I can't get rid of Cinema Plus malware.

Question

It's infected Firefox (37.0.1) and Safari (8.0.5)
I'm running a Mac Mini w/ 10.10.3; 3ghz i7; 16megs of ram; Intel Iris 1536 MB graphics card. Help. Thanks.

Answer 1

You may have installed the "CinemaPlus" ad-injection malware. I suggest the procedure below to disable it. This procedure may leave a few small files behind, but it will permanently deactivate the malware (as long as you never reinstall it.)
Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data before proceeding.
Step 1
From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including one called "Cinema-Plus." If in doubt, uninstall all extensions. Do the equivalent in the Chrome browser, if you use it.
Step 2
Triple-click anywhere in the line below on this page to select it:
~/Library/Application Support/Mozilla/Extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}/[email protected]ea7ca5c5.com
Right-click or control-click the line and select
          Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.
If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
A folder may open with an item selected. It will have a long name ending in ".com". Move it to the Trash.
Reveal this folder in the same way:
~/Library/LaunchAgents
There may be files in the folder with a name beginning in either of the following ways:
           cinemas-+-plus
           cinema-plus
Move them to the Trash too.
Log out or restart the computer and empty the Trash.
This malware is sometimes distributed with another kind of ad-injection malware called "SearchProtect" or "Trovi." If applicable, follow the instructions on this Apple Support page to remove it.