Spacebox

Hi everyone, I have this annoying virus on my mac which redirects my results on Google to another site. I'm running on OSX using Firefox.
What is this? Any easy fixes? Thanks in advance!

sinclair_tm

Well, I can tell you it's not a virus, but instead it's a browser hijack. The first thing is to open Safari, and see if it does the same thing. If it does, then it's in the system cache, if not, then it's only in FireFox. If it does happen in Safari, then goto the Safari menu and select "Reset Safari..." and in the resulting box, make sure everything has a check mark, and then click on reset. That should fix it. If it's only FireFox, then you need to find where within FireFox there is a option to empty the cache, cookies, and any other stored data, and do it.

__________________
.

macthorough

...in firefox 3 clearing the cache is under the Tools >clear private data.

Next I would see if the issue occurs in multiple users, so I would create a test account and see if I can reproduce the issue.

Spacebox

Thanks for the posts.
Safari has no problems but I have reset it anyway and cleared all private data on Firefox. The only thing unchecked on both were passwords, could that be the problem?
Firefox is still the same with no change on the redirect.
I'll try the test account tomorrow....

macthorough

I would clear "ALL" private data including passwords.

If the test account works normally then I would do the following...

Go to the following folders and blow away any files that say Mozilla or Firefox.

\user\library\preferences\

in the preferences folders and files you see files named ...plist

\user\library\caches\

If the test account does have the problem reinstall Firefox.

macthorough

oh yeah troubleshoot you firfox add-ons

...disable or remove any add-on/plug-ins one at a time to see if any are causing the issue.

Spacebox

I have cleared all private data including passwords. No change.
Tried reinstalling Firefox, no change there either!!!
I feel like ditching Firefox altogether.

Disaster, last night after a restart, the computer has reverted to basic settings..!! The dock is empty of my programs, all custom settings have gone and most upsetting of all my mail has vanished. When restarting the program it prompts new set up! All my files appear to be intact though, I'm hoping that I can save my mail files?
If I had a PC I'd be convinced that I have a virus.
Any ideas guys??

macthorough

What did you do before you restarted? Did you change or reinstall anything? If you put something in the trash do not empty the trash you might need it back.

I doubt you have a virus, but if you think you do download a virus program trail and do a scan.

sinclair_tm

Did you create a new user account, as that is what it sounds like is going on. Open your hard drive, then the folder users. There you will find a folder for all users on the computer and a shared folder. The folders are named after the user short name. The current user is the folder that looks like a house. If the house isn't your account, then your stuff is fine, and you just need to log into your account.

__________________
.

macthorough

We need to back track here a little... i hope you did not rename your home folder aka the folder with the house on it... what did you do before you restarted?

Spacebox

All I have done was to dump files in caches and preferences as recommended. I also trashed Firefox out of utilities and downloaded a fresh version. All my bookmarks had turned up though? Still the redirect problem.
Before restarting, I noticed mail behaving weirdly. That was the reason for the restart. Prior to that there was no change to anything I can think of.
The first thing that came to mind was the users account. Its under my name so no relief from that!.
However I have come across my mail files The thing is the new mail program does not want to import them. I go to file, import mailboxes, mail for mac osx, and chose my original pop mail files which are emlx files. All that happens is that no mac osx files found. Anything else I can do?

How do I do a virus/system check on a mac?

Thanks for your help again.

macthorough

1 did you dump the whole preferences folder or just the Mozilla or Firefox files in the preferences folder?

2 did you dump the whole caches folder or just the Mozilla or Firefox files in the caches folder?

3 why is Friefox installed in your Utilities folder? Applications may not work properly if they are not installed in the Applications folder.

4 Let's, look at mail after this issue is fixed, (one thing at a time) please.

Spacebox

1/ I dumped only the Firefox files in preferences folder
2/ Only the plist files in the Firefox/catches folder
3/ Sorry Firefox in Applications folder is what I meant to say.

Netscape has the same problem as Firefox now but a lot worse, it blocks the previous page and sticks. I have to start the search from scratch in a new tab to over ride it.

macthorough

Did you create another admin user to test firefox? Same problem in the test other user too?
Repair permissions with disk utility which is in the utilities folder.

macthorough

What site does you browser redirect to?

Dark_chivalry

I have this problem too.

I've wiped all prefs with "mozilla", "firefox", "safari", or "explorer" in their name. Same with caches.

The problem afflicts multiple admin-level users.

I deleted everything to do with Firefox, Safari, and IE. They ALL exhibited the same behaviour.

On a fresh install of FF3, entering the URL "google.ca" or "google.com" displays a giveaway message in the activity bar at the bottom "looking up copy-book.com"

All "google" and "Yahoo" search results seem to redirect through one of a few sites.

copy-book.com
auut.com
smartbizsearch.com

Maybe a few others. Anyway, the pages are always ads, usually containing words from the search field, but are obviously unrelated.

There appears to be some shared application resource called upon by all browsers. IE isn't even mozilla. I tried Flock which I hadn't used in months and it did the same thing right away. It's definitely tied to Google and Yahoo though, as Dogpile and any other lesser-known engines work fine, and even the exact same results as Google go to the right page.