New To Mac-Forums?

Welcome to our community! Join the discussion today by registering your FREE account. If you have any problems with the registration process, please contact us!

Get your questions answered by community gurus Advice and insight from world-class Apple enthusiasts Exclusive access to members-only contests, giveaways and deals

Join today!

 
Start a Discussion
 

Mac-Forums Brief

Subscribe to Mac-Forums Brief to receive special offers from Mac-Forums partners and sponsors

Join the conversation RSS
Switcher Hangout The place for switchers to discuss their new machines, and how to work with OS X. General support can be had here for newbie stuff, like "How do I restart my new iMac?" :)

Help getting rid of Epoclick malware


Post Reply New Thread Subscribe

 
Thread Tools
Brandonn

 
Member Since: Nov 11, 2010
Posts: 11
Brandonn is on a distinguished road

Brandonn is offline
Hey guys,

I'm new, first post so please take it easy on me!

I've got the Epoclick.com bug on my MacBook Pro and I can't figure out how to get rid of it. All it is, is a pop up window that comes up completely randomly when I click links browsing through the internet, Google also comes up with some pretty funky searches not related to what I myself am searching. I've come to the end of my knowledge on what to do and now seek help in finding it as this is my first Mac and I'm only about 2 months into it. I've done a search but came up empty on this thing..

I believe it came when I downloaded the Frostwire filesharing program, so that should help narrowing down the search.

I've tried the following:
- cleared/reset Safari's cache/history etc etc..
- reinstalled Safari
- removed/reinstalled Frostwire
- Installed iAntiVirus and did a search, passed everything.
- Installed Apple's TechTool Deluxe off the Protection Plan CD, ran diagnostics and it passed everything except for the last bit.. 'Volume Structure'
- Tried browsing through different files/folders to find any suspicious programs

I'm running Mac OS X 10.6.4

I've reached the end of my knowledge on what to do and am trying to avoid a trip to the Mac store. I'm fairly computer literate in the Windows world so any help or suggestions would be greatly appreciated!!

-Brandon
QUOTE Thanks
dtravis7

 
dtravis7's Avatar
 
Member Since: Jan 04, 2005
Location: Modesto, Ca.
Posts: 27,855
dtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond repute
Mac Specs: iMac 2.4 C2D 10.10.1, iMac 2.16 C2d 10.6.8, Macbook2007 10.8.4, Mac Mini 10.8.4, iPhone 3GS Note 8!!

dtravis7 is offline
Apple - Support - Discussions - A mac virus? ...

Ignore the stupid post that it's a Virus. It's DNS Redirection Malware. Read very carefully about 4-5 posts down. It seems to change the DNS settings in the router and NOT the computer. A person tried a router reset and all his systems, both Mac and PC are fine. It was the router.


Give it a read and a try.

Also do you have another computer there hooked up to the same router? See if that does the same thing. The user in that thread, all his systems did what you are experiencing.
QUOTE Thanks
Brandonn

 
Member Since: Nov 11, 2010
Posts: 11
Brandonn is on a distinguished road

Brandonn is offline
Dang, out of ALL the things I read on Epoclick, not one of them mentioned it could be DNS related..

The only other thing I have connected to my router is my Xbox, maybe it came from there? who knows.

I removed power to the router to let it reset, also reset it via the button. Then reset the DNS preferences on my Xbox, we shall see if that fixes the problem!

Thanks!
QUOTE Thanks
dtravis7

 
dtravis7's Avatar
 
Member Since: Jan 04, 2005
Location: Modesto, Ca.
Posts: 27,855
dtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond repute
Mac Specs: iMac 2.4 C2D 10.10.1, iMac 2.16 C2d 10.6.8, Macbook2007 10.8.4, Mac Mini 10.8.4, iPhone 3GS Note 8!!

dtravis7 is offline
Do keep us posted and let us know if that solves your issue.
QUOTE Thanks
Brandonn

 
Member Since: Nov 11, 2010
Posts: 11
Brandonn is on a distinguished road

Brandonn is offline
This did not solve my issue.

