I have a macbook pro and i seem to have a bug or virus as mackeeper keeps propping up on me safari
i have a macbook pro and seem to have a bug/virus as mackeeper and other various websites keep popping up on my safari
There is no need to download anything to solve this problem. You may have installed a variant of the "VSearch" ad-injection malware.
Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.
The VSearch malware tries to hide itself by varying the names of the files it installs. To remove it, you must first identify the naming pattern.
Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:
/Library/LaunchDaemons
In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
A folder named "LaunchDaemons" may open. Look inside it for two files with names of the form
com.something.daemon.plist
and
com.something.helper.plist
Here something is a variable word, which can be different in each case. So far it has always been a string of letters without punctuation, such as "cloud," "dot," "highway," "submarine," or "trusteddownloads." Sometimes the word is "apple," and then you must be especially careful not to delete the wrong files, because many built-in OS X files have similar names.
If you find these files, leave the LaunchDaemons folder open, and open the following folder in the same way:
/Library/LaunchAgents
In this folder, there may be a file named
com.something.agent.plist
where the word something is the same as before.
If you feel confident that you've identified the above files, back up all data, then drag just those three files—nothing else—to the Trash. You may be prompted for your administrator login password. Close the Finder windows and restart the computer.
Don't delete the "LaunchAgents" or "LaunchDaemons" folder or anything else inside either one.
The malware is now permanently inactivated, as long as you never reinstall it. You can stop here if you like, or you can remove two remaining components for the sake of completeness.
Open this folder:
/Library/Application Support
If it has a subfolder named just
something
where something is the same word you saw before, drag that subfolder to the Trash and close the window.
Don't delete the "Application Support" folder or anything else inside it.
Finally, in this folder:
/System/Library/Frameworks
there may an item named exactly
v.framework
It's actually a folder, though it has a different icon than usual. This item always has the above name. Drag it to the Trash and close the window.
Don't delete the "Frameworks" folder or anything else inside it.
If you didn't find the files or you're not sure about the identification, post what you found.
If in doubt, or if you have no backups, change nothing at all.
The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Then, still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates (OS X 10.10 or later)
or
Download updates automatically (OS X 10.9 or earlier)
if it's not already checked.
Similar Messages
-
I have a MacBook Pro and have problems using my Facetime. Last time I used it without problems. Now I am trying to use it, and it is asking that I enter my Apple ID. When doing so, it comes up with a message that says, "The server encountered an error processing registrion. Try again later." What does this mean, and how do I fix it? Thanks.
I had the same problem and found the solution here:
https://discussions.apple.com/thread/3189272 -
I have a Mac Pro and it seems to have a malware. How can I remove it
I have a Mac Pro and seems like it has a malware, adware . How can i remove it. MACkeeper keeps on popping
You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. -
Need some help with this please..
Open Mail, then under Mail, Preferences, look at the gmail account and find the settings for the account...see how the deletion is set. If it deletes on opening, or when removed from the inbox (same thing) change that so the email stays available on the server. Do that on both machines. See if that makes things work right for you.
-
I set up my new air and now want to transfer my info from my macbook pro and I seem to have missed the boat and want to go back and do it . the computers are in different names with diff. passwords. Any idea?
If you set yp the Air before transfer, look in Users or Accounts pref pane to see if the other user is there to login to.
-
I have a MacBook Pro and for some unknown reason I can't open numbers I keep getting a message error -1712 I can't open old documnents not the program
-1712 is a time-out error. It means the application (Numbers) is taking too long to do somthing. The 'something' is often attempting to open a corrupted file.
Holding the shift key, as suggested by Jerry, prevents Nmbers from trying to reopen files that were open when Numbers was last quit. For future reference, you might consider, before quitting Numbers, closing all files you will not require in your next session. Even ignoring the possibility of another corrrupted file bringing this problem on again later, not re-opening the files you do not need in the next session will shorten the launch time for Numbers.
Regards,
Barry -
I have a macbook pro and am trying to upgrade to OS x Mavericks but it won't seem to download from the app store
http://www.apple.com/support/mac/app-store/contact.html?form=account
-
I tried to migrate information from MacBook Air to ...Pro and it seemed to have taken files from folders on desktop as none exist on Air now. As to where these files are, I don't know. It has also taken my pictures from iPhoto to unknown destination. ??
If you used migration assistant then it probably created a new Login user and placed the migrated files under it.
Regards,
Captfred -
I have a macbook pro and a ipod and yesterday while I was on my laptop on Facebook playing words with friends with my daughter who was on the iPod playing under her user name it seems that they combined into one profile. what happened? they used to be separate and we could play against each other but now it says its the same user for both even though I signed in on facebook with my log on and she was on her ipod with her profile. can I fix this?
You might need to be asking the folks at Facebook.
-
i have a macbook pro and i put a 500 gb hard drive but know pro wont start up but when i firewire it to another mac the harddrive seems to be fine
When you formatted the drive, before installing OSX, did you click Options on the Partition and select Mac GUID Bootable ?
