Help defeating adware/malware
I've picked up a very bothersome bit of ????ware that has crippled my Safari today. I've had similar things before but this is the worst.
A little dialog box is generated and, when I click to close it, another immediately replaces it, endlessly. What that means is that no Safari menus are available, so I cannot access Safari Preferences, Extensions, etc... Is there another way to zap extensions without being able to access them from the Safari menu?
I've poked around for hours and haven't been able to find anything hiding around. I found a couple of bits looking at the Activity Monitor but can't get any farther.
The bad guys seem to be ourhostguru(dot)com and 13byt(dot)com
Help anyone?
Helpful Links Regarding Malware Problems
If you are having an immediate problem with ads popping up see The Safe Mac » Adware Removal Guide, AdwareMedic, or Remove unwanted adware that displays pop-up ads and graphics on your Mac - Apple Support.
Open Safari, select Preferences from the Safari menu. Click on Extensions icon in the toolbar. Disable all Extensions. If this stops your problem, then re-enable them one by one until the problem returns. Now remove that extension as it is causing the problem.
The following comes from user stevejobsfan0123. I have made minor changes to adapt to this presentation.
Fix Some Browser Pop-ups That Take Over Safari.
Common pop-ups include a message saying the government has seized your computer and you must pay to have it released (often called "Moneypak"), or a phony message saying that your computer has been infected, and you need to call a tech support number (sometimes claiming to be Apple) to get it resolved. First, understand that these pop-ups are not caused by a virus and your computer has not been affected. This "hijack" is limited to your web browser. Also understand that these messages are scams, so do not pay any money, call the listed number, or provide any personal information. This article will outline the solution to dismiss the pop-up.
Quit Safari
Usually, these pop-ups will not go away by either clicking "OK" or "Cancel." Furthermore, several menus in the menu bar may become disabled and show in gray, including the option to quit Safari. You will likely have to force quit Safari. To do this, press Command + option + esc, select Safari, and press Force Quit.
Relaunch Safari
If you relaunch Safari, the page will reopen. To prevent this from happening, hold down the 'Shift' key while opening Safari. This will prevent windows from the last time Safari was running from reopening.
This will not work in all cases. The shift key must be held at the right time, and in some cases, even if done correctly, the window reappears. In these circumstances, after force quitting Safari, turn off Wi-Fi or disconnect Ethernet, depending on how you connect to the Internet. Then relaunch Safari normally. It will try to reload the malicious webpage, but without a connection, it won't be able to. Navigate away from that page by entering a different URL, i.e. www.apple.com, and trying to load it. Now you can reconnect to the Internet, and the page you entered will appear rather than the malicious one.
Similar Messages
-
Having trouble getting rid of popup adware/malware, primarily in Safari. TuneUpMyMac and MacKeeper persistently open new windows when I navigate to any number of sites. I have never downloaded or registered for their software, so I suspect this is a trojan. How do I get rid of?
Mac users often ask whether they should install "anti-virus" software. The answer usually given on ASC is "no." The answer is right, but it may give the wrong impression that there is no threat from what are loosely called "viruses." There is a threat, and you need to educate yourself about it.
1. This is a comment on what you should—and should not—do to protect yourself from malicious software ("malware") that circulates on the Internet and gets onto a computer as an unintended consequence of the user's actions. It does not apply to software, such as keystroke loggers, that may be installed deliberately by an intruder who has hands-on access to the computer, or who has been able to log in to it remotely. That threat is in a different category, and there's no easy way to defend against it.
The comment is long because the issue is complex. The key points are in sections 5, 6, and 10.
OS X now implements three layers of built-in protection specifically against malware, not counting runtime protections such as execute disable, sandboxing, system library randomization, and address space layout randomization that may also guard against other kinds of exploits.
2. All versions of OS X since 10.6.7 have been able to detect known Mac malware in downloaded files, and to block insecure web plugins. This feature is transparent to the user. Internally Apple calls it "XProtect."
The malware recognition database used by XProtect is automatically updated; however, you shouldn't rely on it, because the attackers are always at least a day ahead of the defenders.
The following caveats apply to XProtect:
☞ It can be bypassed by some third-party networking software, such as BitTorrent clients and Java applets.
☞ It only applies to software downloaded from the network. Software installed from a CD or other media is not checked.
As new versions of OS X are released, it's not clear whether Apple will indefinitely continue to maintain the XProtect database of older versions such as 10.6. The security of obsolete system versions may eventually be degraded. Security updates to the code of obsolete systems will stop being released at some point, and that may leave them open to other kinds of attack besides malware.
3. Starting with OS X 10.7.5, there has been a second layer of built-in malware protection, designated "Gatekeeper" by Apple. By default, applications and Installer packages downloaded from the network will only run if they're digitally signed by a developer with a certificate issued by Apple. Software certified in this way hasn't necessarily been tested by Apple, but you can be reasonably sure that it hasn't been modified by anyone other than the developer. His identity is known to Apple, so he could be held legally responsible if he distributed malware. That may not mean much if the developer lives in a country with a weak legal system (see below.)