I'm still getting the Epoclick.com pop-ups and my google searches get to the page i'm looking for, then switch to alternate ads.

QUOTE Thanks
dtravis7

 
dtravis7's Avatar
 
Member Since: Jan 04, 2005
Location: Modesto, Ca.
Posts: 27,855
dtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond repute
Mac Specs: iMac 2.4 C2D 10.10.1, iMac 2.16 C2d 10.6.8, Macbook2007 10.8.4, Mac Mini 10.8.4, iPhone 3GS Note 8!!

dtravis7 is offline
Will search some more. I have a feeling you click yes on some thing and allowed a DNS changer trojan to install. This is just a guess, but it's starting to look like that could be the issue. Did anything pop up asking for permission to install anything or ask for your password?
QUOTE Thanks
Brandonn

 
Member Since: Nov 11, 2010
Posts: 11
Brandonn is on a distinguished road

Brandonn is offline
The last two and most recent things to ask me for my password to install was itunes' update and Frostwire. Facebook's video chat/message thing asked me to use my video device but I don't think that had anything to do with it.

I downloaded Frostwire from http://download.cnet.com/mac so I assumed it was a safe location to do so... This is the only place I can think/remember it to come from.
QUOTE Thanks
Brandonn

 
Member Since: Nov 11, 2010
Posts: 11
Brandonn is on a distinguished road

Brandonn is offline
Quote:
Originally Posted by chas_m View Post
Have you checked the DNS numbers on BOTH your router AND your Mac? You haven't made that clear.

On your Mac, you can access this via the System Preferences -> Network -> Advanced.

The router most people access via their web browser, and every router has a slightly different way of finding that info.
My apologies, I did not check my stored DNS server addresses on my Mac, I don't know why.. I guess I wanted to rule out the router first? no clue.. ha

Anyways, I do have 2 stored DNS sever addresses in the left hand column under 'DNS Servers', they are grayed and I am unable to click on them to delete or edit them, though I do have the option to add another one. On the right under 'Search Domains' I have simply listed 'Home', again I am unable to click on it to edit/delete.

Also, I don't know how to check my DNS numbers on my router.. it's a Verizon FiOS setup ((if your unaware, it's the only thing compatible with Verizon's Fiber Optic -FiOS- network, they issue it to you)), can't really get into it like my old Linksys one I had.

I hope I've laid my situation out clear enough to you as I'm now lost.. haha. If you need a screenshot or the DNS addresses just let me know, I'm all ears for what to do next!

EDIT -- My xbox is using the same two DNS Servers listed in the same order as my Mac, I don't know if this helps..
QUOTE Thanks
chscag

 
chscag's Avatar
 
Member Since: Jan 23, 2008
Location: Fort Worth, Texas
Posts: 40,966
chscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond reputechscag has a reputation beyond repute
Mac Specs: 27" iMac i5, 3.2 GHz, iPad 3, iPhone 5c, 3 iPods, Yosemite

chscag is online now
Quote:
Also, I don't know how to check my DNS numbers on my router.. it's a Verizon FiOS setup ((if your unaware, it's the only thing compatible with Verizon's Fiber Optic -FiOS- network, they issue it to you)), can't really get into it like my old Linksys one I had.
You can't check the DNS server addresses on the FIOS router as it's static and can not be changed by accessing the router menu. The only way you can change the DNS server settings is as chas_m indicated.

I don't know which router Verizon has issued you (I have the ActionTech), however, you should be able to access the router setup menu by typing in this address: 198.162.1.1 to your browser.

You'll have to enter your userid and password that Verizon issued to you when they installed the router.
QUOTE Thanks
Brandonn

 
Member Since: Nov 11, 2010
Posts: 11
Brandonn is on a distinguished road

Brandonn is offline
Quote:
Originally Posted by chscag View Post
You'll have to enter your userid and password that Verizon issued to you when they installed the router.
I believe I have the same router as you, ActionTec MI424WR? The IP address you sent me may have been incorrect, it didn't bring anything up, but rather just asked for a ID/PW to get in. I tried it.. didn't work. Are you sure that is correct?

