DNS Highjack? Malware?

bohemianboy

macrumors newbie
Original poster
Aug 12, 2008
15
0
Hello!

After a drunken night I admit to having installed the Badoo Desktop client... Now, after removing it, I've noticed that all my searches on chrome or firefox end up something like this:

Code:
http://www.google.pt/[B]search?client=badoo[/B]&source=hp&biw=&bih=&q=macrumors&btnG=Search+Google
I've been looking around, I've tried the dnschanger tool, no success... Tried to change the dns's myself to the google and opendns ones, nothing... Now running a ClamXav scan, but I don't have so many hopes.

My host file is something like this:

Code:
##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##
127.0.0.1	localhost
255.255.255.255	broadcasthost

(lots of adobe related itens)

::1             localhost 
fe80::1%lo0	localhost
##74.208.10.249 gs.apple.com
##127.0.0.1 gs.apple.com
Any ideas on what's going on?
 

chown33

Moderator
Staff member
Aug 9, 2009
8,495
4,504
Restivus
Hello!

After a drunken night I admit to having installed the Badoo Desktop client... Now, after removing it, I've noticed that all my searches on chrome or firefox end up something like this:

Code:
http://www.google.pt/[B]search?client=badoo[/B]&source=hp&biw=&bih=&q=macrumors&btnG=Search+Google
DNS has nothing to do with the URL shown. The problem lies in the URL itself, not in which remote DNS server is being used to resolve google.pt.

A more likely possibility is that Badoo Desktop modified some settings for those browsers, so instead of using a plain google URL as the search engine, it uses the URL with the embedded badoo junk.

You should look in the browser settings for settings that work with or manage search engines. If a search engine has been added or modified, fix it. If you don't see anything, then report back with that information.

I don't use Chrome or Firefox regularly, so I googled this:
chrome search engine

and found this:
https://support.google.com/chrome/answer/95653?hl=en

See the heading "Add, edit, or remove search engines". AFAIK, this is the same as Chrome's builtin help / settings info.


By the way, google.pt is Google's home page for Portugal. Unless you're located there, it seems like an odd choice.