AFansHub

I seem to have a virus on my Mac and fir.im is redirected to the lottery site

by Poster Apr 17, 2019 10
Can't upload pictures? I also recorded a gif. After opening fir.im on chrome, it will be redirected to 5520666.com. It used to be all kinds of messy gambling websites. I used ADBlock to ban all the elements on them. Now I have replaced it with a new one. That's the one above. Already checked and killed using Malwarebytes, but it didn't work. ``` MacOS 10.14. 4 Chrome 73.0. 3683.103 (official version) (64-bit) ```

Replies

  • Anonymous2964 Apr 17, 2019
    Look at DNS or something, it may also be DNS hijacking
  • Poster Apr 17, 2019
    @ Anonymous2964 is not very familiar with this area. I used ` nslookup ` to indicate that it is normal. I don't know if there are other methods. Only mine is the computer in the same office that will have this problem
  • Anonymous2965 Apr 17, 2019
    Try another dns
  • Anonymous2966 Apr 17, 2019
    Take a look at Chrome's plugins
  • Poster Apr 17, 2019
    @ Anonymous2966 I turned off all the plug-ins for Chrome, and it's still the same
  • Anonymous2967 Apr 17, 2019
    What about the default browser?
  • Anonymous2968 Apr 17, 2019
    After taking a look, except that you can directly access http at the beginning, otherwise all web links on this page are https. It is best to open F12 and see what the specific situation of the request is
  • Anonymous2969 Apr 17, 2019
    It is impossible for a virus to hijack your website. Other websites will also be caught. You have a high probability of dns pollution. Turn on the hotspot on your mobile phone and visit the computer. After looking at the router, the operator or the local machine has a problem. Check whether the host file has been changed. If it has not been changed, clean up the dns and change the dns source
  • Poster May 10, 2019
    @ Anonymous2967 default safari is the same @ Anonymous2969 Thank you for your reply. The mobile hotspot can be accessed normally. Don't change the host file. Don't redirect after cleaning it with dscacheutil-flushcache.
  • Poster May 10, 2019
    @ Anonymous2965 posted, replaced Ali's dns, and the above problem no longer repeats