Hi and Welcome to Just Answers. My name isXXXXX me know when your ready to start
OK I'm ready
Ok I can see your back now so I will give you 2 links one to explain what your computer has and the second is a program to remove it. Also look through your contact lists and delete email contacts you don't know the trojan will automatically add itself to your contacts ok. So first look at this description: http://www.f-secure.com/v-descs/trojan_osx_dnschanger.shtml it shows how easy it is to get this even by running fake warnings or opening the email which unfortunately you have done. The second is a program to remove it from your system here: http://macscan.securemac.com/ you can run the free download and let me know if this works for you ok.
The first thing I was going to recommend was install clam and run it lol. Most people don't think apples get viruses.
I have run both clamXav and a fully operational trial version of ProtectMacAntivirus and neither have detected anything !
ok have you checked through your contact list?
If not please do.
Are you still with me?
sorry yes I am still here I was just reading the info from the link you sent ! What am I looking for in my contact list? Do you mean address book?
Will the trial version of MacScan work?
The trial version should do the trick but I am confused you said you ran this and found nothing is that correct? If not please run it. :)Another way to remove it if it has placed itself in the browser is to uninstall firefox and re install it from this link: http://www.apple.com/downloads/macosx/internet_utilities/mozillafirefox.html Let me know whats going on as you do the scan or if you need to uninstall and reinstall ok.
I haven't tried MacScan but ProtectMac - maybe MacScan is better... Can you help me with what I'm looking for in my contacts list and is this the same as my address book?
Do I need to remove from contacts before running the MacScan?
Ok just look through your email contacts for anything that was added without your permission when you opened the email that contained the virus it was most likely added to your mailing list in the addressbook.
the email came from one of my own addresses... although there may well have been another address hidden in the long header... How do I know what was added without my permission?
I have 1395 contacts in my address book and don't even know how i get to look at the "previous recipients" list - is there a short cut for finding the email contact?
Wow thats really a large amount to look through. Give me a minute and let me see if I can find a root kill for your system are you able to wait about five minutes?
I don't want to make you wait to long :)
sure - I really need to get this sorted. I'm a translator and work online - if I can't send mails I can't earn money!
Same here give me a quick minute thanks :)
I think I found it! And have deleted it...
That's great! Can you now download and run the rookit remover from above to remove any pieces that are hiding in your system?
I am running MacScan as we speak...
At the moment it is scanning my "user" files... and has only found 4 tracking cookies...
Did that go through???
It is still scanning!
Sorry let me try again. Ok here is a program that should remove your trojan please scroll down and choose the blue download on the left side of the page. Run this and let me know how it does. It should work quickly. I will be here until your done. If you have to restart your system please just save this page/bookmark so you can get here easier. This may be easier than the first virus remover this cleans the roots. lol Give it a try please It is called F-Secure BackLight Rootkit Remover : http://www.informationengineer.org/2009/04/21/f-secure-backlight-rootkit-remover.html
ok will download and try new solution
Please look above and let me know if the second link comes through this system is blocking me ok
the link showing in your message of 4:22 only shows for Windows
I don't have the second link - all I am getting from http://www.informationengineer.org/2009/04/21/f-secure-backlight-rootkit-remover.html is links to links that provide compression software...???????????
Ok the system keeps blocking my posts I will keep trying to send this new link to you
I have just run a DNSChanger trojan horse remover and the scan it ran (somehow linked to MacScan) said it could not detect the DNSChanger trojan horse...
ok can you send your self an email to check to see if you have removed it while I try to locate the correct link for the rootkit thanks let me know
I cannot send ANY emails - even to myself. That is precisely the problem.
Are you sure this is a DNSChanger trojan horse?
You deleted the contact right so I was wondering if the email worked now.
I think I deleted the email address... and no the email is still not working... We seem to be getting nowhere...