I searched around a bit, found and went to http://192.168.1.1/ and it brought up and official Verizon page. I typed in my ID/Password I use to pay the bills and got no joy. Said I was incorrect. I'm unaware of any other Usernames/Passwords they gave me when they installed FiOS unless I can find it elsewhere...?

stuck! haha
QUOTE Thanks
dtravis7

 
dtravis7's Avatar
 
Member Since: Jan 04, 2005
Location: Modesto, Ca.
Posts: 27,855
dtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond repute
Mac Specs: iMac 2.4 C2D 10.10.1, iMac 2.16 C2d 10.6.8, Macbook2007 10.8.4, Mac Mini 10.8.4, iPhone 3GS Note 8!!

dtravis7 is offline
Usually routers have a default username and password to login unless the user changes them. I wonder if Verizion changed it or left it stock?

chscag, since you have the same router, can you help him?
QUOTE Thanks
Brandonn

 
Member Since: Nov 11, 2010
Posts: 11
Brandonn is on a distinguished road

Brandonn is offline
EUREKA!

dtravis7, for future reference 'admin' and 'password1' or verizon1' works to get you in.

Would it be safe for me to start posting up the DNS servers my router/mac is using?
QUOTE Thanks
dtravis7

 
dtravis7's Avatar
 
Member Since: Jan 04, 2005
Location: Modesto, Ca.
Posts: 27,855
dtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond reputedtravis7 has a reputation beyond repute
Mac Specs: iMac 2.4 C2D 10.10.1, iMac 2.16 C2d 10.6.8, Macbook2007 10.8.4, Mac Mini 10.8.4, iPhone 3GS Note 8!!

dtravis7 is offline
I grabbed the manual to the MI424WR. Turns out the first time you access the router with 192.168.1.1 a password setup screen comes up and asks for a new username and password. If you are not getting that screen, someone at some time configured it and set up a username and password. Do you have all the paperwork that Verizion left? Check for anything that might say router username/password.

Here is a URL to the manual in case it will help.

http://support.actiontec.com/doc_fil...10.11.x_v6.pdf
QUOTE Thanks
Brandonn

 
Member Since: Nov 11, 2010
Posts: 11
Brandonn is on a distinguished road

Brandonn is offline
I posted juuust before you did, but I found a way in, I used the default Username/PW to get in and changed it to my own.

The DNS servers that my Mac lists are matching up with my IP address and DNS Server numbers my router is using. I have the option to restore the defaults which will make all my devices request new IP/DNS servers.. temptingg, but I'm not sure what to do or look for from where I'm at now..

Thanks for everything so far guys!
QUOTE Thanks
jgusto31

 
Member Since: Nov 09, 2010
Posts: 16
jgusto31 is on a distinguished road

jgusto31 is offline
Hi,

Did you tried any malware removal software like Malwarbytes etc. I think that may help to get rid of this.
QUOTE Thanks

Post Reply New Thread Subscribe


« Switching | New to mac and have small problem »
Thread Tools

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off
Forum Jump

Similar Threads
Thread
Thread Starter
Forum
Replies
Last Post
Official antivirus, malware, and firewall FAQ schweb Switcher Hangout 120 07-28-2011 05:27 PM
Macs and Malware 101 capital2 Switcher Hangout 8 01-07-2010 04:44 PM
Mac malware infection K515 OS X - Operating System 5 12-07-2009 02:09 AM
UPS malware maurajbo Running Windows (or anything else) on your Mac 2 06-19-2009 04:22 PM
success getting rid of stuck pixel!! altori1 iPod Hardware and Accessories 2 08-24-2007 10:32 AM

All times are GMT -4. The time now is 05:22 PM.

Powered by vBulletin
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
X

Welcome to Mac-Forums.com

Create your username to jump into the discussion!

New members like you have made this community the ultimate source for your Mac since 2003!


(4 digit year)

Already a member?