Author Topic: Mac IP address on CBL Blacklist for Pushdo Cutwail Zeus or Spyeye Botnet  (Read 4287 times)

0 Members and 1 Guest are viewing this topic.

Offline Paint Horse Mom

  • Newbie
  • *
  • Posts: 2
Can a Mac be infected with Pushdo??  Any suggestions would be sincerely appreciated! 

My Mac IP address is blacklisted on zen.spamhaus, I2.apews.org, and pbl.spamhaus.  The Blacklist message says that my IP address is listed in the CBL because it is infected with, or NATing for a machine infected with, Pushdo - usually associated with the Cutwail Span Trojan as a part of a Zeus or Spyeye Botnet detected by DDOS traffic to a web server.

The same night that I learned of the blacklist, I had used an old HP to access the internet via my AT&T broadband wireless card just long enough to update the antiviral software.  The antiviral found two viruses on the HP, so I assumed that the problem related to the old HP.  I turned off the HP, disconnected the wireless device, and thought the problem was solved.  Just to be safe, I downloaded Avast 7.0 for Mac, free version. 

Now, I am burning through my allocated MB on my AT&T Elevate 91-AE broadband wireless card (my only internet service option available) at an alarming rate.  Last month, my bill was huge!  I spoke with an IT guy at AT&T who said that I am downloading huge chunks of data.  He said there is no operating system on the broadband wireless card that could be infected with Pushdo.  He suggested that my software might be updating itself.  I disabled the Acrobat Reader self-updating, and have looked at all of my other software, trying to find a culprit.  I'm still burning through the data transfers.

I thought I had figured out how to identify my IP address on my Mac, and I used whatismyipaddress.com to automatically detect my IP address and see that it is still blacklisted.  The IP address according to the Mac is a 192.168.x.x ("Wifi is connected to Elevate-91A3 and has the IP address 102.168.. . .), but the IP address detected by the web site and blacklisted is a 166.147.xxx.xxxx address.  (As you can tell, I am NOT NOT NOT IT savvy!)

Can a Mac even have a Pushdo virus?  I'm running the Avast scan again.  Does anyone have any other suggestions?  Thank you very much for listening to my story!




Offline specimen9999

  • Sr. Member
  • ****
  • Posts: 349
Pushdo is Windows only.

I assume you connect to the internet via a router, and you connect to this router via wireless.

Maybe someone else is in your network, meaning some other computer is connecting to the same router.

Offline Paint Horse Mom

  • Newbie
  • *
  • Posts: 2
That's a relief!!!!!!!  Thank you for your response!

Sorry I wasn't clear in providing info.  The broadband wireless device actually is the router.  It's the same device you would use for a laptop while traveling, because we do not have access to Comcast (too far out in the country).  The Mac is the only computer in the house other than the disconnected and powered-off HP.  I can see how many devices are connected to the router from its control panel, and it's always just one device. 

I will go ahead and ask to have my IP address removed from the blacklists and keep looking for another source of data usage. 

Thanks, again!!

Offline specimen9999

  • Sr. Member
  • ****
  • Posts: 349
Why don't you just do a full system scan with Avast?
Pushdo is Windows only, but that doesn't mean you don't have a specific Mac virus.