Gatekeeper doesn't depend on a database of known malware. It has, however, the same limitations as XProtect, and in addition the following:
☞ It can easily be disabled or overridden by the user.
☞ A malware attacker could get control of a code-signing certificate under false pretenses, or could simply ignore the consequences of distributing codesigned malware.
☞ An App Store developer could find a way to bypass Apple's oversight, or the oversight could fail due to human error.
Apple has so far failed to revoke the codesigning certificates of some known abusers, thereby diluting the value of Gatekeeper and the Developer ID program. These failures don't involve App Store products, however.
For the reasons given, App Store products, and—to a lesser extent—other applications recognized by Gatekeeper as signed, are safer than others, but they can't be considered absolutely safe. "Sandboxed" applications may prompt for access to private data, such as your contacts, or for access to the network. Think before granting that access. Sandbox security is based on user input. Never click through any request for authorization without thinking.
4. Starting with OS X 10.8.3, a third layer of protection has been added: a "Malware Removal Tool" (MRT). MRT runs automatically in the background when you update the OS. It checks for, and removes, malware that may have evaded the other protections via a Java exploit (see below.) MRT also runs when you install or update the Apple-supplied Java runtime (but not the Oracle runtime.) Like XProtect, MRT is effective against known threats, but not against unknown ones. It notifies you if it finds malware, but otherwise there's no user interface to MRT.
5. The built-in security features of OS X reduce the risk of malware attack, but they are not, and never will be, complete protection. Malware is foremost a problem of human behavior, and no technological fix alone is going to solve it. Trusting software to protect you will only make you more vulnerable.
The best defense is always going to be your own intelligence. With the possible exception of Java exploits, all known malware circulating on the Internet that affects a fully-updated installation of OS X 10.6 or later takes the form of so-called "Trojan horses," which can only have an effect if the victim is duped into running them. The threat therefore amounts to a battle of wits between you and Internet criminals. If you're better informed than they think you are, you'll win. That means, in practice, that you always stay within a safe harbor of computing practices. How do you know when you're leaving the safe harbor? Below are some warning signs of danger.
Software from an untrustworthy source
☞ Software with a corporate brand, such as Adobe Flash Player, doesn't come directly from the developer’s website. Do not trust an alert from any website to update Flash, or your browser, or any other software. A genuine alert that Flash is outdated and blocked is shown on this support page. Follow the instructions on the support page in that case. Otherwise, assume that the alert is fake and someone is trying to scam you into installing malware. If you see such alerts on more than one website, ask for instructions.
☞ Software of any kind is distributed via BitTorrent, or Usenet, or on a website that also distributes pirated music or movies.
☞ Rogue websites such as Softonic, Soft32, and CNET Download distribute free applications that have been packaged in a superfluous "installer."
☞ The software is advertised by means of spam or intrusive web ads. Any ad, on any site, that includes a direct link to a download should be ignored.
Software that is plainly illegal or does something illegal
☞ High-priced commercial software such as Photoshop is "cracked" or "free."
☞ An application helps you to infringe copyright, for instance by circumventing the copy protection on commercial software, or saving streamed media for reuse without permission. All "YouTube downloaders" are in this category, though not all are necessarily malicious.
Conditional or unsolicited offers from strangers
☞ A telephone caller or a web page tells you that you have a “virus” and offers to help you remove it. (Some reputable websites did legitimately warn visitors who were infected with the "DNSChanger" malware. That exception to this rule no longer applies.)
☞ A web site offers free content such as video or music, but to use it you must install a “codec,” “plug-in,” "player," "downloader," "extractor," or “certificate” that comes from that same site, or an unknown one.
☞ You win a prize in a contest you never entered.
☞ Someone on a message board such as this one is eager to help you, but only if you download an application of his choosing.
☞ A "FREE WI-FI !!!" network advertises itself in a public place such as an airport, but is not provided by the management.
☞ Anything online that you would expect to pay for is "free."
Unexpected events
☞ A file is downloaded automatically when you visit a web page, with no other action on your part. Delete any such file without opening it.
☞ You open what you think is a document and get an alert that it's "an application downloaded from the Internet." Click Cancel and delete the file. Even if you don't get the alert, you should still delete any file that isn't what you expected it to be.
☞ An application does something you don't expect, such as asking for permission to access your contacts, your location, or the Internet for no obvious reason.
☞ Software is attached to email that you didn't request, even if it comes (or seems to come) from someone you trust.
I don't say that leaving the safe harbor just once will necessarily result in disaster, but making a habit of it will weaken your defenses against malware attack. Any of the above scenarios should, at the very least, make you uncomfortable.
