MacDailyNews Popup for DriveCleaner???

Question

Level 2

310 points

MacDailyNews Popup for DriveCleaner???

The last couple of days (and a couple of times in the past), every time I open the MacDailyNews.com page, a popup window appears advertising the services of something called drivecleaner.com. Clicking cancel or OK sends Safari to a site called drivecleaner.com, but the only thing that seems to be happening is a complete lockup of Safari. I have to force-quit Safari in order to regain control.

I'd ask the MacDailyNews folks about this, but I don't dare visit the site long enough to track down an e-mail address much less post a form reply. The popup doesn't appear immediately upon entering the site, but soon thereafter.

Anyone else have this problem with this site? Any ideas what it might be and how to eliminate the problem? I've tried deleting all cookies, resetting cache, etc., in Safari, but nothing seems to work. Too bad, because MacDailyNews is a useful site for Mac news. I'd like to be able to visit it again in the future.

MacBook Pro 2gHz, iMac G5 20" 2 gHz, iMac G4 17" 8000 mHz, Powerbook G4 Ti, Mac OS X (10.4.6)

Posted on Nov 19, 2006 4:30 PM

Reply

Answer 1

CloGram

Level 1

23 points

Nov 20, 2006 7:53 AM in response to Steve Porritt

I've had a new MacPro for a few days and just got one of these pop-ups re: DriveCleaner. It looks very suspicious, with claims of being the thing you "need" to clean out your drive of bad stuff (credit card info, illegal content, etc).
I suspect this is a virus (with claims of being a virus-fixer).
Having been Mac-only since the early 80's, I think I'm somewhat naive about viruses - having never had one so far!

I've searched MacFixit Pro & tried a WHOIS trace on the IP address & domain name, all to no avail. My Google search only found several websites on "how to remove drivecleaner" - which suggest that this is definitely an unwanted thing - some sort of Windows virus or worm (I'm guessing).

I'd like to know if there is something on my computer that would have invited this - or some security setting I could use to avoid it?

Any pro-info (or any info!) would be appreciated.
Thanks.

MacPro 2x3Ghz Dual-Core Intel Xeon Mac OS X (10.4.8) I was using Firefox, not Safari

Reply

Answer 2

Nov 27, 2006 5:41 PM in response to Steve Porritt

Same here. For me, though, it's not a pop-up, it's a re-direct after I click on an article title to view. This is annoying. I usually keep my mouse pointer over the "Stop reloading" button to stop the re-direct once it tries to start, but sometimes I'm too slow and then get stuck in that endless cycle of trying to cancel but still ending up going to drivecleaner.com anyway.

I'm glad I'm not the only one. I thought maybe I had some bad cookies or something.

BTW, I noticed that sometimes the url is spelled "driveclaener"

Reply

Answer 3

CloGram

Level 1

23 points

Nov 27, 2006 5:56 PM in response to Steve Porritt

Steve, I copied your post in a contact page for MacDailyNews and sent the link to this thread.
I used Firefox and I had no problems. Might be something you want to try - or use Opera. If Safari is the target for the drivecleaner "bug," maybe the other browsers are "clean".

Joan

Reply

Answer 4

Steve Porritt Author

Level 2

310 points

Nov 27, 2006 7:55 PM in response to CloGram

Hi!

Thanks! Can't be sure that its a specific Safari problem, though, since it is apparently a Javascript thing. I've been noting references to these things on Daring Fireball and other sites.

It doesn't happen every time. But all but once has been while on the MacDailyNews site. Happened again this morning. After which, I turned off both Java and Javascript in Safari's preferences. That seems to have helped. The Apple site, of course, doesn't like this, and puts a thick yellow bar at the top of the page asking me to turn Java back on 🙂.

I imagine that Apple is working on a security fix for Safari now. I may just try using Firefox for awhile -- see if the same thing happens there -- and just wait for Apple's patch.

