Annoying adware
I read through a bunch of threads regarding the removal of different kinds of malware/adware, but none seemed applicable to my current situation (maybe they were too old?). In an attempt to be proactive, I ran a diagnostic test that other people were posting, hoping that someone could make sense of my results (see below) and tell me how to remove the adware that's terrorizing my Google Chrome at the moment. Anyone?
Boot Mode: Normal
Model: iMac12,2
RAM details
BANK 0/DIMM0:
Size: 2 GB
Speed: 1333 MHz
Status: OK
Manufacturer: 0x02FE
BANK 1/DIMM0:
Size: 2 GB
Speed: 1333 MHz
Status: OK
Manufacturer: 0x02FE
BANK 0/DIMM1:
Size: Empty
Speed: Empty
Status: Empty
Manufacturer: Empty
BANK 1/DIMM1:
Size: Empty
Speed: Empty
Status: Empty
Manufacturer: Empty
User diagnostics
2015-01-12 Finder crash *
2015-01-25 com.apple.qtkitserver crash
* Code injection
Kernel messages
Jan 20 23:14:47 PM notification timeout (pid 9455, Mail)
--- last message repeated 20 times ---
Loaded extrinsic kernel extensions
com.logmein.driver.LogMeInSoundDriver (1.0.0)
Extrinsic daemons
com.xrite.device.xrdd.plist
com.oracle.java.Helper-Tool
com.microsoft.office.licensing.helper
com.google.keystone.daemon
com.v.helper
com.adobe.SwitchBoard
com.adobe.fpsaud
Extrinsic agents
com.paragon.ntfs.auth
com.wacom.pentablet
com.seagate.SeagateStorageGauge.plist
com.oracle.java.Java-Updater
com.logmein.logmeingui
com.hp.messagecenter.launcher
com.hp.help.tocgenerator
com.hp.devicemonitor
com.google.keystone.system.agent
com.v.agent
com.adobe.CS5ServiceManager
com.spotify.webhelper
com.adobe.ARM.UUID
com.adobe.ARM.UUID
launchd items
/Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist
(com.adobe.AAM.Startup-1.0)
/Library/LaunchAgents/com.adobe.CS5ServiceManager.plist
(com.adobe.CS5ServiceManager)
/Library/LaunchAgents/com.arcos.agent.plist
(com.v.agent)
/Library/LaunchAgents/com.google.keystone.agent.plist
(com.google.keystone.system.agent)
/Library/LaunchAgents/com.hp.devicemonitor.plist
(com.hp.devicemonitor)
/Library/LaunchAgents/com.hp.help.tocgenerator.plist
(com.hp.help.tocgenerator)
/Library/LaunchAgents/com.hp.messagecenter.launcher.plist
(com.hp.messagecenter.launcher)
/Library/LaunchAgents/com.logmein.logmeingui.plist
(com.logmein.logmeingui)
/Library/LaunchAgents/com.logmein.logmeinguiagent.plist
(com.logmein.logmeinguiagent)
/Library/LaunchAgents/com.logmein.logmeinguiagentatlogin.plist
(com.logmein.logmeinguiagentatlogin)
/Library/LaunchAgents/com.oracle.java.Java-Updater.plist
(com.oracle.java.Java-Updater)
/Library/LaunchAgents/com.seagate.SeagateStorageGauge.plist
(com.seagate.SeagateStorageGauge.plist)
/Library/LaunchAgents/com.wacom.pentablet.plist
(com.wacom.pentablet)
/Library/LaunchDaemons/com.adobe.fpsaud.plist
(com.adobe.fpsaud)
/Library/LaunchDaemons/com.adobe.SwitchBoard.plist
(com.adobe.SwitchBoard)
/Library/LaunchDaemons/com.apple.remotepairtool.plist
(com.apple.RemotePairTool)
/Library/LaunchDaemons/com.arcos.daemon.plist
(com.v.daemon)
/Library/LaunchDaemons/com.arcos.helper.plist
(com.v.helper)
/Library/LaunchDaemons/com.google.keystone.daemon.plist
(com.google.keystone.daemon)
/Library/LaunchDaemons/com.logmein.logmeinserver.plist
(com.logmein.logmeinserver)
/Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist
(com.microsoft.office.licensing.helper)
/Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist
(com.oracle.java.Helper-Tool)
/Library/LaunchDaemons/com.xrite.device.xrdd.plist
(com.xrite.device.xrdd.plist)
Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist
(com.adobe.AAM.Scheduler-1.0)
Library/LaunchAgents/com.adobe.ARM.UUID.plist
(com.adobe.ARM.UUID)
Library/LaunchAgents/com.adobe.ARM.UUID.plist
(com.adobe.ARM.UUID)
Library/LaunchAgents/com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID. plist
(com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID)
Library/LaunchAgents/com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID. plist
(com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID)
Library/LaunchAgents/com.spotify.webhelper.plist
(com.spotify.webhelper)
Extrinsic loadable bundles
/System/Library/Extensions/hp_Inkjet9_io_enabler.kext
(com.hp.print.hpio.Inkjet9.kext)
/System/Library/Extensions/LogMeInSoundDriver64.kext
(com.logmein.driver.LogMeInSoundDriver)
/System/Library/Extensions/Pen Tablet.kext