6. Java on the Web (not to be confused with JavaScript, to which it's not related, despite the similarity of the names) is a weak point in the security of any system. Java is, among other things, a platform for running complex applications in a web page, on the client. That was always a bad idea, and Java's developers have proven themselves incapable of implementing it without also creating a portal for malware to enter. Past Java exploits are the closest thing there has ever been to a Windows-style virus affecting OS X. Merely loading a page with malicious Java content could be harmful.
Fortunately, client-side Java on the Web is obsolete and mostly extinct. Only a few outmoded sites still use it. Try to hasten the process of extinction by avoiding those sites, if you have a choice. Forget about playing games or other non-essential uses of Java.
Java is not included in OS X 10.7 and later. Discrete Java installers are distributed by Apple and by Oracle (the developer of Java.) Don't use either one unless you need it. Most people don't. If Java is installed, disable it—not JavaScript—in your browsers.
Regardless of version, experience has shown that Java on the Web can't be trusted. If you must use a Java applet for a task on a specific site, enable Java only for that site in Safari. Never enable Java for a public website that carries third-party advertising. Use it only on well-known, login-protected, secure websites without ads. In Safari 6 or later, you'll see a padlock icon in the address bar when visiting a secure site.
Stay within the safe harbor, and you’ll be as safe from malware as you can practically be. The rest of this comment concerns what you should not do to protect yourself.
7. Never install any commercial "anti-virus" (AV) or "Internet security" products for the Mac, as they are all worse than useless. If you need to be able to detect Windows malware in your files, use one of the free security apps in the Mac App Store—nothing else.
Why shouldn't you use commercial AV products?
☞ To recognize malware, the software depends on a database of known threats, which is always at least a day out of date. This technique is a proven failure, as a major AV software vendor has admitted. Most attacks are "zero-day"—that is, previously unknown. Recognition-based AV does not defend against such attacks, and the enterprise IT industry is coming to the realization that traditional AV software is worthless.
☞ Its design is predicated on the nonexistent threat that malware may be injected at any time, anywhere in the file system. Malware is downloaded from the network; it doesn't materialize from nowhere. In order to meet that nonexistent threat, commercial AV software modifies or duplicates low-level functions of the operating system, which is a waste of resources and a common cause of instability, bugs, and poor performance.
☞ By modifying the operating system, the software may also create weaknesses that could be exploited by malware attackers.
☞ Most importantly, a false sense of security is dangerous.
8. An AV product from the App Store, such as "ClamXav," has the same drawback as the commercial suites of being always out of date, but it does not inject low-level code into the operating system. That doesn't mean it's entirely harmless. It may report email messages that have "phishing" links in the body, or Windows malware in attachments, as infected files, and offer to delete or move them. Doing so will corrupt the Mail database. The messages should be deleted from within the Mail application.
An AV app is not needed, and cannot be relied upon, for protection against OS X malware. It's useful, if at all, only for detecting Windows malware, and even for that use it's not really effective, because new Windows malware is emerging much faster than OS X malware.
Windows malware can't harm you directly (unless, of course, you use Windows.) Just don't pass it on to anyone else. A malicious attachment in email is usually easy to recognize by the name alone. An actual example:
London Terror Moovie.avi [124 spaces] Checked By Norton Antivirus.exe
You don't need software to tell you that's a Windows trojan. Software may be able to tell you which trojan it is, but who cares? In practice, there's no reason to use recognition software unless an organizational policy requires it. Windows malware is so widespread that you should assume it's in every email attachment until proven otherwise. Nevertheless, ClamXav or a similar product from the App Store may serve a purpose if it satisfies an ill-informed network administrator who says you must run some kind of AV application. It's free and it won't handicap the system.
The ClamXav developer won't try to "upsell" you to a paid version of the product. Other developers may do that. Don't be upsold. For one thing, you should not pay to protect Windows users from the consequences of their choice of computing platform. For another, a paid upgrade from a free app will probably have all the disadvantages mentioned in section 7.
9. It seems to be a common belief that the built-in Application Firewall acts as a barrier to infection, or prevents malware from functioning. It does neither. It blocks inbound connections to certain network services you're running, such as file sharing. It's disabled by default and you should leave it that way if you're behind a router on a private home or office network. Activate it only when you're on an untrusted network, for instance a public Wi-Fi hotspot, where you don't want to provide services. Disable any services you don't use in the Sharing preference pane. All are disabled by default.
