I think a trojan virus has infected my iMac. How can I remove it?

My iMac has been acting weirdly opening new tabs on my internet explorer (usually betting or **** stuff). I have downloaded ClamXav and ran a few scans but nothing other than finding emails with the virus (which I have obviously deleted).
Now one on my mailbox has been acting weirdly too in that I can't connect. I tried to connect via a webmail and the password wasn't working. I then changed the password on the control panel for the same mailbox and it works on all my devices (phone, iPad) but each time I try to change the password on my iMac, nothing... and then within a few minutes my password doesn't work on my other devices either.
I have now deleted the mailbox in despair but I guess that doesn't clean my Mac.
I also downloaded the OS Yosemite today int he hope the upgrade would clean my Mac.
Any suggestion? software I can buy to scan my iMac. I know Symantec is not compatible.
Thank you.
C.

You may have installed the "VSearch" trojan. Remove it as follows.
Malware is always changing to get around the defenses against it. These instructions are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data before proceeding.
Step 1
From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
Reset the home page and default search engine in all the browsers, if it was changed.
Step 2
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
          Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
The problem may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the Internet criminal behind VSearch has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing has not done so, even though it's aware of the problem. This failure of oversight has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination  command-C. In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Similar Messages

  • Just bought my iphone 5s and it has the android software how can I remove it?

    Just bought my iphone 5s and it has the android software how can I remove it?

    Pictures...or you are fibbing!!!

  • I have a trojan on my iMac, how can I remove it?

    I have what I believe is a trojan. Basically what it does is redirect me to http://flvdirect.iamwired.net/ when I'm under Safari.
    I've researched this issue and couldn't really find people who had this issue on Mac, even on PC it seems to be rare.
    But I think I know what caused it. Earlier today I looked for a way to download Youtube videos. There's several sites where you enter the link, and they ask you to accept something (my Mac warned me that I'm at my own risk). Obviously I declined, but I kept looking around for another solution. Finally I found a Safari extension on a site like Softpedia (don't remember the name however), and I even still have the DMG file: youtube_downloader_pro_mac-1.0.0.0-sf-macosx10.6.dmg
    Strangely enough, the "extension" doesn't appear in the Safari extensions menu, and I can't find it anywhere else on my computer either. I tried looking for all possible names or for all possible "culprits" in various folders (Preferences, Logs, Cache, etc.) and also with CCleaner. How can I get rid of it?
    I've noticed that it's only on Safari. I renewed the DHCP-Lease, don't ask me why, thought it might help. It reset some stuff. I removed proxies (I think I was using these before, but the trojan might have hacked them in somehow, at least I've read about that), and weirdly enough in the WLAN section of the Network preferences, there was another Wlan hotspot, that I had never seen. I had never seen any WLAN around here actually because there isn't really anyone using it. But maybe I'm wrong. What's weird is that it says "Preferred networks", when clearly, I never connected with that.
    I searched for WLAN networks again now, and I can't find this network anymore. Too bad that I removed it from the list already, I should have written down the name first. It started with "ml".
    I also noticed that my Safari home page was set to Iamwired.net, that's probably the reason why it redirected me there. What can I do people?
    I'm thankfull for all answers! That's the first time something like this happened to me!
    Cheers!

    @ etresoft: Well, I downloaded it from the official Java site, so I supposed it should be safe! And by the way, how do I know you're software doesn't contain malware now?
    @ Thomas: I read your article and removed those internet plugins. I also removed anything Java related, or at least I believe I did. I didn't notice anything suspicious in the internet plugins however. I'm still bothered where this "Youtube downloader" plugin has gone. I mean I've installed it, it MUST be somewhere...
    If you want I can send you that DMG file, in case you think you could analyse it somehow? I still have the site I downloaded it from somewhere in my history, it shouldn't be hard to find it. But I don't want you to get infected as well, so I wouldn't open it! Perhaps you can analyze it in a way without opening it however?
    For now however, Safari seems to work. No more redirecting. Java is allowed, so are plugins and also extensions. I'm still worried that the thing is hiding somewhere in my computer and that it may get hold of private data.
    I've run an app called VirusBarrier express earlier (downloaded from the App store, should be safe!), it scanned by whole computer and didn't find anything. But then... it may not have found anything because this isn't a virus, right? Do you believe it can found trojans or other malware?
    @ etre: I've still run your program and don't think I've noticed anything suspicious! I don't want to post everything on here since it also may contain private data (I saw an email address) so maybe you can tell me what to look out for? There's a few things where it says "failed" but I've had these for ages.