(com.wacom.kext.pentablet)
/System/Library/Extensions/Seagate Storage Driver.kext
(com.seagate.driver.PowSecDriverCore)
/System/Library/Extensions/TabletDriverCFPlugin.bundle
(No bundle ID)
/Library/Audio/MIDI Drivers/EmagicUSBMIDIDriver.plugin
(info.emagic.driver.unitor)
/Library/Internet Plug-Ins/AdobePDFViewer.plugin
(com.adobe.acrobat.pdfviewer)
/Library/Internet Plug-Ins/Flash Player.plugin
(com.macromedia.Flash Player.plugin)
/Library/Internet Plug-Ins/googletalkbrowserplugin.plugin
(com.google.googletalkbrowserplugin)
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin
(com.oracle.java.JavaAppletPlugin)
/Library/Internet Plug-Ins/LogMeIn.plugin
(com.logmein.remctrlplugin)
/Library/Internet Plug-Ins/LogMeIn.plugin/LogMeInPluginHost.app
(com.logmein.LogMeInPluginHost)
/Library/Internet Plug-Ins/LogMeInSafari32.plugin
(com.logmein.remctrlplugin)
/Library/Internet Plug-Ins/LogMeInSafari64.plugin
(com.logmein.remctrlplugin)
/Library/Internet Plug-Ins/npContributeMac.bundle
(com.adobe.npContributeMacBundle)
/Library/Internet Plug-Ins/o1dbrowserplugin.plugin
(com.google.o1dbrowserplugin)
/Library/Internet Plug-Ins/OfficeLiveBrowserPlugin.plugin
(com.microsoft.officelive.browserplugin)
/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin
(com.microsoft.sharepoint.browserplugin)
/Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin
(com.microsoft.sharepoint.webkitplugin)
/Library/Internet Plug-Ins/WacomNetscape.plugin
(com.wacom.tabletplugin)
/Library/Internet Plug-Ins/WacomTabletPlugin.plugin
(com.WacomTabletPluginLib.WacomTabletPlugin)
/Library/PreferencePanes/Flash Player.prefPane
(com.adobe.flashplayerpreferences)
/Library/PreferencePanes/Growl.prefPane
(com.growl.prefpanel)
/Library/PreferencePanes/JavaControlPanel.prefPane
(com.oracle.java.JavaControlPanel)
/Library/PreferencePanes/NTFSforMacOSX.prefPane
(com.paragon-software.filesystems.ntfs.prefpanel)
/Library/PreferencePanes/PenTablet.prefPane
(com.wacom.PenTabletSettingsPrefPane)
/Library/PreferencePanes/Tuxera NTFS.prefPane
(com.tuxera.ntfs.mac.prefpane)
/Library/QuickTime/SoundboothScoreCodec.component
(com.adobe.SoundboothScoreAudioCodec)
/Library/ScriptingAdditions/Adobe Unit Types.osax
(No bundle ID)
/Library/Spotlight/GBSpotlightImporter.mdimporter
(com.apple.garageband.spotlightimporter)
Library/Address Book Plug-Ins/SkypeABDialer.bundle
(com.skype.skypeabdialer)
Library/Address Book Plug-Ins/SkypeABSMS.bundle
(com.skype.skypeabsms)
Library/Internet Plug-Ins/CitrixOnlineWebDeploymentPlugin.plugin
(com.citrixonline.mac.WebDeploymentPlugin)
Library/PreferencePanes/Growl.prefPane
(com.growl.prefpanel)
Extrinsic shared libraries
/usr/lib/libgutenprint.2.0.3.dylib
/usr/lib/libgutenprint.2.dylib
/usr/lib/libUFSDNTFS.dylib
DNS (from DHCP): 75.75.75.75
Restricted user files: 157
Font problems: 108
Bad plists
Library/Preferences/com.apple.Safari.plist.plist
Library/Preferences/com.apple.WebFoundation.plist
Library/Preferences/com.solidstatenetworks.host.plist
Desktop file count: 23
Elapsed time (s): 297
You installed a variant of the "VSearch" trojan. Remove it as follows.
This malware has many variants. Anyone else finding this comment should not expect it to be applicable.
Back up all data before proceeding.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.arcos.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.arcos.daemon.plist
/Library/LaunchDaemons/com.arcos.helper.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/arcos
/System/Library/Frameworks/v.framework
The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Then, still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates (OS X 10.10 or later)
or
Download updates automatically (OS X 10.9 or earlier)
if it's not already checked.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
Similar Messages
-
I have an annoying adware in my safari browser. How can I get rid of it?
How can I get rid of adware in Safari?
Click here and follow the instructions, or if there’s a type of adware not covered by them on the computer, these ones. If you're willing to use a tool to remove it(you don't need to, but may find it easier), you can instead run Adware Medic; this link is a direct download.
(124073) -
How can I remove the annoying Adware of "MacKeeper"?
I have this popup problem, that really doesn't let me work on my mac.