Reply

Answer 5

Steve Porritt Author

Level 2

310 points

Nov 27, 2006 7:59 PM in response to CloGram

Nope. Same thing just happened in Firefox, too. Different format, Slightly different content of the 'anti-virus' message, too. But same behavior, sending me to their web site no matter what I do. ARRGGHH!

Reply

Answer 6

Steve Porritt Author

Level 2

310 points

Nov 27, 2006 8:02 PM in response to Steve Porritt

Further clarification...again, pops up while at the MacDailyNews site, not while at Apple's or the BBC's -- the two sites I visited prior to MDN. Also, in Safari, disabling Java only doesn't prevent it. Must disable Javascript. Don't know what happens if Java is enabled but Javascript is disabled. Will try that next.

Reply

Answer 7

Nov 30, 2006 9:59 AM in response to Steve Porritt

I've had this same problem for the last couple of days, also happening on AppleInsider. I disable javascript and avoid the problem, but it is annoying having to continually switch on, switch off. Funny it is targeting such mac centric sites. On one occasion while trying to get out of it, it began downloading a drivecleaner 2006.exe file.

Reply

Answer 8

Nov 30, 2006 3:06 PM in response to Steve Porritt

Well, I haven't had it for the last few days. I contacted MDN about the problem and they said they would look into it. Maybe they fixed it.

Reply

Answer 9

Steve Porritt Author

Level 2

310 points

Nov 30, 2006 3:12 PM in response to mymacluvsme

I haven't had it since installing the latest Apple security patch (knock on wood...). Hope we've seen the end of this nasty bit of Windows gomi.

Reply

Answer 10

Nov 30, 2006 3:29 PM in response to Steve Porritt

Oh yeah, I forgot about that. Maybe that's what did it!

Reply

Answer 11

Gigi Q

Level 1

0 points

Dec 13, 2006 12:38 PM in response to Steve Porritt

I've just been hit by drivecleaner.com while surfing onto www.goldenpass.ch, a transport website. I jumped into my computer after I clicked on one of the links within the site and refused to respect my choices against taking it up. I managed to stop the download half way by closing Safari but am not sure if it has still managed its infiltration.

I've read the info on the discussion page and the only help seems to be for me to find the Apple security patch.

What can I do? Does it really steal all the credit card and banking details on my mac? I'm pretty new to the technical bits and would like some advice.

Thanks so much.

Reply

Answer 12

Steve Porritt Author

Level 2

310 points

Dec 13, 2006 2:52 PM in response to Gigi Q

I have not had this problem since installing the latest Apple security update. If you are running Mac OS X (as seems likely), simply go to the menu bar, click the blue apple icon and select "Software Update..." Let it find any software updates you don't already have, and then install them. A pretty simple and painless process.

If for some reason you don't want to do this, you can avoid the problem by turning off Javascript in your browser's preferences. Not a cure, but it does seem to work. Of course, that also means that you'll have trouble viewing sites that rely on various Javascript bits to display/navigate pages.

Reply

Answer 13

CloGram

Level 1

23 points

Dec 13, 2006 2:56 PM in response to Steve Porritt

I agree. I have not had the pop-up either since the last security update.

Reply

Answer 14

Dec 13, 2006 3:40 PM in response to Gigi Q

Gigi Q, first of all welcome to the Apple Discussions.

As Steve said, you can install the security update via Software Update under the apple menu, or you can manually download and install it here.

Black MacBook Mac OS X (10.4.8) various older macs going back 15 years, and they still work!

Reply

Answer 15

Gigi Q

Level 1

0 points

Dec 14, 2006 2:24 PM in response to Steve Porritt

Dear Everyone,

Thank you for all your near instant replies. I've taken the advice and installed the latest security patch. I will keep an eye on its efficiency and post here if new mischief pops up.

Frankly, I'm very heartened to feel the support available here.

Many grateful thanks,
Gigi

Macbook Mac OS X (10.4.8)

Reply