Just because it mounts as an external does not mean it's a bootable Volume ... -
I have a MacBook Pro and tried to download and open the torbundle package.
I have a MacBook Pro and tried to download and open the torbundle package. I get a message that reads "A copy of firefox is already running. Only one copy of firefox can be open at a time."
1. I do not seem to have firefox anywhere of my computer. Ive been using safari and as far as my computers library is concerned there is no firefox.
2. I have tried shutting down and restarting.
3. I tried making a new user account.
I believe the torbundle package is trying to open itself twice. Has anyone had this problem when trying to use tor on OS X?
This is getting very frustrating! Help please!If you open Activity Monitor do you see a FireFox running? If so delete it.
Have you tried deleting and redownloading/installing?
Next:
How can I get support?
Your best bet is to first try the following:
Read through this FAQ.
Read through the documentation.
Read through the tor-talk archives and see if your question is already answered.
Join our irc channel and state the issue and wait for help.
Send an email to [email protected]
If all else fails, try contacting us directly.
If you find your answer, please stick around on the IRC channel or the mailing list to help others who were once in your position.
From:
https://www.torproject.org/docs/faq.html.en -
I have a MacBook Pro and an 1TB WD my passport for mac. I bought a second hard drive to act as back up and when I went to do this the original passport won't mount. It is showing in disc utility but it will not repair. I am told the mac cannot repair it and I need to back up the files and then restore the hard drive. But I can't open the hard drive to move the files onto the new one!
Help me please. I am not very technical so please answer as if I have no clue!! This hard drive has my iPhoto on it and all my pictures of my son, wedding and my current photography course so I desperate to get it back!
Any help will he appreciated!disk0s2: I/O error.
disk0s2: I/O error.
The MBP's disk is damaged and requires replacement.
Genius Bar Reservations: http://www.apple.com/retail/geniusbar/ -
I have a macbook pro, and am trying to update my software. I recently bought an iphone 5, and my software is to out of date to sync my phone with itunes. I currently am running 10.5.8 and I need to update to atleast 10.6.8. Just wondering if I need to purchase it from apple or if there is an easy/free way to update it.
you need to purchase it: http://store.apple.com/us/product/MC573Z/A/mac-os-x-106-snow-leopard. It is only on a disk, not in download form.
-
i have a MacBook Pro and just added an airport express to listen to my iTunes on my stereo. How do I get Firefox to use my AX when I use Grooveshark or Pandora?
If the purchases are all from the same account then you can share the content by authorizing each device.
If you have separate accounts then you have to be authorized to use the content purchased from another account.
MJ -
I have a macbook pro and use BT homehub 3. can't work out how to connect my time capsule. can anyone help? thanks
Just need to plug the TC in to the hub in bridge mode.. do not try and bridge the homehub.. it is not possible with the setup BT uses.
To bridge the TC.. plug it directly into a computer by ethernet.. no other connection to the TC or the computer.
Press and hold in reset until the front LED flashes rapidly.. about 10sec.
Release the reset.
Open the airport utility and setup the TC to bridge mode.
The actual method depends on version of the OS and airport utility you use.
This is version 5.
Sorry I cannot post the v6 as I am on a snow leopard computer now. But you go to the network tab, and choose off bridge mode for method of connection. It will be NAT and dhcp by default.
Then setup wireless.. you have a number of choices here.
Either setup with the same SSID Security and password, as the homehub uses.. or a different name, and password..
Each method works fine.. but you sometimes have issues with wireless channels.. for now leave it on auto and see what happens.. if you have issues lock down the radio channels on both devices.. use one out of the following on each, 1, 6, 11 or 13 in UK.. so say 6 on the homehub then 13 onthe TC.
Update the TC.. unplug fromt the computer and plug it into the homehub.
If you have other issues with the setup tell us what OS you run so we can post suitable screenshots.
Maybe you are looking for
-
I read online to reset the default settings on chrome and when i did that the problem seemed to all but go away. But then, not even an hour later, i notice that there are random ads that popup and sometimes ads will just open in new tabs. I know that
-
Hopefully this is in the right topic, if not I'll move it or re-post it. I installed a nice little app called Right Zoom, which lets you click the green button on the top left of any window to full-screen it. Well-known app, no problems, etc... I use
-
File upload hanging when called from another form
Hi I have created a file upload form from the documentation I found on metalink and the form works fine on its own. I have then implemented the form into a multi form application and when the file upload form is called from another form it hangs tryi
-
Can one put four operating systems on a Mac?
At the local Senior Center the Windows computers they have been using for computer instructions are dying. I want to suggest replacing them with Mac Minis. Among the people who go there there is a growing interest in learning Mac OSX that the Center
-
Managed user account can't be accessed thru admin account
In trying to get a handle on my 14 year old son's computer habits I established myself with an administrator account and his user account is managed by me through parental controls. When in my Admin account I go through System Preferences> Accounts.