How can I remove "ClientConnect" software?

Question

Hi-
Recently, in an automotive web forum, a poster offered to the general public a PDF version of the shop manuals for a type of Subaru car. Since I own one of these, and it isn't getting any younger, I thought it might be a good idea to have on my computer since I work on my cars myself.
I tried to download the files, but repeatedly could not.  Apparently, I needed to download some sort of reader software that I hadn't heard of before.  It used a symbol similar to QuickTime, though it obviously wasn't.  Weighing the possibility of problems versus the advantage of having the manuals, I downloaded the reader.
And that's when the problems started!
In Safari, my page is TOTALLY corrupted.  You cannot remove Safari and re-install it on my MacBook Pro [mountain lion], so now the page looks completely different and uses "Bing" as the search engine, despite the fact that I have the setting set for Google!  EVERY time I click on something to open [including on the Apple website!] it takes me to some advertisement, including for one called "MacKeeper", which wants to clean my computer.  The same thing happens in Chrome, even after completely removing it and re-installing!
Bite me once shame on you;  Bite me twice shame on ME.  I don't think so!
I'm serious, I had literally 13 advertisements open as a completely new tab/window in order to just get to THIS web forum and register!  This whole thing is called "ClientConnect", and it is actually NOT considered a virus, if you can believe it.  It is considered "very aggressive adware", for whatever the difference actually is!
OK, my Chrome is muddled too.  When I open a website such as CNN's, about 25% of the words in an article are green and double underlined, and if the cursor so much as passes over these then an advertisement will pop up and take over the whole page!  This is INSANE!
Q:  How do I remove this software, which I have found to be called "ClientConnect"?  There are tutorials online about removing it from Windows machines, but I cannot find one about removing it from the Mac.
Suggestions?  Thanx in advance!
T!

Answer 1

You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
          Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot" or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination  command-C. In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.