PC Scan for Virus hijacking my Mac

Both Safari and Firefox acting the same way. If I type something [i.e. yellowpages] in url box, browser says I'm infected or something and they want to scan my 'PC'. I say NO and it does it any way. I say 'quit' and it downloads an .exe package. I finally quit the browsers!<br><br>Where can I find the enabling 'thing' on my Mac to get rid of this pest?<br><br>Anyone else experiencing this?<br><br>I am also getting pop-under ads when I read forum MM in Safari. <br><br>tia<br><br>

It seems you have a few "Malicious Cookies" in Safari and Firefox.<br>In Firefox open Firefox Preferences click on Privacy choose Show Cookies.<br>If you know the name of the site of the PC Scan delete that cookie or better still choose Remove All Cookies.<br><br>In Safari open Safari Preferences choose Security then choose Show Cookies and click Remove All.<br><br>

If you remove all cookies be warned you'll lose many auto log ins, you'll have to re-login to here for example.<br><br>If it's happening on both browsers, I would suspect a malicious plug in was installed, Hard Drive/Library/Internet plugins, or Hard Drive/users/you/Library/Internet plugins.<br><br>What if you type in yellowpages.com?<br><br>------>#1 - JD's Trivia game<br><br>------>#2 - MM-MCF Trivia game

I was reluctant to remove all cookies. Swatty and I have PM'd and he suggest I google the offending site's name. That led me to an Apple Discussion. I have not tried their suggestions but it seems to involve DNS. I am using AirPort Extreme and IP 10.0.1.3 address. I do not see an option in the dropdown menu -- just automatic -- to add the DNS I see in the support forum.<br><br><br><br><br><br>Here are some grabs of this villain <br><br><br><br><br><br><br><br><br><br>Trying to get rid of the windows on my screen just keeps downloading this critter.<br><br><br><br><br><br><br>

Ok Kate I got the cookie now I am infected <br><br>Check your cookies for scanner.net and delete the cookie<br><br><br> <P ID="edit"><FONT SIZE=-1><EM>Edited by Swatcat on 08/27/08 04:36 PM (server time).</EM></FONT></P>

Yeah... that's been happening to me quite a bit lately. It seems to be rampant.<br><br>[image][/image]

There are several of those out there most from porn sites some online Travel Agencies,Real Estate websites also provide those valuable cookies.<br>Some download exe's or video codec's <br><br>

So does a cookie cause a download, or a popup on an unrelated site? This is a mechanism I'm not clear on. If cookies can do this, then cookies CAN fairly count as malware after all! (I'd always thought it was a little extreme to call cookies malware.)<br><br>I saw something like this a couple years ago, but only on a certain site, so I blamed the site (and maybe that was correct).<br><br>nagr[color:red]o</font color=red>mme<br><br>I require stroyent!<br>TeamMacOSX.com | MacClan.net

My understanding<br><br>Cookies are tiny little applications that record your web surfing habits and what you buy online - The cookie then reports back to the mother web site the next time you visit that site , the cookie also holds your log in information that given web site.<br><br>Cookies are sorta like a MS macro "tiny application" and a "exe" file <-- Microsoft weakest link since Office , Excel yada yada uses macros and execution files . Favored method of attackers is to create a virus laden "macro" hides it in a "exe" file which activates the virus macro when clicked on.<br><br>These (Bad Cookies) seem to be designed for PCs but since web browsers are sorta platform independent Macs are susceptible too , it attacks browsers not the HDs for example or for as far as I can see ?<br><br>I did notice that I too have been getting lots of downloaded "exe" files <-- as far as I know and "exe" file cannot be executed on a Mac if clicked on ??<br><br>

I took those files out of both Safari and Firefox. I still get the daaamn virus takeover!!<br><br>

That is strange I removed the cookies quit Firefox and Safari and did a restart with no problems.<br>It has to be a website your going to that has that cookie.<br><br>

Did you try my plug ins suggestion, remove all those and try. Make sure you quit Safari and restart it.<br><br>How about that DNS changer removal tool that was in the article you posted?<br><br>What are you running, 10.4 or 10.5?<br><br>------>#1 - JD's Trivia game<br><br>------>#2 - MM-MCF Trivia game

Macs can't execute real exe files, although someone could NAME Mac app with an "exe" ending and I don't think it would fail to run. (That would be silly for malware to do, since a non-standard .exe name would serve is a warning of something odd going on.)<br><br>Cookies aren't apps or macros, just text snippets. That's why I don't get how one could make a page open. The snippets can store info on your browsing habits, which a site could later read or share with other sites, but it seems to me that if any ACTION is happening (downloads, popups) then that must come from scripting on the site in question.<br><br>http://en.wikipedia.org/wiki/HTTP_cookie<br><br>Let us know what you discover. Maybe look at the source code of the sites that do this. Maybe it's them who have been hijacked and not you!<br><br>nagr[color:red]o</font color=red>mme<br><br>I require stroyent!<br>TeamMacOSX.com | MacClan.net

Nagromme has a point. Just recently myspace had an ad that would cause multiple windows to open for the same site. Something about a swami or something.<br><br>Here's a link to what happens, sounds like something similar is happening to you.<br><br>http://cyberinsecure.com/malicious-adobe-flash-ads-hit-high-profile-websites/<br><br>------>#1 - JD's Trivia game<br><br>------>#2 - MM-MCF Trivia game

I don't know<br><br>However Cookies cold be a Back Door to any web browser attack scheme ?? Seems possible to me but what do I know about scripting , nothing <br><br>

Well, all the responses have been interesting. I've been to Google, other Mac sites, looked into virus software, and tried removing the offending stuff.<br><br>Still, if I type i.e. 'yellowpages' in url line, I still get the runaround and end up knifing Safari or Firefox in the back <br><br>So does it hurt when you scratch it? Well then don't scratch it -- as the saying goes.<br><br>I'll ride it out for a while and not type in one words in the url line.<br><br>Thanks for help everyone.<br><br><br><br><br>

Naw, make it hurt!<br><br>Is your ISP up to funny tricks with their own DNS?<br><br>nagr[color:red]o</font color=red>mme<br><br>I require stroyent!<br>TeamMacOSX.com | MacClan.net

Comcast don't do dirty tricks!<br><br><br><br><br>Maybe I should make that a winkie. They have cut back some people's speed when suspected of downloading or passing on big files too frequently ??????????<br><br><br><br><br><br>

Still, if I type i.e. 'yellowpages' in url line, I still get the runaround and end up knifing Safari or Firefox in the back<br><br>Hmmm. When I do that in FF, I get a generic Earthlink start page with the url of http://yellowpages/<br><br>Of course, Earthlink is my ISP. My DNS server addresses in my Network Prefs are: 4.2.2.3, 204.117.214.10<br><br>

I have comcast. Interesting.<br><br><br><br>

<blockquote><font size=1>In reply to:</font><hr><p>Hmmm. When I do that in FF, I get a generic Earthlink start page with the url of http://yellowpages<p><hr></blockquote><p>That's just the way the DNS servers are parsing what you type, not intelligently.<br><br>Try theses number instead in DNS and yellowpages goes right to yellowpages.com<br><br>208.67.222.222<br>208.67.220.220<br><br><br><br>------>#1 - JD's Trivia game<br><br>------>#2 - MM-MCF Trivia game