You may have installed one or more of the common types of ad-injection malware. Follow the instructions on this Apple Support page to remove it. It's been reported that some variants of the "VSearch" malware block access to the page. If that happens, start in safe mode by holding down the shift key at the startup chime, then try again.
Back up all data before making any changes.
One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those. If Safari crashes on launch, skip that step and come back to it after you've done everything else.
If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, ask for further instructions.
Make sure you don't repeat the mistake that led you to install the malware. It may have come from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.
Malware is also found on websites that traffic in pirated content such as video. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates (OS X 10.10 or later)
or
Download updates automatically (OS X 10.9 or earlier)
if it's not already checked. -
I need help finding source of adware
I recently, and I'll admit stupidly, downloaded a file off of piratebay and now I'm plagued with annoying adware. I downloaded the file and entered my password without thinking and immediatly regretted it. This adware is causing popup banners on the sides and bottom of my screen that I cannot close, only hide. It also is highlighting random words with more pop ups attached and on some websites, wikipedia for example, every time I click somewhere for the first time on a new screen another pop up appears and opens a new tab/window. I'll attach a screen shot to help give an idea of what I mean. I have no weird extensions as far as I can tell, I've ran a scan and nothing turned up, I've deleted all cookies, and I deleted the plug in the was downloaded. My only guess is that something other than the file I meant to download went unnoticed and now its giving me ****. Any help would be GREATLY appriciated. Also I know its not DivX or genieo.
also forgot to mention the banners seem blank because I have an adblocker running because sometimes the popups are pretty vaulger. When i click to hide them I also get the annoying new tab/window pop up
-
I appear to have downloaded some very annoying adware. I'm desperate to get rid of it and need some help. It seems to be associated with www.appround.us and I can find lots of online info about this adware attacking Windows users, but nothing about Macs. It adds annoying "buttons" and load bars to the screen of both Safari and Chrome. It opens random pop-ups (even if blocker is on) and it turns random words on websites I visit into unwanted links. The messages that come up are always about updating a "Video Performer" or some other bogus software. I have tried resetting Safari and called Apple Care, but I've had no success so far. Apple Care recommend I run a virus software so I tried Dr. Web...no luck either. Sample screenshots below. Anyone able to help?
iPentax wrote:
The best advice is to Download & Install AVG
That is most definitely NOT the best advice.
First, the problem in this case was adware called Downlite (aka VSearch). I am not aware of any variant of Downlite that is detected by AVG. So AVG would be absolutely worthless at solving a problem caused by this particular adware, and probably wouldn't be much use with any other adware either.
As for actual malware, note that when I tested it in January, AVG only detected 61% of the malware samples that I threw at it. See:
Mac anti-virus testing 2014
(Fair disclosure: The Safe Mac is my site, and contains a Donate button, so I may receive compensation for providing links to The Safe Mac. Donations are not required.) -
Post my etresoft report mac desk top OSX version 10
Report generated 2 October 2014 15:30:41 NZDT
Hardware Information: ?
iMac (21.5-inch, Mid 2011) (Verified)
iMac - model: iMac12,1
1 2.5 GHz Intel Core i5 CPU: 4 cores
4 GB RAM
Video Information: ?
AMD Radeon HD 6750M - VRAM: 512 MB
iMac 1920 x 1080
System Software: ?
OS X 10.9.5 (13F34) - Uptime: 1 day 0:17:31
Disk Information: ?
ST3500418AS disk0 : (500.11 GB)
S.M.A.R.T. Status: Verified
EFI (disk0s1) <not mounted>: 209.7 MB
disk0s2 (disk0s2) <not mounted>: 478.49 GB
Recovery HD (disk0s3) <not mounted>: 650 MB
BOOTCAMP (disk0s4) /Volumes/BOOTCAMP: 20.63 GB (20.51 GB free)
HL-DT-STDVDRW GA32N disk2 : (739.6 MB)
S.M.A.R.T. Status: Verified
disk2s1 (disk2s1) <not mounted>: 44.6 MB
disk2s2 (disk2s2) <not mounted>: 43.1 MB
disk2s3 (disk2s3) <not mounted>: 41.5 MB
disk2s4 (disk2s4) <not mounted>: 38.8 MB
disk2s5 (disk2s5) <not mounted>: 39.8 MB
disk2s6 (disk2s6) <not mounted>: 45.7 MB
disk2s7 (disk2s7) <not mounted>: 53 MB
disk2s8 (disk2s8) <not mounted>: 42.6 MB
disk2s9 (disk2s9) <not mounted>: 36.2 MB
disk2s10 (disk2s10) <not mounted>: 44.2 MB
disk2s11 (disk2s11) <not mounted>: 49.7 MB
disk2s12 (disk2s12) <not mounted>: 55.4 MB
disk2s13 (disk2s13) <not mounted>: 36.8 MB
disk2s14 (disk2s14) <not mounted>: 33.6 MB
disk2s15 (disk2s15) <not mounted>: 40.3 MB
disk2s16 (disk2s16) <not mounted>: 52.6 MB
disk2s17 (disk2s17) <not mounted>: 41.8 MB
USB Information: ?
