Safari for Macbook Pop-Up Problems

Question

I have a Macbook Pro that I got less than a year ago, and I recently started having Safari problems. Whenever I am using safari, I get random pop-ups for things like promotional websites that say they're giving away free stuff, Mackeeper, and other websites I have never heard of much less been onto. Also, I seem to have a random shopping helper enabled as well. Whenever I am viewing a product on a website, there is a little bar underneath where the pictures of the items are, and they have pictures of similar items in the boxes. When I click on it, it takes me to an Apple Support Desk that offers free PC Diagnosis. Their number is 855-214-9613, but I do not at all believe that it is a real Apple service. Another shopping helper that has shown up is a green bar in the bottom right corner that has a box attached to it that shows products that it thinks I will like based on my search. There's a button with 3 dots on it at the top right of the box, and it has a disable button where you can disable it for different time periods up to a day. I do that every time it shows up, and it says "[pop-up name] has been disabled" but then the next time I go to search something, it is there again. When I do a Google search on Safari, there is always a lis of about 6 items that are purely irrelevant. There's a hello section of 3 of them that are "Ads related to [search]," and another 3 that are typically from whoisbest.com, grocery saving.com, and sale stores.com. I'd like these to be gone too because it is very annoying to have those block the actual search results that I want. I've already done a Hardware Test and reset Safari several times. I updated Safari to 7.0.4 already, but nothing fixes it. I already have pop-up blocker enabled and it doesn't stop the problem.

Answer 1

You may have installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
          Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination  command-C. In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.