  • PCPowerBoost has taken over FireFox; how can I remove it?

    When downloading Adobe Flash, I got a bundle of other stuff (unwanted). I was able to uninstall all but PCPowerBoost 1.0.5. That seems to have infected FireFox. When I open FireFox, the search engine that comes up is Astromendia. I deleted that from my list of programs but I believe it's embedded in PCPowerBoost. I have uninstalled and reloaded FireFox but with the same result. How can I get rid of PCPowerBoost?

    Hello,
    Please see one of these guides:
    * http://malwaretips.com/blogs/remove-astromenda-virus/
    * http://malwaretips.com/blogs/astromenda-removal/
    If you have already uninstalled it, likely there are just some residual files leftover. You can first check your extensions to see if that didn't get removed:
    * Tools (or [[Image: New Fx Menu]]) > Add-ons > Extensions
    Try running the scans outlined in the guides above (download links here as well):
    * [http://www.malwarebytes.org/products/malwarebytes_free/ MalwareBytes' Anti-Malware]
    * [http://general-changelog-team.fr/en/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner AdwCleaner] (for more info, see this [http://www.bleepingcomputer.com/download/adwcleaner/ alternate AdwCleaner download page])
    You can use the [https://addons.mozilla.org/en-US/firefox/addon/searchreset/ Search Reset Tool] extension to reset some of your settings. Installing this will set your home page, new tab page, and search preferences to the default settings and then the extension will uninstall itself.

  • HT1904 I sent a gift certificate to someone who's email account has been deleted by the provider and my credit card has been billed. How can I remove or retrieve said gift certificate? Any ideas?

    I guess it goes without saying it was an iTunes gift cert.

    You can either try resending it somebody else : http://support.apple.com/kb/HT1541
    Or you can try contacting iTunes Support and see if they will refund or credit you : http://www.apple.com/support/itunes/contact/ - click on Contact iTunes Store Support on the right-hand side of the page, then Purchases, Billing & Redemption

  • How can I remove viruses off my computer? I have mac OS X, but I clicked on a website on google and it didn't open. Instead the security program popped up and said that my computer is at risk of a crash and has detected several viruses!?!?! AAAAHHH!?!?!

    How can I remove viruses off my computer? I have mac OS X, but I clicked on a website on google and it didn't open. Instead the security program popped up and said that my computer is at risk of a crash and has detected several viruses!?!?! AAAAHHH!?!?!

    MnM
    It's probably the MacDefender scareware trojan horse. If you have this here is how to remove it.
    1. Open Activity Monitor look for MacDefender process double click on it and hit quit or force quit.
    2. Go to System Preferences, Go to accounts, Go to login items look for anything related to MacDefender hightlight it by clcking on it once. Then hit the minus sign to remove it.
    3. Go to applications folder and drag MacDefender to the trash.
    4. Open finder and do a search for Macdefender and remove anything you see related to MacDefender.
    5. Open Spotlight (the little magnyfing glass in the menubar far right corner) and do a search for MacDefender.
    6. Restart your computer and empty trash.
    7. If you feel you need to have virus protection for your Mac use ClamXav. It's the recommended AV program for MacOSX. Hope this helps.
    Joseph

  • I have a jailbroked iphone,and  it seems that it has some viruses how can I remove them from my iphone?

    I have a jailbroked iphone,and it seems that it has some viruses how can I remove them from my iphone?

    You have viruses because you jailbroke your phone, and now you're probably spreading them to other phones. Nice.
    Jailbroken phones are generally bricked for good. Throw it away, it's junk.

  • I have iPhone 4s, and using latest iOS. When I try to open any link from Twitter or Facebook, it goes to open some wrong webpage. My iphone seems to be infected or suffering from some spyware or malware. How can I remove this wrong link opening

    I have iPhone 4s, and using latest iOS. When I try to open any link from Twitter or Facebook, it goes to open some wrong webpage. My iphone seems to be infected or suffering from some spyware or malware. How can I remove this wrong link opening ? Please help me to resolve...

