Again! One of my machines got infected. Actually it’s my only machine at this moment. I gave my Windows machine to my lil bro and my other Windows machine is still open up! Waiting for spare parts!

Symptoms:

I don’t know what I did. But I first noticed there was a problem when I tried going to goodreads.com and I was redirected to a russian search engine! That was the only time I was being redirected. Accessing other websites or Google search results were fine. This was when using Chrome. I tried Safari same problem and then I tried my mobile, same problem!

This is when I thought that their web server was infected *3aysha eldoor*

After knowing that I only had that problem. I started Googling and some result links sent me to the russian search engine with WWW as query! Even if a malware/spyware was aimed at making profit, why would it redirect me to WWW search queries ???

Troubleshooting:

Checked my router, thought that the DNS settings were changed, everything was normal.

Anyway I’m not at all familiar with Mac OS so it took me a while.

Clearing cookies and browsing history for both Safari and HTC solved the problem. Though I still don’t understand how my mobile got infected! Maybe when I connected it to charge, the malware transfered itself! Can it do that?

Kaspersky didn’t detect any abnormalities!

Clearing the content of my Chrome didn’t solve the problem. Checking the settings this is what I found

You can check that through Manage Search Engines under Preferences. The above was automatically added because when I typed goodreads.com in the URL bar it was being redirected to yandex.

Make there are no added extensions you are not aware of. Preferences -> Extensions.

Check all exceptions under Preferences -> Content Settings.

Also I wanted to check the task manager I mean the Activity Monitor under Utilities. Nothing seems abnormal to the best of my knowledge.

One more step is to check for processes that run at startup. You can do that through System Preferences -> Accounts check both user accounts and Login Items.

The only thing that looked suspicious was iTunesHelper. It’s a valid process but this one wasn’t actually pointing to any valid path so I removed all.

Cleared all data and cookies again for my Chrome browser and that seemed to solved the problem!

Confusion Points:

• I still I’m not sure why Safari got infected since it’s a browser’s content problem. If this malware is a result of me accessing a website, then most probably a script got installed from an infected website. That means they share a folder, Temp folder in Windows, or the infection transfered itself. I’m pretty sure I didn’t install an application lately. Moreover, when running Chrome in Safe Browsing mode there was no problem at all. In incognito browsing not extensions are enabled, no cookies are used, no history is looked up so that kind of narrows the problem cause.
• How the hell did the mobile get infected?
• In Windows there’s a Temp folder, what’s Mac equivalent?