P0rn4Mac & 1032.dmg trojans (misspelled so it won't ****)

Question

*4mac is something very bad. I just got it. very nasty. It won't let me use time machine to get rid of it. It won't let me delete it.
I got it on an imac running up to date 10.5 leopard.
I got it from a web page that appeared on a google search result page. It appeared to be an appropriate search result, the google synopsis had my search terms in it, etc. (I was searching for "precision 165 sailboat for sale" so this can hit you on any search term.) I clicked the link. It redirected me to a page that began a download of 1032.dmg automatically. I was not asked. I did not install the disk image. Forgot about ejecting the disk image. Somewhere along the way I saw the filename "****4mac." I've googled the 1032.dmg trojan and it seems like it's a different thing than ****4mac, which is confusing. Perhaps I got both at the same time.
I got the 1032.dmg file into the trash. It would not allow me to empty the trash. I restarted. Still could not empty trash. I noticed that my time machine backup disk was turning non-stop when I tried to empty the trash, so I shut that disk off. I was then able to empty the trash.
I turned the time machine disk back on and I tried to use time machine to restore to pre-attack condition. Time machine will not work. I can see the backups but the "restore" button is greyed out and does nothing. I turned the time machine disk back off.
I went back to google and googled "**4mac." I got several results that looked helpful. I decided to read one of those pages, but for safety I decided to read google's cache of that page in case it was the virus lurking as a help link. I was wrong, even google's cache redirected me again to some kind of download page. Same deal as before, only this time it actually took over my imac, INSTALLED WITHOUT ASKING FOR MY PASSWORD, it took over the entire screen, including the menus, and showed me the **4mac gui. I held down my power button to get out of it.
Upon restart it looked like my imac was normal, but after an overnight shut down the imac was completely bricked the next morning. I unplugged the imac for 4 hours, then it started up normally again.
I bought MacScan from SecureMac. I ran it earlier today without it finding anything (backup disk still turned off). Today I tried running MacScan again and it said that updates were available, so I updated MacScan and I am running it again now.
That's all I know at this time. As far as I know my imac is still infected. I plan to let MacScan run to completion. I'll then try turning the backup disk on and running it again.
I'll post again if I learn more.

Answer 1

1023.dmg is the DNS changer trojan. That's the one that was making the rounds a few months ago. Since it changed DNS settings, the user could be redirected to further malicious sites despite entering correct addresses in the browser, or clicking on legitimate links. To be installed, it did require user intervention, requiring a user to i) run the installer, and ii) provide an admin password.
However, since that trojan originally came out, a privilege escalation vulnerability came to light so that any trojan potentially wouldn't require a password. The installer still was required to be run, however. This vulnerability was patched with the latest security update (2008-005) but if the OP is still on 10.5.2, it is possible that they are still vulnerable, and that the trojan has been modified to take advantage of the privilege escalation.
So 1032.dmg could be a typo, or a new revision...
Edit: there are several DNS Changer removal tools on the internet. Since I haven't used any of them I don't want to endorse any, but it might be worth trying one out. Of course, search and download from a "clean" machine or else something worse might end up being installed...