Apple Inc. FaceTime HD Camera (Built-in)
Apple Inc. BRCM2046 Hub
Apple Inc. Bluetooth USB Host Controller
Apple Inc. iPhone
Apple Computer, Inc. IR Receiver
Apple Internal Memory Card Reader
Thunderbolt Information: ?
Apple Inc. thunderbolt_bus
Gatekeeper: ?
Mac App Store and identified developers
Kernel Extensions: ?
[not loaded] com.NovatelWireless.driver.NovatelWirelessUSBCDCECMControl (3.0.13) Support
[not loaded] com.NovatelWireless.driver.NovatelWirelessUSBCDCECMData (3.0.13) Support
[not loaded] com.ZTE.driver.ZTEUSBCDCACMData (1.3.4) Support
[not loaded] com.ZTE.driver.ZTEUSBMassStorageFilter (1.3.4) Support
[loaded] com.intego.Family-Protector.safe-boot (10.7.5 - SDK 10.8) Support
[not loaded] com.mice.driver.Wireless360Controller (1.0.0d11) Support
[not loaded] com.mice.driver.WirelessGamingReceiver (1.0.0d11) Support
[not loaded] com.mice.driver.Xbox360Controller (1.0.0d11) Support
[not loaded] com.novamedia.driver.IceraUSB_MSD_Bypass (1.3.0) Support
[not loaded] com.novatelwireless.driver.3G (3.0.13) Support
[not loaded] com.novatelwireless.driver.3GData (3.0.13) Support
[not loaded] com.novatelwireless.driver.DisableAutoInstall (3.0.13) Support
[not loaded] com.option.driver.Option72 (2.15.0) Support
[not loaded] com.option.driver.OptionHS (3.26.0) Support
[not loaded] com.option.driver.OptionMSD (1.21.0) Support
[not loaded] com.option.driver.OptionQC (1.11.0) Support
[not loaded] com.vodafone.driver (3.0.9) Support
[not loaded] com.vodafone.driver.Data (3.0.9) Support
[not loaded] com.zte.driver.cdc_ecm_qmi (1.0.0d1) Support
[not loaded] com.zte.driver.cdc_usb_bus (1.0.0d1) Support
[not loaded] de.novamedia.driver.NMSamsung (0.0.2) Support
[not loaded] de.novamedia.driver.NMSmartplugSCSIDevice (1.0.1) Support
[not loaded] de.novamedia.driver.NMUSBCDCACMControl (3.2.12) Support
[not loaded] de.novamedia.driver.NMUSBCDCACMData (3.2.12) Support
[not loaded] de.novamedia.oem.vodafone.vtp.huawei.cdc (0.0.2) Support
[loaded] org.virtualbox.kext.VBoxDrv (4.2.16) Support
[not loaded] org.virtualbox.kext.VBoxNetAdp (4.2.16) Support
[not loaded] org.virtualbox.kext.VBoxNetFlt (4.2.16) Support
[loaded] org.virtualbox.kext.VBoxUSB (4.2.16) Support
Problem System Launch Agents: ?
[failed] com.apple.systemprofiler.plist
Launch Daemons: ?
[failed] com.adobe.fpsaud.plist Support
[loaded] com.google.keystone.daemon.plist Support
[running] com.intego.commonservices.daemon.integod.plist Support
[running] com.intego.commonservices.daemon.taskmanager.plist Support
[loaded] com.intego.commonservices.icalserver.plist Support
[loaded] com.intego.commonservices.metrics.kschecker.plist Support
[running] com.intego.Family-Protector.daemon.plist Support
[running] com.intego.netbarrier.daemon.logger.plist Support
[running] com.intego.netbarrier.daemon.monitor.plist Support
[running] com.intego.netbarrier.daemon.plist Support
[running] com.intego.netupdate.daemon.plist Support
[running] com.intego.PersonalBackup.daemon.plist Support
[loaded] com.intego.virusbarrier.daemon.emlparser.plist Support
[loaded] com.intego.virusbarrier.daemon.logger.plist Support
[running] com.intego.virusbarrier.daemon.plist Support
[loaded] com.intego.virusbarrier.daemon.scanner.plist Support
[running] com.intego.WashingMachine.service.plist Support
[loaded] com.macpaw.CleanMyMac2.Agent.plist Support
[running] com.parallels.desktop.launchdaemon.plist Support
[running] com.zeobit.MacKeeper.plugin.AntiTheft.daemon.plist Support
[failed] org.ijbswa.privoxy.plist Support
Launch Agents: ?
[failed] com.divx.dms.agent.plist Support
[loaded] com.divx.update.agent.plist Support
[loaded] com.google.keystone.agent.plist Support
[not loaded] com.hp.messagecenter.launcher.plist Support
[not loaded] com.intego.commonservices.integomenu.plist Support
[loaded] com.intego.commonservices.taskmanager.plist Support
[loaded] com.intego.commonservices.uninstaller.plist Support
[running] com.intego.Family-Protector.agent.plist Support
[not loaded] com.intego.netbarrier.alert.plist Support
[running] com.intego.netupdate.agent.plist Support
[loaded] com.intego.personalbackup.agent.plist Support
[not loaded] com.intego.virusbarrier.alert.plist Support
[not loaded] com.parallels.desktop.launch.plist Support
[loaded] com.parallels.DesktopControlAgent.plist Support
[not loaded] com.parallels.vm.prl_pcproxy.plist Support
[not loaded] de.novamedia.VodafoneDeviceObserver.plist Support
User Launch Agents: ?
