Could we have malware on our Mac??

October 21, 2007 6:30 PM

Browser hijack- on a MAC?! Both Firefox & Safari on our iBook will only access a page that says, "Welcome to Comcast" and wants us to "Click here to install". We have internet service with AT&T and my PC on the same network is working fine.

You can type any URL in the address bar and it's not redirecting (it'll show www.metafilter.com for example) but the page only displays the welcome to Comcast message. I've found two other reports of this happening on a Mac via Googling, but no answers are found in either thread. (There is a lot of "no, you can't have malware, dood!" however.)

We restarted the machine and it still happened, but the Finder buttons quit working as well. After force restarting it I'm only getting the gray screen & spinny thing.

Does anyone know what this could be? None of our usual Mac gurus have ever heard of anything like this and it seems pretty obvious that it has messed up the machine.

posted by Mamapotomus to computers & internet (14 comments total)

If you are using wireless internet, are you sure the iBook is connecting to the correct access point?
posted by Loto at 6:38 PM on October 21, 2007

How are you connected to the net? Is your AT&T service DSL or cable? (My cable internet used to come from AT&T, before it got sold or spun off to Comcast, several years ago.)

How are you connected to it -- via a modem and an ethernet cable going to it, or a wireless base station, or what? As Loto says, if it's wireless, make sure you are connected to the right base station, not your neighbor's!
posted by xil at 6:44 PM on October 21, 2007

Might want to also verify that you're using the right DNS servers for your AT&T connection (if they're hard-coded in). My money's on the wrong access point though.
posted by bizwank at 6:46 PM on October 21, 2007

After force restarting it I'm only getting the gray screen & spinny thing.

This doesn't sound good. What was that about the Finder buttons not "working as well"? Try booting with a MacOS X installer CD/DVD in the drive and see if it will start-up.

My first thought re: the Comcast business was what everyone else has suggested, about ensuring that you are connected to the right access point and not a neighboring one. However, actually getting the iBook to boot obviously takes first priority.

Also, I am not aware of browser hijacking malware that would do this to your Mac, d00d.
posted by mumkin at 6:55 PM on October 21, 2007

yes, make sure you are connecting to your access point and not someone else's. a call to at&t should sort you out.
posted by thinkingwoman at 7:11 PM on October 21, 2007

You are in the walled garden. Comcast has a special place on the Internet for modems that lose their provisioning data.

It's not the computer, it's Comcastic!

Call them. They will reprovision your modem and all will be well.
posted by disclaimer at 7:19 PM on October 21, 2007

To be clear: Comcast's network doesn't believe your modem is a permitted device. Until you call Comcast and get the modem fixed, all your modem can do is redirect all traffic to that specific address, because Comcast can't trust the modem on its network until it has been "reprovisioned". The other issues you are having are very likely caused by the modem as well.
posted by disclaimer at 7:24 PM on October 21, 2007

Just type cancel comcast into google!

But seriously, you said you had internet through AT&T. Are you sure it's not through comcast? The AT&T name is used by TONS of different companies, some of them completely seperate. For example one company named AT&T used to be called Cingular, and then there are all of these. And there could be some other thing going on where comcast is providing the pipes.

If you're using DSL, then you'll have both a DSL provider and an internet provider (which may be the same company).

Once, I lost my internet connection, but my modem said it was connected. Turns out my apartment switched to it's own internal DSL system so my modem connected to it, Qwest didn't see me at all. I had to call some random-ass local ISP from Ames, Iowa to disconnect me from their system.
posted by delmoi at 7:31 PM on October 21, 2007

You can only see comcast.com when your cable modem is considered new and unknown to the network. Sounds like something might have changed either on your end or their end (they lost your customer record?) but call Comcast and they should be able to straighten it out.
posted by mathowie at 8:13 PM on October 21, 2007

ummm... did people not read that the submitter said he/she has AT&T???

if i was getting that comcastic page, first thing i would do is make sure some 'auto config' crap isn't running on startup... go to System Preferences, select Accounts, click the current user's name on the left and then click the Login Items tab... see anything there relating to comcast? if so, select it and then click the - button.

next thing to do is verify network settings... Open System Preferences again and select Network. these all depend on how this ibook is connecting... are you using an ethernet cable or are you connected via wifi, are you plugging directly into the modem or is there some sort of router handing out dhcp? for now, just set the Location to Automatic, then click either Airport or Built in Ethernet and come back and tell us whats posted in the TCP/IP settings...


.//chris
posted by hummercash at 8:46 PM on October 21, 2007

At this point, we need some standing questions answered. Namely, whether the iBook is connected with a wire or wirelessly.
posted by pmbuko at 9:09 PM on October 21, 2007

Check to see if your browser, or your Mac overall, is set up to use a proxy. You may be using AT&T to access a Comcast proxy, which is then preventing you from accessing anything else. Given that another computer you own is not having any problems accessing other internet sites when using the same network connection, that would be my first guess as to what's wrong.
posted by Steven C. Den Beste at 9:22 PM on October 21, 2007

Third (or fourth) that you are connected to the wrong wireless network.. or perhaps you are connected via ethernet, but don't realize you are also connected to your neighbors wifi.

Doesn't add up that this is the cause of your other problems though... shouldn't be related.. unless you have weird software installed that's waiting on a working internet connection to boot up properly.
posted by TravellingDen at 10:25 PM on October 21, 2007

I think it would be informative to compare the results of a traceroute from your PC that works to the results of a traceroute from your Mac that doesn't. Try tracing to google.com; it's as good a destination as any for this purpose. If you can't get a DNS lookup, it's [72.14.207.99].
posted by Steven C. Den Beste at 12:07 AM on October 22, 2007