10. As a Mac user, you don't have to live in fear that your computer may be infected every time you install software, read email, or visit a web page. But neither can you assume that you will always be safe from exploitation, no matter what you do. Navigating the Internet is like walking the streets of a big city. It's as safe or as dangerous as you choose to make it. The greatest harm done by security software is precisely its selling point: it makes people feel safe. They may then feel safe enough to take risks from which the software doesn't protect them. Nothing can lessen the need for safe computing practices. -
I'm currently using OSX 10.6.8, 2.4GHz Intel Core 2 Duo Processor, 2 GB 667 MHz DDR2 SDRAM Memory. I am not able to upgrade the operating system, and the computer still has 67 GB of memory on the harddrive. I don't use it for anything very intense, mostly internet browsing. I was at a hotel over the weekend and connected to their free wifi. Once back home, two days later, I started receiving pop ups in Chrome. The first was MediaDownloader, so I assume that is the culprit. The second pop up to occur was Trojanalert. I looked through some online community forums and was pointed towards downloading and running AdwareMedic. My operating system does not support this program. Next I read up on how to examine libraries and extensions to find the issue. I'm not well versed in this, but I followed the directions and did not find any malicious looking extensions or items in the libraries. Before looking for the "thing" to remove, I backed up my computer as recommended.
I have never, to my knowledge, had a virus on this computer. I have never experienced pop ups, and I very rarely download any program, especially not software included with other programs.
Could someone recommend a virus/adware/malware utility that will find and remove this issue or provide me with a detailed set of instructions on how to find the issue and then correct it? Are there free online scans or removal tools that are trusted and could help? Also, if I should be posting this somewhere else, please let me know. I have not used this community tool much at all. Thank you in advance for any assistance.First, thanks for the quick response. This is the website that I looked at and was trying to follow. There are no extensions listed in my Safari, and the only two in Chrome are: Google Docs and Java for Browsing. In Firefox the only extension is Garmin Communicator 4.1.0.
To the best of my novice ability I followed the directions to look at the libraries and have not found malicious things there either. As I cannot upgrade to 10.7, is there anything else I'm missing? Again, I've tried my best to locate the cause, but I'm new to looking at files and paths. Nothing jumps out as abnormal or as something listed on thesafemac.com/arg . -
My Mac is very slow and applications take a long time to load, especially Safari and iTunes. Please help. I have run the Etrecheck report and these are results.
Thanks Pat
EtreCheck version: 2.1.5 (108)
Report generated 4 January 2015 14:29:26 GMT
Click the [Support] links for help with non-Apple products.
Click the [Details] links for more information about that line.
Click the [Adware] links for help removing adware.
Hardware Information: ℹ️
iMac (21.5-inch, Mid 2011) (Verified)
iMac - model: iMac12,1
1 2.7 GHz Intel Core i5 CPU: 4-core
4 GB RAM Upgradeable
BANK 0/DIMM0
2 GB DDR3 1333 MHz ok
BANK 1/DIMM0
2 GB DDR3 1333 MHz ok
BANK 0/DIMM1
empty empty empty empty
BANK 1/DIMM1
empty empty empty empty
Bluetooth: Old - Handoff/Airdrop2 not supported
Wireless: en1: 802.11 a/b/g/n
Video Information: ℹ️
AMD Radeon HD 6770M - VRAM: 512 MB
iMac 1920 x 1080
System Software: ℹ️
OS X 10.10.1 (14B25) - Uptime: 0:32:50
Disk Information: ℹ️
ST31000528AS disk0 : (1 TB)
EFI (disk0s1) <not mounted> : 210 MB
Macintosh HD (disk0s2) / : 999.35 GB (717.51 GB free)
Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB
OPTIARC DVD RW AD-5690H
USB Information: ℹ️
Apple Inc. FaceTime HD Camera (Built-in)
Seagate Expansion Desk 2 TB
EFI (disk1s1) <not mounted> : 210 MB
Seagate Expansion Drive (disk1s2) /Volumes/Seagate Expansion Drive : 2.00 TB (1.66 TB free)
Apple Inc. BRCM2046 Hub
Apple Inc. Bluetooth USB Host Controller
Apple Inc. iPhone
Apple Internal Memory Card Reader
Apple Computer, Inc. IR Receiver
Thunderbolt Information: ℹ️
Apple Inc. thunderbolt_bus
Gatekeeper: ℹ️
Mac App Store and identified developers
Kernel Extensions: ℹ️
/Library/Application Support/Avast/components/fileshield/unsigned
[loaded] com.avast.AvastFileShield (2.1.0 - SDK 10.9) [Support]
/Library/Application Support/Avast/components/proxy/unsigned
[loaded] com.avast.PacketForwarder (2.0 - SDK 10.9) [Support]