[failed] com.apple.CSConfigDotMacCert-[...]@me.com-SharedServices.Agent.plist
[loaded] com.facebook.videochat.[redacted].plist Support
[loaded] com.macpaw.CleanMyMac2Helper.diskSpaceWatcher.plist Support
[loaded] com.macpaw.CleanMyMac2Helper.scheduledScan.plist Support
[loaded] com.macpaw.CleanMyMac2Helper.trashWatcher.plist Support
[running] com.zeobit.MacKeeper.Helper.plist Support
User Login Items: ?
Alfred 2
DeskConnect
Disk Diag
Internet Plug-ins: ?
Default Browser: Version: 537 - SDK 10.9
QuickTime Plugin: Version: 7.7.3
Safari Extensions: ?
Searchme
Amazon Shopping Assistant
Ebay Shopping Assistant
SlickSavings
Audio Plug-ins: ?
BluetoothAudioPlugIn: Version: 1.0 - SDK 10.9
AirPlay: Version: 2.0 - SDK 10.9
AppleAVBAudio: Version: 203.2 - SDK 10.9
iSightAudio: Version: 7.7.3 - SDK 10.9
iTunes Plug-ins: ?
Quartz Composer Visualizer: Version: 1.4 - SDK 10.9
3rd Party Preference Panes: ?
Flash Player Support
Time Machine: ?
Skip System Files: NO
Mobile backups: OFF
Auto backup: NO - Auto backup turned off
Volumes being backed up:
Destinations:
BOOTCAMP [Local] (Last used)
Total size: 19.21 GB
Total number of backups: (null)
Size of backup disk: Excellent
Backup size 19.21 GB > (Disk size 0 B X 3)
Time Machine details may not be accurate.
All volumes being backed up may not be listed.
Top Processes by CPU: ?
3% WindowServer
2% BehavioralInjector_64
1% Dock
1% fontd
1% launchservicesd
Top Processes by Memory: ?
160 MB com.apple.IconServicesAgent
98 MB softwareupdated
82 MB Finder
74 MB mds_stores
53 MB WindowServer
Virtual Memory Information: ?
1.38 GB Free RAM
1.24 GB Active RAM
485 MB Inactive RAM
904 MB Wired RAM
4.04 GB Page-ins
41 MB Page-outsThat Mac has been modified to such an extent that it bears little resemblance to the Mac it once was. It is not reasonable to expect it to operate normally. The numerous "cleaning", "anti-virus" and "disk diag" utilities that have been installed serve no beneficial purpose and can only contribute to poor performance. Time Machine has not been properly configured. Intrusive and annoying adware has also been installed.
Like many ill-conceived "cleaning" utilities, "CleanMyMac" is trash capable of corrupting a Mac to the point that erasing it completely is the only practicable means of recovery.
There is no way to reverse the effects of having used CleanMyMac2, and the developer's uninstallation instructions are ineffective. Only MacPaw, its developer, can know the reason for that, but I can think of two possibilities: either they are purposefully leaving components behind for reasons known only to them, or they simply don't know what they're doing. Neither one of those possibilities is particularly comforting for the user.
Reinstalling OS X alone will have no effect on either removing CleanMyMac or reversing the damage it is capable of inflicting upon a system.
Follow the applicable recovery procedure below:
If you have a backup that you created prior to using CleanMyMac, now is the time to use it. For Time Machine, boot OS X Recovery, and at the Mac OS X Utilities screen, choose Restore from Time Machine Backup. Choose a date preceding the installation of CleanMyMac.
If you do not have a backup that predates the use of CleanMyMac, create one now. To do that read Mac Basics: Time Machine backs up your Mac.
The recovery procedure will require that you erase the Mac using OS X Recovery, and then create a new user whose contents will be empty. You will then be able to use Setup Assistant to migrate your essential documents including photos, music, work products and other essential files.
When doing so, select only your previous User account and do not select "Applications", "Computer and Network Settings" or "Other files and folders". De-select those choices.
Subsequent to using Setup Assistant, you will need to reinstall the essential software you may require, once again remembering to install software only from their original sources, and omitting all non-essential software.
To erase and install Mavericks read: OS X Mavericks: Erase and reinstall OS X
To migrate your essential documents read: OS X: How to migrate data from another Mac using Mavericks and follow the procedure under Time Machine or other disk migration. -
Why is my iMac running so slowly?