Ok I am desperately trying to send you several posts here and this system is just blocking me. When you signed up did you give them a working email or just the one thats giving you trouble
I would like to swith this over to question and answer so the system can no longer block me but dont know if you will be able to acess the email or if you can work with me on a different computer to fix the mac please let me know.
I am receiving emails no problem! I just can't send them... I don't seem to be having any problems with Firefox though. How does question and answer work?
Are you still there - my screen is showing Expert is : offline !
Yes I am still here
Question and answer is a back and forth process you ask I answer all through email. You said you can recieve but is there another computer near you to reply to me before I switch this???
Yes, I have a laptop that I can answer you from
Awesome let's try that please look for the email.
Are you with me now???
Ok quite a few things I was trying to post to you didn't go through there is a system problem so this will eliminate that. If I repeat myself I am sorry I am not sure what actually went through so I was asking if this was the program you were running: http://www.dnschanger.com/ and it found my program you downloaded. or were you running this mine and it found it on your system? Next I am trying to get you the correct MAC version of the root kill so you can run it to remove all pieces that may be hiding in your system. Did the virus program you ran find anything other than tracking cookies? Thanks
Hi are you still working on this? Are you there?
Yes this software was originally designed for windows operating systems and has been modified for mac (the file extension is not .exe). It is safe to try and the worst thing that can happen here is it will not run if it isn't compatible. Try the download and let me know if it will run for you and I will search for another just incase it doesn't allow you to run it ok.But it should run. Thanks
Wow I can't believe it didn't find what we are looking for! But it did eliminate a huge amount of very bad trojan possibilities. So please read this whole post and follow the steps I give and when it is done please shoot me a reply remember not to hit accept unless it fixes your email issue. I have to step out but will return in an hour an a half.
Ok this is a very detailed article of the virus I believe you have here please take a look at it: http://www.macworld.com/article/49459/2006/02/leapafaq.html and it recommends you update your anti virus software. You didn't mention which one you are using or if you have any installed. I know you have run clam which is a scanner not anti virus software. So let me know if you are using any of the three here: If you use Sophos Anti-Virus, Symantec's Norton AntiVirus, or Intego's VirusBarrier X4, and if you don't have one on your system, I would recommend Sophos anti-virus which you can get to to download by clicking the link in blue. But before you change or add anything else please download this removal program for mac to remove virus/trojan here: http://download.cnet.com/Bye-Leap-A/3000-2239_4-90424.html?tag=mncol;7
Use the green download button on the left and download it and follow the prompts to run it. After this is complete download and install your sophos software and you should be all set here ok. I would also like to ask you to uninstall the following: Mac scan, Protect mac, and the rootkit hunter I gave you. You will no longer need this software. :)
Now after you have done all in this post please try to send yourself an email and see if the virus is gone if it is please hit accept for me and if after all this you still can't get an email to send just shoot me a reply and I will continue to help. You are doing great by the way!!! Killing viruses can take some time but your almost there! Let me know how you do by shooting me a reply. I will be offline for an hour an a half I have to go pick up my little one from school but will sign right back in to see how you are doing ok. Thanks talk to you in a little bit Denise
Hi I am back and read your post, I was under the impression you wanted to fix your virus that has stopped your email out-going side from the infected email you opened sorry.
So let's fix your settings and update your apple mail software.To fix your settings and ports for email please follow this set of instructions:
And if this doesn't work you can download the update for your apple mail like this which includes pictures and steps:
Getting updates immediately (Mac OS X v10.3 or later)
Attachments are only available to registered users.
You can repeat these steps to see if more updates are now available. Because some software updates are prerequisites for others, you may need to repeat these steps several times to complete the software update sequence.
Note: Mac OS X v10.5 and later can automatically run Software Update checks in the background and let you know when an update is available for your computer.
Getting updates immediately (Mac OS X v10.2.8 or earlier)
Now if this fixes the email issue please hit accept and if not after all we are doing please shoot me a reply tomorrow when you are ready to begin again. Thanks Denise