DNS Highjack? Malware?

bohemianboy · Jun 4, 2013

Hello!

After a drunken night I admit to having installed the Badoo Desktop client... Now, after removing it, I've noticed that all my searches on chrome or firefox end up something like this:

Code:

http://www.google.pt/[B]search?client=badoo[/B]&source=hp&biw=&bih=&q=macrumors&btnG=Search+Google

I've been looking around, I've tried the dnschanger tool, no success... Tried to change the dns's myself to the google and opendns ones, nothing... Now running a ClamXav scan, but I don't have so many hopes.

My host file is something like this:

Code:

##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##
127.0.0.1	localhost
255.255.255.255	broadcasthost

(lots of adobe related itens)

::1             localhost 
fe80::1%lo0	localhost
##74.208.10.249 gs.apple.com
##127.0.0.1 gs.apple.com

Any ideas on what's going on?

GGJstudios · Jun 4, 2013

If you haven't already done so, try changing your DNS servers on your Mac and your router to OpenDNS servers. This will show you how: Why am I being redirected to other sites?

As far as removing Badoo, the most effective method for complete app removal is manual deletion:

Best way to FULLY DELETE a program

bohemianboy · Jun 4, 2013

GGJstudios said:
If you haven't already done so, try changing your DNS servers on your Mac and your router to OpenDNS servers.

Oh, but I have,

Tried to change the dns's myself to the google and opendns ones, nothing...

I will give a go to the manual deletion tho.

chown33 · Jun 5, 2013

bohemianboy said:
Hello!

After a drunken night I admit to having installed the Badoo Desktop client... Now, after removing it, I've noticed that all my searches on chrome or firefox end up something like this:

Code:

http://www.google.pt/[B]search?client=badoo[/B]&source=hp&biw=&bih=&q=macrumors&btnG=Search+Google

DNS has nothing to do with the URL shown. The problem lies in the URL itself, not in which remote DNS server is being used to resolve google.pt.

A more likely possibility is that Badoo Desktop modified some settings for those browsers, so instead of using a plain google URL as the search engine, it uses the URL with the embedded badoo junk.

You should look in the browser settings for settings that work with or manage search engines. If a search engine has been added or modified, fix it. If you don't see anything, then report back with that information.

I don't use Chrome or Firefox regularly, so I googled this:
chrome search engine

and found this:
https://support.google.com/chrome/answer/95653?hl=en

See the heading "Add, edit, or remove search engines". AFAIK, this is the same as Chrome's builtin help / settings info.

By the way, google.pt is Google's home page for Portugal. Unless you're located there, it seems like an odd choice.

Search

Search

DNS Highjack? Malware?

bohemianboy

macrumors newbie

GGJstudios

macrumors Westmere

bohemianboy

macrumors newbie

chown33

Moderator

Our Staff