EtreCheck version: 1.9.12 (48)
Report generated June 17, 2014 at 7:50:21 AM EDT
Hardware Information:
iMac (27-inch, Late 2013) (Verified)
iMac - model: iMac14,2
1 3.5 GHz Intel Core i7 CPU: 4 cores
16 GB RAM
Video Information:
NVIDIA GeForce GTX 775M - VRAM: 2048 MB
iMac 2560 x 1440
System Software:
OS X 10.9.3 (13D65) - Uptime: 0 days 14:44:24
Disk Information:
APPLE SSD SD0128F disk0 : (121.33 GB)
EFI (disk0s1) <not mounted>: 209.7 MB
disk0s2 (disk0s2) <not mounted>: 120.99 GB
Boot OS X (disk0s3) <not mounted>: 134.2 MB
APPLE HDD ST1000DM003 disk1 : (1 TB)
EFI (disk1s1) <not mounted>: 209.7 MB
disk1s2 (disk1s2) <not mounted>: 999.35 GB
Recovery HD (disk1s3) <not mounted>: 650 MB
USB Information:
Apple Inc. BRCM20702 Hub
Apple Inc. Bluetooth USB Host Controller
Apple Inc. FaceTime HD Camera (Built-in)
Thunderbolt Information:
Apple Inc. thunderbolt_bus
Gatekeeper:
Anywhere
Kernel Extensions:
[loaded] com.Cycling74.driver.SAVD (1.0.0d1 - SDK 10.6) Support
Startup Items:
Jaksta: Path: /Library/StartupItems/Jaksta
Launch Daemons:
[loaded] com.adobe.fpsaud.plist Support
Launch Agents:
[running] com.rosettastone.rosettastonedaemon.plist Support
User Launch Agents:
[running] com.akamai.single-user-client.plist Support
[failed] com.apple.CSConfigDotMacCert-[...]@me.com-SharedServices.Agent.plist
[running] com.genieo.completer.download.plist Support
[loaded] com.genieo.completer.update.plist Support
[loaded] com.nchsoftware.debut.schedule.LikeSurvey.plist Support
User Login Items:
Wondershare Helper Compact
Internet Plug-ins:
Flip4Mac WMV Plugin: Version: 3.2.0.16 - SDK 10.8 Support
FlashPlayer-10.6: Version: 13.0.0.214 - SDK 10.6 Support
iPhotoPhotocast: Version: 7.0
Flash Player: Version: 13.0.0.214 - SDK 10.6 Outdated! Update
Default Browser: Version: 537 - SDK 10.9
QuickTime Plugin: Version: 7.7.3
Google Earth Web Plug-in: Version: 7.0 Support
Unity Web Player: Version: UnityPlayer version 4.3.7f1 - SDK 10.6 Support
Silverlight: Version: 5.1.10411.0 - SDK 10.6 Support
JavaAppletPlugin: Version: 14.9.0 - SDK 10.7 Check version
Safari Extensions:
AllMyTube: Version: 4.5.0.0
Audio Plug-ins:
BluetoothAudioPlugIn: Version: 1.0 - SDK 10.9
AirPlay: Version: 2.0 - SDK 10.9
AppleAVBAudio: Version: 203.2 - SDK 10.9
iSightAudio: Version: 7.7.3 - SDK 10.9
iTunes Plug-ins:
Quartz Composer Visualizer: Version: 1.4 - SDK 10.9
User Internet Plug-ins:
Picasa: Version: 1.0 - SDK 10.4 Support
3rd Party Preference Panes:
Akamai NetSession Preferences Support
Flash Player Support
Flip4Mac WMV Support
Tuxera NTFS Support
Time Machine:
Mobile backups: OFF
Auto backup: NO - Auto backup turned off
Volumes being backed up:
Destinations:
My Passport [Local] (Last used)
Total size: 2
Total number of backups: 10
Oldest backup: 2014-02-22 00:13:17 +0000
Last backup: 2014-02-24 01:12:40 +0000
Size of backup disk: Excellent
Backup size 2 > (Disk size 0 B X 3)
Time Machine details may not be accurate.
All volumes being backed up may not be listed.
Top Processes by CPU:
2% WindowServer
1% fontd
0% hidd
0% Safari
0% dpd
Top Processes by Memory:
131 MB softwareupdated
82 MB Finder
66 MB WindowServer
66 MB com.apple.WebKit.WebContent
66 MB Safari
Virtual Memory Information:
13.24 GB Free RAM
1.20 GB Active RAM
158 MB Inactive RAM
1.14 GB Wired RAM
488 MB Page-ins
4 KB Page-outsAlthough you are here to speed up your Mac and Carolyn has probably hit on solving that for you (except that Genieo is only annoying adware and not malware), I noticed several other things that should help you out going forward.
Castle5 wrote:
Gatekeeper:
Anywhere
There is no reason to have GateKeeper disabled. If you find the need to open an app not from the AppStore and not signed, then simply right-click / control click on the app and select Open from the popup menu. That way you will think about whether or not it's from a trusted site so you won't accidentally install Genieo Adware next time. Just make sure you use the developers web site or a reputable download site like MacUpdate. The installers at Softonic and C|Net's download.com often include unwanted add-ons.
User Launch Agents:
[failed] com.apple.CSConfigDotMacCert-[...]@me.com-SharedServices.Agent.plist
You don't need this any more, it's left over from the old MobileMe days.