Problem System Launch Agents: ℹ️
[failed] com.apple.syncservices.SyncServer.plist
Launch Agents: ℹ️
[loaded] com.avast.userinit.plist [Support]
[running] com.epson.Epson_Low_Ink_Reminder.launcher.plist [Support]
[loaded] com.epson.esua.launcher.plist [Support]
[running] com.epson.eventmanager.agent.plist [Support]
[loaded] com.oracle.java.Java-Updater.plist [Support]
[running] com.trusteer.rapport.rapportd.plist [Support]
Launch Daemons: ℹ️
[loaded] com.adobe.fpsaud.plist [Support]
[loaded] com.avast.init.plist [Support]
[loaded] com.avast.uninstall.plist [Support]
[failed] com.avast.update.plist [Support]
[loaded] com.microsoft.office.licensing.helper.plist [Support]
[loaded] com.oracle.java.Helper-Tool.plist [Support]
[running] com.trusteer.rooks.rooksd.plist [Support]
User Launch Agents: ℹ️
[loaded] com.adobe.ARM.[...].plist [Support]
[invalid?] com.avast.home.userinit.plist [Support]
[running] com.microsoft.LaunchAgent.SyncServicesAgent.plist [Support]
User Login Items: ℹ️
iTunesHelper ApplicationHidden (/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)
Internet Plug-ins: ℹ️
FlashPlayer-10.6: Version: 16.0.0.235 - SDK 10.6 [Support]
Default Browser: Version: 600 - SDK 10.10
AdobePDFViewerNPAPI: Version: 11.0.07 - SDK 10.6 [Support]
AdobePDFViewer: Version: 11.0.07 - SDK 10.6 [Support]
DivXBrowserPlugin: Version: 2.2 [Support]
Flash Player: Version: 16.0.0.235 - SDK 10.6 [Support]
OVSHelper: Version: 1.1 [Support]
QuickTime Plugin: Version: 7.7.3
JavaAppletPlugin: Version: Java 8 Update 25 Check version
Safari Extensions: ℹ️
wrc [Installed]
3rd Party Preference Panes: ℹ️
DivX [Support]
Flash Player [Support]
Flip4Mac WMV [Support]
GoToMyPC Preferences [Support]
Java [Support]
Trusteer Endpoint Protection [Support]
Time Machine: ℹ️
Skip System Files: NO
Auto backup: YES
Volumes being backed up:
Macintosh HD: Disk size: 999.35 GB Disk used: 281.84 GB
Destinations:
Seagate Expansion Drive [Local]
Total size: 2.00 TB
Total number of backups: 78
Oldest backup: 2013-07-28 18:09:06 +0000
Last backup: 2015-01-04 14:29:38 +0000
Size of backup disk: Adequate
Backup size 2.00 TB > (Disk used 281.84 GB X 3)
Top Processes by CPU: ℹ️
2% WindowServer
1% mds
0% fontd
0% mds_stores
0% com.avast.daemon
Top Processes by Memory: ℹ️
120 MB Safari
112 MB com.avast.daemon
94 MB com.apple.WebKit.WebContent
56 MB spindump
52 MB mds_stores
Virtual Memory Information: ℹ️
479 MB Free RAM
1.56 GB Active RAM
1.11 GB Inactive RAM
904 MB Wired RAM
5.37 GB Page-ins
75 MB Page-outs
Diagnostics Information: ℹ️
Jan 4, 2015, 01:57:18 PM Self test - passed
Standard users cannot read /Library/Logs/DiagnosticReports.
Run as an administrator account to see more information.patbythesea wrote:
Can I assume that with my Mac I do not need any additional virus protection software? If I do, what should I use?
See my Mac Malware Guide for help on protecting yourself from malware. You generally don't need anti-virus software.
(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com, in the form of buttons allowing for donations. Donations are not required to use my site or software.) -
Recommendations on adware/malware software?
My old MacBook (Tennessee Jed is 10 now and STILL kickin) got nailed by a nasty TH about four years ago and I had to give it the NAV, no spoonful of sugar to wash that one down, about $100 and gajillion of ARE YOU SURE YOU WANT TO DO THIS??? for the rest of forever (gag me).
Anyone have any recommendations on something a little sweeter for my MacBook Air? I'm on a supercalifragilisticexpialidocious budget, so inexpensive to free would be good. I'm not a luddite, by any means, but I spend a lot of time blogging and job hunting, and way less time looking for software.
Basically what I'm saying is, if anyone has researched stuff and has a reliable answer for this thing I'm asking, that can be supported by multiple users, thumbs up, and please send my way!Excellent help here > The Safe Mac » Adware Removal Guide
Download and run the AdMedic adware / malware removal tool here > AdwareMedic
Easy and only takes a minute or two. -
What is the best adware & malware removal tool?
What is the best adware & malware removal tool?
1. Click here. This link is a direct download.
2. For other types of malware, it varies.
(124629) -
Help i have malware on my mac how do i remove it sophos says clean up manually
please help i have malware on my mac mini. my daughter clicked on a bogus removal thing while on a wabsite and it downloaded antimalware.zip antantimalware1.zip to my mac, but sophos will not remove it! what do i do now?
as for sophos, see this post.
get rid of that junk quick !
as for the malware, check out this user tip. -
How to remove blinkx popup adware/malware from Firefox?
