Windows malware in Macs

[meagain]

I'm using Firefox and yes, it's happened when the settings were set to block popups. I asked another person on userplane if she was getting this also - yes. I did think it happened also even when I didn't go to Userplane, but can't specifically recall. I just went to a Userplane chat and didn't get it. I'm going to try Safari for a few days. It's just disturbing when it happens. My concern is that it's somehow dumping 'something' on my computer to dirty it up. But perhaps it's not possible. It's just a scarey thing when it starts 'running' or 'fake running'. Like in the days I had Microsoft.

 

[Bobbi Flekman]

I think it is just a matter of popups. Get a good popup blocker and you'll be rid of it. I use Opera, so I cannot advise about a blocker, but others here doubtfully can (and will).

As for the download.... Clean your caches. I think that Firefox can do this automatically on shutdown. Once again, I don't use Firefox.

 

[newbie2008]

i got that pop-up today.
on safari. i was browsing through livejournal amazon and the muse boards and it popped up...
i was confused and didn't trust it so i clicked cancel...and then took me to some other page but i exited out of that page...
i took a screen grab before i clicked cancel...

i have pop-up blocker on...is there a reason why it popped up or is it just a random pop-up?

well just glad i have a mac...

 

[Bobbi Flekman]

i have pop-up blocker on...is there a reason why it popped up or is it just a random pop-up?

Sorry, can't help you there as I don't use Safari (except to see if my own webpage creations are okay). In other words I don't know what will be blocked or not. It also depends on whether it is a literal popup (as in a new window) or an alert() message dialog (as this one looks like).

At least you're not infected

 

[meagain]

It happens both on Safari and Firefox. My popups are blocked.
I'm getting this definitely using Userplane chats. Something else also but I can't figure out what it is.

 

[Gaberdine]

i got this malware alert crap also. it pretty much took over firefox but does not seem to be effecting safari. i uninstalled firefox and reinstalled it later to no avail. i tried clearing the cache and cookies in firefox but it still has control over it. every time i start firefox it goes to the scanner2.malware site and will not let me navigate away from it. anybody know a way to get rid of it? btw, i am using an intel macbook running the latest version of tiger, if that helps.

Any progress? Did you get Firefox back?

Are you sure it was ever Firefox at all?

Did you check your homepage? Had it been changed? Did you try a new one and see what happened? Did you consider that maybe the page itself had been hacked, not your copy of Firefox (so no wonder it kept happening)?

If Safari was unaffected, did it have the same homepage setting?

 

[Gaberdine]

i got that pop-up today.
on safari. i was browsing through livejournal amazon and the muse boards and it popped up...
i have pop-up blocker on...is there a reason why it popped up or is it just a random pop-up?

Just read my previous posts in this thread and you will find the answers there:

1. This is a website hack.
It requires no action on the part of the user, apart from innocently visiting a popular site that has been hacked to redirect your browser. If you see it, *contact the sites webmaster* immediately. You may be immune but millions of others are not.

2. This is not a pop-up.
Pop-up blockers will not prevent this message displaying because it is not a pop-up. A pop-up is a browser window that you didn't want to open. This is a system alert message generated by Safari displaying information provided by the bogus site. Not only does this circumvent pop-up blockers, it also prevents you using Safari until you click one of the buttons.

3. Clicking "Cancel" may not save you.
When this message appears, Safari is effectively locked until it records a System Event, namely clicking the "Download" or "Cancel" buttons. You'd need to know more about how these system alerts work to be sure; but Cancel may not mean cancel. Maybe it just releases Safari to continue the site redirection to the bogus scanner window, or maybe it actually gives it permission to display a new window and take any other action hidden behind that button. How lucky do you feel?

4. Different browsers may behave differently
Just 'cos you are using OS X does not make you completely safe. According to one report, this thing *may* hack Firefox to redirect the browser's home page to malware central. You wouldn't bother to do that to a Mac browser unless you had a payload waiting. It's possible Firefox handles these alerts differently and is more susceptible - or less so. However, see above, the other possibility is that the home page URL itself had been hacked and Firefox itself was not at affected.

 

[richard.mac]

uploaded the .exe to Virustotal.com that downloads after clicking "OK" in the OP's link and it came back as a trojan

http://www.virustotal.com/analisis/4ee0596a186743108c58078e4b1ace7f

be thankful that your using Mac OS X as clicking "OK" and downloading the .exe it would just sit dormant in your downloads folder.

BUT dont anyone think that you are completely safe on a Mac! the scam was targeting Windows users. there have been scam video sites that urge Mac users to download a video codec to watch content which is actually a trojan. the codec is an installer package inside a disk image which needs your admin password to install.

 

[Ubele]

3. Clicking "Cancel" may not save you.
When this message appears, Safari is effectively locked until it records a System Event, namely clicking the "Download" or "Cancel" buttons. You'd need to know more about how these system alerts work to be sure; but Cancel may not mean cancel. Maybe it just releases Safari to continue the site redirection to the bogus scanner window, or maybe it actually gives it permission to display a new window and take any other action hidden behind that button. How lucky do you feel?

I don't know if it's effective in every case, but on those rare occasions when I get suspicious messages or have a series of windows rapidly start to open in Safari, my approach is to disconnect from the Internet, and then either cancel the message or close the windows. Then I reset Safari to be safe, and then I reconnect to the Internet. So far, it's worked fine (unlike on my old Windows PC).

That brings up another question: Safari's pop-up blocker works 99% of the time for me. So how do those other 1% of pop-ups get through?