Internet Plug-ins:
FlashPlayer-10.6: Version: 13.0.0.214 - SDK 10.6 Support
Flash Player: Version: 13.0.0.214 - SDK 10.6 Outdated! Update
Silverlight: Version: 5.1.10411.0 - SDK 10.6 Support
Flash Player needs a security update from System Preferences->Flash Player. Silverlight is also in need of a security related update if you use it.
User Launch Agents:
[running] com.akamai.single-user-client.plist Support
3rd Party Preference Panes:
Akamai NetSession Preferences Support
Many users find that NetSessions doesn't really help, so if you continue to experience slowdowns when streaming media, consider trying with out it.
Time Machine:
Auto backup: NO - Auto backup turned off
If you don't want to use TimeMachine, then you need to adopt some form of routine backup or chance losing any important files you have on your computer. All hard drives will fail at some point, normally around the three year point, so even though your's is relatively new, it can still fail early. -
How can I get rid of Top Arcade Hits virus/malware?
I noticed on the past month or two that on certain sites a little bar appears with thumbnails of things thtx are somewhat similar to what I have on screen. I figured it was just annoying adware. l I googled it and it seems the stuff is a virus or malware of some sort. I saw a posting somewhere on this site that Top Arcade Hits can easily be removed by deleting it from the Add-ons. However, my Firefox Add-ons contain nothing about this. Oddly, this intrusion does not appear consistently. I tried to get a screen capture by reopening the site where it pops u but I can't get it to show up in Firefox. However, I opened that site in IE and there it was! I made a screen shot but can't figure out how to attach it. I see that a troubleshooter of some sort (window below) says I have "GreatArcade Hits" Add-on so I seem to have it even though it does not show up on the Add-ons--probably not a good sign.
See this - http://malwaretips.com/blogs/remove-toparcadehits-virus/
-
Do I need to run a malware scan after removing uTorrent?
I know this is a dumb question, but I don't know of any malware scan sites for Mac that I trust. I'm using Mavericks and my OS is up-to-date. Do I need to run a malware scan after uninstalling uTorrent? If so, where would I get one I can trust?
Here is my scenario - On a recommendation (which I no longer trust) I installed uTorrent, as I wanted to download a file that was only available in torrent form. (This file is a legally available file, so I would not be violating copyright.)
What made me worry was the when I downloaded uTorrent, it installed without asking me to enter my admin password. This raised a red flag for me. So I immediately uninstalled uTorrent, by moving the Application to trash.
So, now that I have it uninstalled, is there a danger it may have left unwanted files on my Mac?
I don't see any evidence of unwanted files. Just wondering. Am I worrying for nothing?darrenfromoakland wrote:
I don't know of any malware scan sites for Mac that I trust.
There aren't any. It is not possible to scan one's computer from a web-site, they are all scams. All or most of the Windows sites are, as well.
when I downloaded uTorrent, it installed without asking me to enter my admin password. This raised a red flag for me. So I immediately uninstalled uTorrent, by moving the Application to trash.
So, now that I have it uninstalled, is there a danger it may have left unwanted files on my Mac?
Many applications can be installed without the need for an admin password since they don't need to install files in any common or system locations. As long as everything goes into the Applications folder and your user folder, you should never need admin permissions.
uTorrent itself is a perfectly legit application that can be used for illegal activities, like all BitTorrent apps. I'm sure it comes with an Apple developer ID signature and under normal circumstances should not be able to harm your OS X or it's applications. But to some extent it depends on where you obtained the app itself. Any app you obtain from AppStore, a legit developer site or MacUpdate should be just fine. If you got it from C|Net's download.com or Softonic then it may have come with an installer that will also install annoying adware. It would have notified you that it was being installed (and again, no admin password is required), but a large majority of users never read those dialogs and blindly click through them to get their app installed and in use as soon as possible. If you think the latter is a possibility, then the Adware Removal Guide that Carolyn tipped you to has a Adware Removal Tool that should make quick work of anything like that. -
How can I remove all traces of Facebook, Yahoo, Google, and Twitter from my computer?
Hello. I have noticed some very annoying adware/malware/bloatware, whatever it is called. I can not seem to get Google, Yahoo, Twitter, and Facebook off of my computer. When I go to empty my cache and cookies etc from Safari these websites come right back into my top sites. What gives? I don't use these sites. How can I get this garbage off of my computer and keep it from coming back? It's like a virus or something with how annoyingly persistent it is.
Thanks.Andy, thank you.
Question one:
I will investigate the .NET Framework Cleanup Tool, which Styxen (to whom I also thank) also pointed me at.
Question two:
I’m still confused.
I installed my new Windows 7 SP1 system on the 5 November 2013 and Windows Update subsequently offered a number of updates to .NET Framework 3.5.1 which are all successfully installed.
KB958488, KB979900, and KB982526 are all old updates now and, with the exception of KB958488, have never been offered by Windows Update and are not installed on my system.
As mentioned in my original post, KB958488 is installed on my system but I believe that it was installed without my knowledge by the installation of the Mouse and Keyboard Center or possibly by .NET Framework 4 Client Profile.
If Windows Update had independently determined that my system needed or could benefit from KB958488, your post appears to suggest that Windows Update would have offered
KB982526 instead.