    I think the McAfee suite will do the trick when I pay them a one-time fee of $69 or $179 for a year for unlimited support.
    Your call of course but IMO a waste of money. Please read this first:
    There are many forms of ‘Malware’ that can affect a computer system, of which ‘a virus’ is but one type, ‘trojans’ another. Using the strict definition of a computer virus, no viruses that can attack OS X have so far been detected 'in the wild', i.e. in anything other than laboratory conditions. The same is not true of other forms of malware, such as Trojans. Whilst it is a fairly safe bet that your Mac has NOT been infected by a virus, it may have another security-related problem, but more likely a technical problem unrelated to any malware threat.
    You may find this User Tip on Viruses, Trojan Detection and Removal, as well as general Internet Security and Privacy, useful:
    https://discussions.apple.com/docs/DOC-2435
    The User Tip (which you are welcome to print out and retain for future reference) seeks to offer guidance on the main security threats and how to avoid them.
    More useful information can also be found here:
    http://www.reedcorner.net/mmg/

  • I have a virus, how can I remove it

    All of the sudden I have all of these pop ups.  I think that this virus has even invaded my campus email?  What is the best way to scan my computer (free) and remove this?

    Click here and follow the instructions, or if there’s a type of adware not covered by them on the computer, these ones. If you're willing to use a tool to remove it(you don't need to, but may find it easier), you can instead run Adware Medic; this link is a direct download.
    (121536)

  • My Internet company sent a notification saying I had a "BOT" virus on my computer and that they would shut my internet access down permanently! They given 48 hours to fix it. How can I remove this virus!?

    My Internet company sent me a notification saying I had a "BOT" virus on my computer and that they would shut down my internet access. They given 28 hours to remove this virus. How Can I remove this thing!?

    Flashback is only one possibility.  See About the Flashback malware for information about it and how to get rid of it.
    Unfortunately, these kinds of problems can happen for a variety of other reasons.  There's very little malware that actually can cause a Mac to become part of a botnet.  You could have an infected Windows PC on your network.  (Perhaps because of a visitor or because you're using an open, unencrypted wireless network and have a "squatter.")  Or it could be false positives.
    If you do all the checks mentioned on my Flashback page and still can't find any infection, you need to lock down your wireless network (change the security to WPA2 with a strong password) and check out any Windows machines that are on your network.
    (Note that my pages contain links to other pages that promote my services, and this should not be taken as an endorsement of my services by Apple.)

  • ICal on my Macbook has always grayed the current date. iCal on my MacMini (both 10.5.8) never has until a few days ago but has since stopped. How can I get it to "shade" again?

    iCal on my Macbook has always grayed the current date. iCal on my MacMini (both 10.5.8) never has until a few days ago but has since stopped. How can I get it to "shade" again?

    At this point I think you should get Applejack...
    http://www.macupdate.com/info.php/id/15667/applejack
    After installing, reboot holding down CMD+s, (+s), then when the DOS like prompt shows, type in...
    applejack AUTO
    Then let it do all 6 of it's things.
    At least it'll eliminate some questions if it doesn't fix it.
    The 6 things it does are...
    Correct any Disk problems.
    Repair Permissions.
    Clear out Cache Files.
    Repair/check several plist files.
    Dump the VM files for a fresh start.
    Trash old Log files.
    First reboot will be slower, sometimes 2 or 3 restarts will be required for full benefit... my guess is files relying upon other files relying upon other files! :-)
    Disconnect the USB cable from any Uninterruptible Power Supply so the system doesn't shut down in the middle of the process.

  • It Gives me no reason this message often the first to enter my pass:" When you can not buy Equilibrium - Leonardo da Vinci's Balance Puzzle " and 27other elements. Please try again later". How can I remove this annoyng message? Maybe it's a Virus?

    It Gives me no reason this message often the first to enter my pass:" When you can not buy Equilibrium - Leonardo da Vinci's Balance Puzzle " and 27other elements. Please try again later". How can I remove this annoyng message? Maybe it's a Virus?