This morning I noticed that my Firefox browser was constantly being interrupted by in-window popups for a site called cdn.blinkx.com/uvp-0.2.1/applications/blank.php. It opens these pages about every 20 seconds, but since updating Firefox it appears to have slowed down. Still, I would like to find the adware responsible and remove it for security reasons. The site itself doesn't appear to do anything - just a blank black page - but it is very annoying and can make the browser almost unusable. I have strong reason to believe this is adware or malware. I have not really done any unusual downloads recently, and my antivirus software ClamXav did not spot it. If anyone could help solve this problem I would be very grateful.
You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot" or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. -
How to get rid of adware/malware? It turned into a nightmare.
Hi everyone,
This is my first post here so I hope I am posting on the right place. So basically I am using a Macbook Pro with Retina Display (13 inch) and it was bought on September 2014. This is all I know about my laptop as I really don't understand from softwares or anything of that kind (I do not even know what IOS means, sorry!) and I cannot look at any of the information because it was a gift from my father who lives in another country!
Now, the problem is that I do not know whatever happened, as I do not download anything to my laptop other than university slides and lecture notes. But since yesterday, almost whenever I click on a legit website, the website is replaced by this weight loss advertisement (or malware, I do not know the word to use as I have just learnt about these terms while looking for a solution to my problem) within a few seconds. This is a nightmare, and I am really really happy at least it did not happen on this website.
Do you know what I should do? Sorry I can't provide any information as I don't know anything about technology myself.
Any help is greatly appreciated, thank you very much!Click here and follow the instructions, or if they don't cover the type of adware on the computer, these ones. If you're willing to use a tool to remove it(you don't need to, but may find it easier), you can instead run Adware Medic; this link is a direct download.
(119848) -
I NEED DESPERATE HELP! ADWARE THAT DOES NOT GO AWAY NO MATTER WHAT I TRY
So I was downloading something to my computer and, of course, I got stuck with that Only Search thing and no matter what I try it DOES NOT GO AWAY. I tried turning off my extensions, I tried switching networks, I tried resetting safari. Deleting my history. Every. Single. Thing.
And nothing works.
Pleas please PLEASE someone help me with getting rid of this I HATE having an adware.There is no need to download anything to solve this problem.
You may have installed the "VSearch" trojan. Remove it as follows.
Malware is always changing to get around the defenses against it. These instructions are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data before proceeding.
Step 1
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
Reset the home page and default search engine in all the browsers, if it was changed.
Step 2
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
The problem may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the Internet criminal behind VSearch has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing has not done so, even though it's aware of the problem. This failure of oversight has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. -
I am not 100% sure how I actually got this issue but its really bothering me. I have some adware on my mac that is causing random text in any browser I use to turn into spam links and ads. I have tried to use the methods posted on thesafemac.com but that didnt solve the issue. I have now removed all extensions in the browsers I use as well as ran CleanMyMac and ClamXav, neither have removed the issue. Can someone help me get rid of this junk?
You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
/Library/Application Support/VSearch
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchAgents/com.vsearch.agent.plist
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
Restart and empty the Trash. Don't try to empty the Trash until you have restarted.
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. It must be said that this failure of oversight is inexcusable and has seriously compromised the value of Gatekeeper and the Developer ID program. You cannot rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. -
I appear to have downloaded some very annoying adware. I'm desperate to get rid of it and need some help. It seems to be associated with www.appround.us and I can find lots of online info about this adware attacking Windows users, but nothing about Macs. It adds annoying "buttons" and load bars to the screen of both Safari and Chrome. It opens random pop-ups (even if blocker is on) and it turns random words on websites I visit into unwanted links. The messages that come up are always about updating a "Video Performer" or some other bogus software. I have tried resetting Safari and called Apple Care, but I've had no success so far. Apple Care recommend I run a virus software so I tried Dr. Web...no luck either. Sample screenshots below. Anyone able to help?
iPentax wrote:
The best advice is to Download & Install AVG
That is most definitely NOT the best advice.
First, the problem in this case was adware called Downlite (aka VSearch). I am not aware of any variant of Downlite that is detected by AVG. So AVG would be absolutely worthless at solving a problem caused by this particular adware, and probably wouldn't be much use with any other adware either.
As for actual malware, note that when I tested it in January, AVG only detected 61% of the malware samples that I threw at it. See:
Mac anti-virus testing 2014
(Fair disclosure: The Safe Mac is my site, and contains a Donate button, so I may receive compensation for providing links to The Safe Mac. Donations are not required.) -
Please help, mixed reports, malware ? virus ? neither ? I am truly stuck
I am having a problem with my relatively new 6month old imac.
Please I am hoping to find some really smart (& hopefully patient) mac users for help. I appreciate all the time mac uers help members with there questions. Yuy guys really are an invaluable resource.
So here's my situation a few wks back i started noticing my imac seemed to be running slow, after that different programs like Firefox, and Safari seemed to be freezing and appear to "not respond". But things have been busy and just put it on the side.