And, of course, I still have no explanation as to why, if KB958488 is an update to .NET Framework 3.5.1, all its files appear to belong to .NET Framework 4 and my update history believes it belongs
to .NET Framework 4 as well. -
Can anyone identify "hostmgr.app"?
I recently turned on my Mac's firewall since I was getting some annoying adware interruptions in my browsers. Coincident with that, whenever I open my MacBook Pro after it's been sleeping I get a request to allow "hostmgr.app" to have access. I routinely deny it but for all I know, it may be a necessary utility. I did some Googling about it but didn't find anything definitive. Hoping someone on these boards can help.
There is no need to download anything to solve this problem. The firewall does not block adware, and it serves no purpose at all if you're behind a router on a private network.
You may have installed one or more of the common types of ad-injection malware. Follow the instructions on this Apple Support page to remove it. It's been reported that some variants of the "VSearch" malware block access to the page. If that happens, start in safe mode by holding down the shift key at the startup chime, then try again.
Back up all data before making any changes.
One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those. If Safari crashes on launch, skip that step and come back to it after you've done everything else.
If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, ask for further instructions.
Make sure you don't repeat the mistake that led you to install the malware. It may have come from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.
Malware is also found on websites that traffic in pirated content such as video. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates (OS X 10.10 or later)
or
Download updates automatically (OS X 10.9 or earlier)
if it's not already checked. -
How do you uninstall Free Zip Mac?
I use Mavericks OS X 10.9.3. How do you uninstall "Free Zip Mac?"
Probably you can simply trash it (see my reply in your Ez7z topic).
There is however a chance that during the installation 'Free Zip Mac' some annoying adware was installed. If you see any unusual behavior in your browser(s), check this: http://www.thesafemac.com/arg/ -
I have a Hp Pavillian P 6000 Series desktop windows 7 32 bit desktop computer. Att Tech Connect expert diagnose a root kit virus on my computer recenty and they removed the virus. This is what Wikepedia has to say about the virus. " Rootkit installation can be automated, or an attacker can install it once they've obtained root or Administrator access." I knew this virus was not on computer when I purchased it 2 years ago because last year in December is when I all of a sudden started having annoying adware popping up everywhere on all websites that I normally visit without any issues. My subscription with I Yogi Support Team was about to expire on Dec. 4th. 2014 and I allowed I yogi to obtain Administrator access to my computer several times before I started having severe problems in December. Can you point me in the right direction to take action against a team that should have been protected my computer but instead attacked it with a malicious virus? Thanks in advance.
This usually happens if the updater wasn't able to retrieve the date from the OS and used 0 (zero) instead.
Firefox uses the Unix EPOCH that starts with Jan 1, 1970 and that date is corrected for the time zone.
See http://en.wikipedia.org/wiki/Unix_time -
Macbook Pro has adware. Keep getting annoying pop-ups. How do i clean my laptop
Macbook Pro has adware. Keep getting annoying pop-ups. How do I clean my laptop
There is no need to download anything to solve this problem.
You may have installed one or more of the common types of ad-injection malware. Follow the instructions on this Apple Support page to remove it. It's been reported that some variants of the "VSearch" malware block access to the page. If that happens, start in safe mode by holding down the shift key at the startup chime, then try again.
Back up all data before making any changes.
One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those. If Safari crashes on launch, skip that step and come back to it after you've done everything else.
If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, ask for further instructions.
Make sure you don't repeat the mistake that led you to install the malware. It may have come from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.
Malware is also found on websites that traffic in pirated content such as video. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates (OS X 10.10 or later)
or
Download updates automatically (OS X 10.9 or earlier)
if it's not already checked. -
How to remove blinkx popup adware/malware from Firefox?
This morning I noticed that my Firefox browser was constantly being interrupted by in-window popups for a site called cdn.blinkx.com/uvp-0.2.1/applications/blank.php. It opens these pages about every 20 seconds, but since updating Firefox it appears to have slowed down. Still, I would like to find the adware responsible and remove it for security reasons. The site itself doesn't appear to do anything - just a blank black page - but it is very annoying and can make the browser almost unusable. I have strong reason to believe this is adware or malware. I have not really done any unusual downloads recently, and my antivirus software ClamXav did not spot it. If anyone could help solve this problem I would be very grateful.
You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot" or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
Maybe you are looking for
-
How do you create a popup calendar in a fillable PDF form? I am running Acrobat on a Mac Air with the current OS.
-
Dear All, I have made a report that fetches data from table BSEG, BKPF, etc. Thus it timeouts. Is there any way I can upgrade my code for getting the O/P earlier ?? Please help.
-
I just upgraded to firefox 6 and it did not include the add ons. It said that the add ons were out of date. When I try to open yahoo.com I don't have any site to see. I can open chrome browser and IE without any problem. Before this new problem I was
-
Como devuelvo un programa mal comprado
Como devuelvo un programa que compre mal
-
How to find which Diagnostic Logging is turned on?
Hello, When I am opening a supplier page, am getting a warning 'Low-level Diagnostic Logging is turned on. This may temporarily reduce performance'. Recently I did the following Enable FND Logging using system administrator responsibility by setting