I think I have spyware... ON MY MAC!!!!

Discussion in 'Mac Basics and Help' started by Stinkythe1, Sep 8, 2005.

  1. Stinkythe1 macrumors regular

    Mar 30, 2005
    We'll I just noticed that whenever I go to a webpage that doesn't exist, ending in .net, (such as www.slkdjf.net) it redirects safari to http://www.net.net/search.asp?Keywords=[whatever the domain was]

    I go to a different computer, and it works fine saying that the webpage can not be found. What is going on?
  2. eva01 macrumors 601


    Feb 22, 2005
    Gah! Plymouth
    hahahha spyware on Mac that is great. hehehe made me laugh

    reset safari
  3. Stinkythe1 thread starter macrumors regular

    Mar 30, 2005
    Reset, as in restart safari? Tried it. Still does it.
  4. tobefirst macrumors 68040


    Jan 24, 2005
    St. Louis, MO
    No, in the main menu in Safari, there's a "Reset Safari..." option. That is what eva01 is referring to.
  5. Stinkythe1 thread starter macrumors regular

    Mar 30, 2005
    Ok, I reset safari and it still doesn't fix it. I also tried to go to sdlkfjoe.net or anything to that effect in firefox, and it redirects it to that net.net stuff also.
  6. Quartz Extreme macrumors regular

    Quartz Extreme

    Jun 9, 2005
    Outside of the box
    Check your hosts file:

  7. Eric5h5 macrumors 68020

    Dec 9, 2004
    You're not running Windows. You don't have spyware. ;)

    Check this out. The fix described is for Windows, but it's similar on Macs...open preferences, click on the Network pref pane, put the right DNS number in the obvious place.

  8. Stinkythe1 thread starter macrumors regular

    Mar 30, 2005
    Explain this.

    Also, my DNS information is correct.
  9. belvdr macrumors 603

    Aug 15, 2005
    No longer logging into MR
    I doubt its your hosts file, as all entries ending in .net go to www.net.net. I'm not sure you can put a wildcard entry into /etc/hosts.

    Are you running through a proxy server of some sort? If Firefox acts the same as Safari, it has to be a more global problem.
  10. Stinkythe1 thread starter macrumors regular

    Mar 30, 2005
  11. ckeck macrumors 6502a


    Jul 29, 2005
  12. Stinkythe1 thread starter macrumors regular

    Mar 30, 2005
    That seems kind of drastic.
  13. moonislune macrumors regular

    Sep 11, 2005

    Yeah no kidding. Do you have network connectivity to airport's or other networked computers?
  14. powerbook911 macrumors 68040


    Mar 15, 2005
    I had this happen to me a couple months ago. I restarted the computer, and it worked again. It was doing it to me in Firefox too. Maybe it was my ISP though, I'm not sure.
  15. rainman::|:| macrumors 603


    Feb 2, 2002
    Sounds like some bad DNS entries are filtering down to your ISP, and they have to others as well. Probably not spyware for obvious reasons. And spyware doesn't just go away for some people... admittedly this isn't a great answer but it's the best i can think of.
  16. FFTT macrumors 68030


    Apr 17, 2004
    A Stoned Throw From Ground Zero
    I seriously doubt you have any spyware on your machine.

    Even so,
    I'm wondering if you may have downloaded any questionable
    files or programs from a P2P network?

    More than likely, I have to agree that this is an issue
    with your ISP.
  17. MacNoobie macrumors 6502a


    Mar 15, 2005
    I don’t think its spyware at all, for some reason a company.. don’t know who or where has registered or somehow controls domains that are either spelled incorrectly or not valid and when you type in a domain name that’s misspelled (commonly) it seems to redirect to "a web site". I don’t know who controls it or why but I've noticed it with my mac and windows machines, like for example I try www.dprevew.com (correct one has an I in vew) and gives me http://newnet.qsrch.com/dpark?s=dprevew.com&prt=nn01 , so no its not spyware that I can tell its just some company or entity controlling redirects to an invalid name instead of showing you a domain not found message.

    The url its redirected to is Quick! Search Technology from New.net. © 2003 - 2005 New.net, Inc. All rights reserved. That’s the "company" I commonly see if I misspell a domain name.

    I doubt that DNS settings from your ISP are even the problem, I think it has more to do with a lot of companies now controlling domain name registrations and other aspects of the internet, use that to get traffic to their site. If you think about it then it makes sense from a company aspect to redirect and increase traffic to a site you (the company) own and what better way to do it then to tap into misspelling a domain name, you know how many people a day must mistype a url (even one letter) and get this quick search crap, especially people that don’t understand the internet and just see a search engine and end up using that one (which probably ends up installing spyware somewhere down the line).
  18. snkTab macrumors 6502a


    Nov 13, 2004
    Cincinnati, OH
    ISP's get hit with DNS attacks as well. It took a few weeks before 50% of all my websites that I visited to stop being redirected to a site where I can buy offshore drugs.

    Basically, when you send a request for webpage A, it goes to your ISP and your ISP's records are scambled so a lot of all its cached ip <-> domain names go to these spam sites.
  19. SummerBreeze macrumors 6502a


    Sep 11, 2005
    Chicago, IL
    The thing is, the company has to BUY all these domains in order to get them to redirect to a different website. This definitely sounds like a bit of spyware that my roommate had on her computer last year. Everytime she spelled something wrong, a spyware program that had installed itself in internet explorer redirected the browser to a online store.

    Did you install any new programs lately? Sometimes programmers can't afford to distrubute their programs, so they let these spyware companies install spyware "helpers" along with the program. Maybe something like that happened?

    If not, you should contact your ISP.
  20. Makosuke macrumors 603

    Aug 15, 2001
    The Cool Part of CA, USA
    Hmm... the fact that it's only on nonexistant .net domains certainly points to your ISP, not your Mac (for example the big Verisign hulabaloo of a couple years back), but if it's the same from another computer using the same internet connection, then that is less likely.

    To confirm, it does *not* do this on another computer when it's connected using the same ISP?

    And, since it's not Safari only, it'd have to be lower-level than a simple browser hijack.

    The first thing to try would be, as suggested, to manually set your DNS to an available DNS server somewhere (I'm sure you can Google up a pile) and see if that changes anything. If not it doesn't guarantee it's not the ISP but seems a lot less likely, so the hosts file is next up (also as mentioned). The third possibility would indeed be some sort of adware, though it'd be something of a first.
  21. Err macrumors member

    Aug 19, 2005
    i second the post above me.

    does this "redirect" happen to other computers on your network when visting the same .net address? if so its your ISP. setting your computer up to use a diff DNS is another good idea, if you dont have another computer on your network to try.
  22. Stinkythe1 thread starter macrumors regular

    Mar 30, 2005

    DNS for comcast is set correctly, also.
  23. mkrishnan Moderator emeritus


    Jan 9, 2004
    Grand Rapids, MI, USA
    Is the other computer that doesn't do this connected to the same ISP via the same router?
  24. Stinkythe1 thread starter macrumors regular

    Mar 30, 2005
  25. mkrishnan Moderator emeritus


    Jan 9, 2004
    Grand Rapids, MI, USA
    When you go to System Preferences -> Networking -> (click on the connection you're using) -> TCP/IP, are you using DHCP, and what is written in the DNS servers and Search domains boxes?

    Usually you don't really have to set up DNS anymore... especially not on a computer downstream of a router. The first device in the line (usually the router) should get all of that via DHCP, and then should pass it on to everything else via DHCP. I have Cox cable and not Comcast, but I don't have any DNSes set up explicitly, either on my router or on my iBook....

Share This Page