, so it's not malicious.

I've found the IP's used by the malicious DNS changer network, however it is old news.

DNS stands for Domain Name Server, what this does is when you search for say google.com, or apple.com, it translates the Domain name of apple.com into a IP address (number) that then allows your computer to connect to that site.

Because servers (computers) are moved around to different hosting services with different IP address, sort of alike a business that changes location if the lease for the location is expired, the name of the domain (like a name of a business) doesn't change so people can still find the site.

The Domain Name Server handles all the IP changes, proving your computer with the latest IP address to connect too.

Now in your System Preferences > Network > DNS will be the iP addresses of the Domain Name Server your using, usually it's your ISP's but people often change it to something faster or offers more security or "filtering" of malicious site or even content!

So what you need to do is check two things, your Mac's and your router's DNS setting to make sure the IP address (two of them usually) are set to IP addressed that you KNOW belong to your ISP or a alternate DNS provider you have selected.

The only way to find out is to contact your ISP and give them your account/location present DNS IP numbers and they will tell you the IP address of the closest DNS to your location which is likely what they use.

If your DNS settings on either the Mac or the router is NOT kosher, then you've got a problem.

Sorry to sound dumb, but is it safe to run the check found at http://www.dcwg.org. Supposedly the FBI set this up.

No.

You can check here if you have been infected with DNS Changer malware: http://www.dns-ok.us/

The DNSChanger Removal Tool detects and removes spyware targeting Mac OS X and allows users to check to see if the trojan has been installed on their computer; if it has, the software helps to identify and remove the offending file. After a system reboot, the users' DNS records will be repaired.

SecureMac provides a Trojan Detection Tool for Mac OS X. It's available here:

http://macscan.securemac.com/

Seems to be on the level.

http://www.sfgate.com/cgi-bin/article.cgi?f=/n/a/2012/04/20/national/w110653D95. DTL

But these are the steps for manually checking for Mac. Appears to be Windows only, so don't know there are steps for checking for Macs.

http://www.sfgate.com/cgi-bin/article.cgi?f=/n/a/2012/04/20/national/w110653D95. DTL

WOT gives the site an excellent rating.

Your are right, your first link links to my link: http://www.dns-ok.us/ !

I really don't understand what this is all about. The Secure Mac DNS Changer Trojan is really ancient news. This seems to be something newer than that and for Windows only, yet that site has detection and removal for OS X.

Thank, Klaus1. I've installed the trial verson of MacScan and it's running now.

So if nothing is found I don't need to run www.dns-ok.us. Right?

One other question. Does this trojan only infect intel macs. I have an old G3 that is only use for backup storage and was wondering if I need to run a check on it.

Thanks!

Running MacScan probably has nothing to do with this. Run the DNS check; it's not harmful. The original DNS Changer that MacScan identified was both PPC/Intel. As I said, I don't understand what this is about, since it's supposed to be Windows only, but there are instructions for removing it from Macs.