Pop-up window with an attempt to open a URL - has anyone seen this?

Question

I was browsing a website for music lyrics when a suspicious pop-up appeared, along with a very small browser window (about an inch square on the screen). This has happened twice even though I have pop-ups blocked.
The pop-up had the Safari icon and looked like a standard mac window. The text contained the following:
<edited by host>
Antivirus 2009 will perform a quick and 100% free
scan of your computer for Viruses, Spyware and Adware.
Do you want to install Antivirus 2009 to scan your
computer for malware now? (Recommended)
There is a cancel and an OK button at the bottom.
The small browser window appears to be contacting the onlineprivatescan.com URL
I did a force-quit because I did not want to click either button.
I reset Safari, and ran the DNSChanger Removal Tool
from macupdate, but it didn't find anything. I have not loaded codecs from any websites and I had just completed the latest Apple updates for OSX, Quicktime and iTunes before this problem occured.
Has anyone seen this? Is this serious? I've never had any problems with Safari before this.

Answer 1

Mac OS X 10.4 Tiger automatically checks your downloads for malicious software and content that could harm your system or collect information from your computer. You can read more about that here:
http://support.apple.com/kb/HT2340
If you feel you need added protection, read on:
SecureMac has introduced a free Trojan Detection Tool for Mac OS X. It's available here:
http://macscan.securemac.com/
The DNSChanger Removal Tool detects and removes spyware targeting Mac OS X. Called DNSChanger Trojan and also known as OSX.RSPlug.A Trojan Horse, the software attacks users attempting to play a fake video file.
Upon attempting to play the video, the victim receives the following message:
“Quicktime Player is unable to play movie file.
Please click here to download new version of codec.”
Upon running the installer, the user's DNS records are modified, redirecting incoming internet traffic through the attacker's servers, where it can be hijacked and injected with malicious websites and pornographic advertisements. The trojan also installs a watchdog process that ensures the victim's DNS records stay modified on a minute-by-minute basis.
SecureMac's DNSChanger Removal Tool allows users to check to see if the trojan has been installed on their computer; if it has, the software helps to identify and remove the offending file. After a system reboot, the users' DNS records will be repaired.
There may be other ways of guarding against Trojans, viruses and general malware affecting the Mac. A white paper has recently been published on the subject by SubRosaSoft, available here:
http://www.macforensicslab.com/ProductsAndServices/index.php?mainpage=document_general_info&cPath=11&productsid=174
Also, beware of MacSweeper:
MacSweeper is malware that misleads users by exaggerating reports about spyware, adware or viruses on their computer. It is the first known "rogue" application for the Mac OS X operating system. The software was discovered by F-Secure, a Finland based computer security software company on January 17, 2008
http://en.wikipedia.org/wiki/MacSweeper
On June 23, 2008 this news reached Mac users:
http://www.theregister.co.uk/2008/06/23/mac_trojan/
More information on Mac security can be fund here:
http://macscan.securemac.com/
More on Trojans on the Mac here:
http://www.technewsworld.com/story/63574.html?welcome=1214487119
The latest news on the subject, from July 25, 2008, is:
Attack code that exploits flaws in the net's addressing system are starting to circulate online, say security experts.
The code could be a boon to phishing gangs who redirect web users to fake bank sites and steal login details.
In light of the news net firms are being urged to apply a fix for the loop-hole before attacks by hi-tech criminals become widespread.
Net security groups say there is anecdotal evidence that small scale attacks are already happening.
Further details here: http://news.bbc.co.uk/2/hi/technology/7525206.stm
You should also read what a major contributor called tacit has to say here:
http://tacit.livejournal.com/238112.html