How do I remove what appears to be malicious cached javascript? I was recently using someone else's iMac and came across some rather strange behaviour.  Searches (from google and yahoo at least, I didn't test other search engines) were being redirected.  After searching, then clicking on a link in the search led to a new window being opened with some redirected link in it (the redirection went through a few variations before settling on the final link).  Going back to the original window and clicking on the link a second time led to the correct site.  This happened with both Safari and Firefox (I didn't test other browsers).

Searching on the internet suggested that this was a piece of malicious code, but I couldn't find it in the process lists.  The key symptoms were:


Turning off javascript removed the problem.
Creating a whole new account removed the problem (for the new account).
Booting in safe mode did not remove the problem.
There was no obvious process that the original account (with the problem) was running that wasn't being run by the new account (without the problem).


So guessing that there was some malicious javascript somehow cached on the machine, I tried deleting everything that looked cache-like (in particular, in ~/Library/Cache - if I remember right).  That seemed to fix it, but the owner told me that the next day it was back again.  I couldn't find a "get rid of all temporary files, no I really mean all temporary files" command.

My real question is: can someone identify the problem and tell me what steps to tell the machine's owner to do to get rid of it?

(Note that I'm no longer in front of that machine, unfortunately, so further diagnostic tests will be tricky; add in to the mix the fact that the owner is not a computer ... nerd.)

Perhaps a more answerable question (if the above isn't answerable) is: what steps are needed to clean out temporary files from a user's area on an apple?  I'd prefer concrete steps rather than "download (and pay for) iKillTempFiles".

Lastly, I don't know the versions of the software involved, but I suspect they were all fairly old.
Sounds like a DNS changer of sorts.
could maybe try running a scan with clamXav if your not too familiar with what files are legit and what ones are malicious.

where I found the dodgy DNSchanger file and instal.pkg
~/Library/Internet Plug-Ins
/Library/Receipts

Only clearing the cached files wont get rid of malware. It might only do half the job.

Here are some links, feel free to use them.. or not. :)

http://www.howtogeek.com/howto/38793/how-to-switch-mac-os-x-to-use-opendns-or-google-dns/ - When trouble shooting the issue, I noticed that the auto DNS settings in sys prefs were different to what our routers DNS address was.

Open DNS address:    208.67.222.222 &amp; 208.67.220.220
google DNS addres:   8.8.8.8 &amp; 8.8.4.4

http://www.macupdate.com/app/mac/15850/clamxav/ - read up on some of the user feedback before you try.


bottom line is - be aware of what your are accepting and installing on your machine.