Now around July or so Safari seems to be almost totally unstable. i starting being subjected to constant Safari problems like the browser constantly closing, yet FireFox (14.0.1) appeared to be relatively problem-free.
My wife starting finding strang emails that were supposedly quarantined so I decided to run a virus Scan. I went to the app's store to see which virus Scans were popular and downloaded Norton from the store. I have gotten mixed results from: my poor Mac being possibly sickened with: Malware (This was what was shown "Sokobanbuild.xsl") than sometimes the scan appeared to report no problems, and i have been unable to find such a file on my Harddrive
I was under the very naive impression that Mac's were rarely affected to these types of virus and such. I am by no means a mac guru so please be gentle. I tried to search on here and got even more confused, I looked for update to the OS as i thought there was somekind of download avaiklable, but became more confused and frustrated.
Thanks so much in advance, i really appreciate the prescious time everyone takes to read this or help myself or other users.
please I am in a real bind here, and hoping for some sort of solution that doesn't involve me having to re-format the Harddrivre and re-install everything, or booting up with a cd. I was also hoping to upgrade to the new Mountain Lion OS, which I assume I should wait till this gets fixed.
please any and all help would be greatly appreciated, thanks so much in advance !!!!!!
FYI: If this helps here are some of my mac's info:
OS: 10.7.4 (MAc OS only, no windows)
Processor: 2.5 GHz Intel Core i5
Memory: 4 GB
Firefox 14.0.1
thanks again
- iamTheMustangGuyIn reply to a recent post of mine, madmacs0 responded with an assessment of Norton ... and a more balanced and informative post would be hard to find. Do read it.
I need to preface my remarks to explain why I have not spoken up on this subject here before.
I was an early adopter of Norton Anti-Virus when Peter Norton owned it. It, along with the even better Norton Utilities saved my bacon more than once when running Apple's Classic OS. At the time I would have recommended it to most any Mac user. Then Symantec bought Peter out and things went rapidly down hill. The last chance I gave them to get it back on track was SystemWorks 2.0 and Internet Security 1.0 back in the OS 9 era. Despite a number of bug fix releases, I had to disable most of it and then remove it entirely. That's the last time I actually ran a Norton product on any of my Macs.
So I have no current experience with either NAV or the new iAntiVirus at this point and can't speak with authority on their worth. So feel free to ignore anything else I may have to say here.
I guess my bottom line would be that I think it has an undeserved bad reputation based on user experience from many years ago. I don't remember the last time I read a first person account of individual user issues in modern times. You chose your words carefully, which is appropriate, but I'll bet there are a lot of "experts" here who condemn it without ever having recent hands on experience.
There are a lot of reasons for their reputation, most well deserved. It's been said that Symantec never invented a single piece of software (not sure that's true any more, either), but rather purchased the works of others to either kill the competition or enhance their bottom line. They were a very different company in those days, with a different management style, etc.
So I wouldn't be surprised if it turned out to be at least as good as whatever has the best reputation among Commercial Mac A-V vendors today. They seem to be on top of most all the OS X malware, even though they don't spend a lot of time blogging about it. I know a lot of IT professionals who swear by their enterprise level software. I suspect that their software no longer behaves any worse than the others that operate at the kernel extension level (always dangerous for third parties). But their reputation seems to be their unending albatross.
I hope madmacs0 will not mind me copying his post like this. -
How do i get rid of Adware/malware on my Macbook Pro?
I have a MacBook Pro, 15" with Retina Display, When i click on a page, mackeeper opens up in a new tab, also my default browser which is "Google.com" has been changed to "Search-Quick.com". i also just started seeing a pop up Ad, also from the "mackeeper. this started when i downloaded an app/updated my flash player. Please help!
There is no need to download anything to solve this problem. You may have installed a variant of the "VSearch" ad-injection malware. Follow Apple Support's instructions to remove it.
If you have trouble following those instructions, see below.
Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.
The VSearch malware tries to hide itself by varying the names of the files it installs. To remove it, you must first identify the naming pattern.
Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:
/Library/LaunchDaemons
In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
A folder named "LaunchDaemons" may open. Look inside it for two files with names of the form
com.something.daemon.plist
and
com.something.helper.plist
Here something is a variable string of characters, which can be different in each case. So far it has always been a string of letters without punctuation, such as "cloud," "dot," "highway," "submarine," or "trusteddownloads." Sometimes it's a meaningless string such as "e8dec5ae7fc75c28" rather than a word. Sometimes the string is "apple," and then you must be especially careful not to delete the wrong files, because many built-in OS X files have similar names.
If you find these files, leave the LaunchDaemons folder open, and open the following folder in the same way:
/Library/LaunchAgents
In this folder, there may be a file named
com.something.agent.plist
where the string something is the same as before.
If you feel confident that you've identified the above files, back up all data, then drag just those three files—nothing else—to the Trash. You may be prompted for your administrator login password. Close the Finder windows and restart the computer.
