BT Home Hub, a Mac and a virus

Back on the 23rd Feb 2007 I post a piece on setting up a BT Home Hub with a Mac (the earlier post). Well, all has been going well, except for the occasional virus alert.

The other morning I received a call from company I had helped to set up their BT Home Hub office. Now, it should be pointed out that they only use Macs on their network. And the call went:

Them: “I have a virus on my Mac!!!”
Me: “What? How? What? How do you know? What makes you think that?”

(Meanwhile, I am racking my brain trying to think what is happening.)

Them: “I have a message on the computer screen saying we have a ‘blaster’ infection”

At this point I was very confused as ‘blaster‘ is a Windows virus, and what would it be doing on a Mac?

I got the client to take a screen shot (shift-Apple key-3), and to send it to me by email. And this is what I received (click to see a larger version):

It seems to be from BT, odd web-address though.. a quick ‘whois’ showed that 2wire.net is registered in California, US. This was beginning to look like a ‘spoof’ site or page.

Odd…

Had the Mac picked up a virus? Had the browser homepage been reset? Had BT been hit with a virus/problem? Had the route been ‘got at’?

Next I got the page source code (html) for the page sent. It all seemed to check out. The links on the page seemed legitimate and to point to BT servers. The mystery deepened.

As I was talking to the client and explaining what I had found, and how this 2wire.net address looked odd, but the page seemed fine, he said: “Well, 2wire do make the wireless router”…. The penny dropped. This must be some sort of ‘alert’ page sent by the makers of the router, 2wire, when one of their routers detects a suspected virus or problem… So, based on that assumption I suggested that the ‘Select this box to stop seeing this warning in the future’ be checked and the ‘Continue’ link clicked. That did the job – the page vanished, and was replaced ‘Page not found (404)’ at BT.

The problem now solved the client was able to get back on the net and continue using his virus free Mac.

Update 17 Mar 2007 10:26:31: Late yesterday afternoon I received another call saying the ‘virus page’ is back. Again we checked the ‘Select this box to stop seeing this warning in the future’, and clicked ‘Continue’ – hopefully this will be the last we see of the page…