    The old rule of thumb was to keep 10-12 GB free. Any lower than that and you will start to have trouble. I was very close to that for a long time and never had any complaints. Now, Lion "encourages" 20% free space (on my newer 250 GB drive) so I try to keep it with more than 50 GB free.
    Do you still have the original memory in that machine too? The metal plate you have to remove in the battery compartment also provides access to the RAM. Your machine will take 2 GB of RAM, possibly 3. You definitely want to max that out too.
    Regardless, you definitely need a new hard drive. When Apple switched to PC components, they had to take a quality hit. These 2.5" notebook hard drives are not very reliable. I'm surprised your hard drive hasn't died by now. I usually get a new hard drive with every major OS upgrade. A $ 50 investment every couple of years is no big deal.
    Unfortunately, you (and I) suffer from being an early adopter in 2006. Those 32-bit machines only accept 2 GB RAM (maybe 3) and are only 32-bit so they can't be upgraded to Lion. Because of this limitation, you won't see as dramatic an improvement as you would with a 2007 machine. If you run more than a couple of applications, your hard drive is always going to have to be doing some VM work. My 2006 machine has even lost its bluetooth. I gave it to my brother. My very similar 2007 Macbook is still running great.
    So, you must get a new hard drive because your old one is likely on death's door. If you don't have at least 2 GB - get it. If you can't afford a new machine, you might want to consider an SSD. That might help mitigate your RAM limitations. You can spend from $ 100 to $ 350 and get a dramatic speed improvement.

  • I have a MacBook Pro and someone has inserted a mini disc in the disc drive and I can not eject it or even get it to read, How can I remove it?

    I have a MacBook Pro and someone has inserted a mini disc in the disc drive and I can not eject it or even get it to read, How can I remove it?

    Sounds like to me that you have a bootcamp partition with Windows and have the default Windows to boot first.
    I think there is a Windows Control Panel or other setting while your in Windows to set the OS X as the first boot option.
    Also in OS X there is a option under the System Preferences to set OS X as the first boot option.

  • My Iphone has family emails that appear randomly when I try to update apps or generally have to log into my account. It comes up as my sister in laws address. She was once connected to our account when she got her phone at first. How can I remove?

    My Iphone has family emails that appear randomly when I try to update apps or generally have to log into my account. It comes up as my sister in laws address. She was once connected to our account when she got her phone at first. How can I remove? There are only two other email address's associated with my account and hers was never one of them! I do have a cloud set up on my phone. I thought this issue had gone away when I canged my passwords, but I just registered a new phone yesterday and its happening again!
    Can anyone help me?

    Apps are permanently tied to the Apple ID used to purchase them, and all future updates will require you to enter the password associated with this ID, whether you are currently using this ID for purchases or not.  If you are being prompted for your sister-in-law's Apple ID when updating it means that there must be one or more apps on your phone that was purchased using her Apple ID.  (When she synced with your computer it may have transferred this app to your library.  It was subsequently synced to your phone.)  The only way to stop the prompt for her ID is to delete these apps from your phone and your iTunes library and repurchase them using your Apple ID.

  • My iPhone has two computers in (iTunes wifi sync), how can I remove one of them without using it ?

    Hello everyone.
    My iPhone has two computers in (iTunes wifi sync) how can I remove one of them without using that computer?
    because that PC stopped working so I had to recover it. Now everything is gone on that PC.
    Also I bought a new computer (MacBook Pro) and I use iTunes on it in the mean time. Now I want to remove the old computer!
    here is a photo of my (iTunes WiFi sync)
    is there any way that I can use to do that?
    Thanks

    Hello,
    Did you ever find a solution for this ?
    I have the same issue and i dont know how to fix it.

Maybe you are looking for

  • How to translate the text dynamically in the program?

    Hi All, I have a requirement where I need to translate the text dynamically in the program based on the Language Key retrieved. Let's say that the Login language is 'EN' and in the logic has retrieved the language 'IT'(based on some conditions). I ha

  • Query regarding display values

    Hi, I Have a Table with column name as agent_name guest billing i have to display report as                                             2010                      2009 Agent_name           guest        billing        guest     billing abc             

  • Links disappear in active state

    Hey there, for my navigation bar I have created several text boxes. I use three different colors for the states "Normal", "Rollover" and "Active". However, when I visit page 2 for instance, the menu bar on top doesn't display "page 2" in my active co

  • I want to put music on my iPhone but when I want to do it it keeps telling me that I can't to id with a sign. Please help me?

    I want to put music on my iPhone but when I want to do it it keeps telling me that I can't to id with a sign. Please help me?

  • Sharing all files

    I'm connecting my iBook and iMac through Airport and am brand new at this. From reading the discussions here, am I correct that it's not possible to share my files unless they're in the "Shared" folder? I'd like to be able to access my account easily