Don't delete the "LaunchAgents" or "LaunchDaemons" folder or anything else inside either one.
The malware is now permanently inactivated, as long as you never reinstall it. You can stop here if you like, or you can remove two remaining components for the sake of completeness.
Open this folder:
/Library/Application Support
If it has a subfolder named just
something
where something is the same string you saw before, drag that subfolder to the Trash and close the window.
Don't delete the "Application Support" folder or anything else inside it.
Finally, in this folder:
/System/Library/Frameworks
there may an item named exactly
v.framework
It's actually a folder, though it has a different icon than usual. This item always has the above name; it doesn't vary. Drag it to the Trash and close the window.
Don't delete the "Frameworks" folder or anything else inside it.
If you didn't find the files or you're not sure about the identification, post what you found.
If in doubt, or if you have no backups, change nothing at all.
The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Then, still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates (OS X 10.10 or later)
or
Download updates automatically (OS X 10.9 or earlier)
if it's not already checked. -
Need help removing adware from Safari Version 7.0.5 (9537.77.4) Maverick System OS X 10.9.4 (13E28)
This adware renders system useless during while using web. Cannot perform even the simplest work that requires interaction on a website. (Except Apple). I have excellent Web Service. Other iMac and 4 IOS devices are not affected, and work well.
Hello Apple community
PLEASE I need your help!
I'm having an horrible experience with my Safari 7.1.2 ( iMac OS X 10.9.5)
Bare with me, here are my symptoms, and what I did so far looking for solutions online. None of them helped
This all started SUDDENLY, today. Although i DOWNLOADED a couple of apps last week thinking i was upgrading my video app that wasn't working (I was prompted to do so but the video never ended up working!)
My symptoms:
- Ads are "glueing" themselves on my webpages... in different formats depending on the website i'm on (regular websites...)
- pages are opening ups by themselves (see picture) :
*directing to "d2bzz.resolve.sweepstakesghost.biz/?sov....." with a window saying "PC TECH SUPPORT Chat initiated. Specialist: Matt Folson Date: January 7, 2015";
To this i turned my Wifi off and then closed the page to avoid clicking on the OK button (yet now it's not asking anymore and just redirecting me without asking)
*directing to other supposedly technical support...
- SELECTED WORDS become all caps, underlined, and in light blue with a link to an ad? (see picture above)
- ALL of this are displaying a certain "Ad by PJS-4.2"
My Solutions:
1)
I searched online and DOWNLOADED
-Clamsav: found items to remove and removed them and emptied my trash ---> Dindt work (see picture)
- ADWARE Medic: found a couple of other items to delete and deleted them , emptied trash and restated computer ----> didn't work!
Still same Symptoms!
2)
I checked my extensions for Safari and only found 3 that I do use (and been using for quite a while). Just uninstalled them
Still same symptoms!
3)
I also looked for your files “Linc Davis” is referring to here in the forum but can't find any of them in my COMPUTER.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator LOGIN password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then DELETE the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
4)
I did an other search recommended by “Linc Davis”, about looking for /Library/LaunchDaemons in the Finder and I FOUND this:
com.smithmicro.schedulerdaemon.plist
com.MICROSOFT.office.licensing.helper.plist
com.surteesstudios.hddfancontroldaemon.plist
com.adobe.fpsaud.plist
com.macpaw.CleanMyMac2.Agent.plist
com.apple.aelwriter.plist
com.adobe.SwitchBoard.plist
com.apple.qmaster.qmasterd.plist
com.adobe.versioncueCS3.plist
com.bombich.ccc.plist
PLEASE PLEASE HELP what can I do to GET RID OF those?!!
Maybe you are looking for
-
Office 2013 64 bit get rid of WSD ports and never see them again
I have some users with enormous spreadsheets, so we upgraded to Office 2013 64 but (from Office 2010 32 bit). The OS is Windows7 64 bit. We were working just fine with TCP ports for the printers. But Office 2013 64 bit installs WSD ports (not the tri
-
Freezing and crashing iPhone 5S - What do I need to do before going to Genius Bar
Bought a iPhone 5S in October. Started crashing, slowing down and freezing up 5 days ago. Revived it by hard reset (pressing power and home buttons). Contacted Apple Support online chat, advised to restore from backup, try to use minimal function,
-
No vertical scroll bar in dock stack grid view
using osx 10.6.4; in regards to the dock stack grid view -- do i have to enable the scroll bar in the stack grid view because i am not seeing any scroll bar except the "open in finder" arrow ? thanks for your help ! Message was edited by: newbeetle
-
Thomas Mercer Hursh, Ph.D. wrote: > If so, is this risk confined to failure during the end transaction processing? I.e., if I stick in something after the third insert which takes 10 minutes (because I like being stupid!) and the failure occurs durin
-
Help missing add button to add Processed Entities to a process in the proce
I am misssing the add button to ad entities and attributes. How do you add entities to a process?