Pop-ups and possible virus?

I'm using a MacBook Air purchased approximately 6 months ago.
I just downloaded version 7.1.2 for safari tonight while trying to fix the problem.
I watch movies and tv shows a lot that require new flash player installations and I believe this has to do with it.
I think I downloaded a faulty install and now I have lots of pop-ups and I can't click anything on any website without an additional tab with a weird website or something pulling up.
My internet is slower now.
It changed my homepage on both browsers to "trovi" whatever that is.
I deleted all of the downloads I found that I thought might have caused the problem, but it didn't fix anything.
I manually changed my homepage back to google, but the pop-ups continue to happen when I visit any website.

There is no need to download anything to solve this problem.
You may have installed the "Trovi," "Conduit," or "SearchProtect" ad-injection malware. Follow the instructions on this Apple Support page to remove it.
Back up all data before making any changes.
Besides the files listed in the linked support article, you may also need to remove these files in the same way:
~/Library/Application Support/Firefox/searchplugins/MyBrand.xml
~/Library/Application Support/Google/Chrome/External Extensions/fjadmdmahkpbhgbmmkiiaanlnlekelmn.json
~/Library/Application Support/Mozilla/Extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}/[email protected]
One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those. If Safari crashes on launch, skip that step and come back to it after you've done everything else.
If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, then you may have one of the other kinds of adware covered by the support article. Follow the rest of the instructions in the article.
Make sure you don't repeat the mistake that led you to install the malware. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.
"SearchProtect" may be distributed along with two other applications: "MacKeeper," which is a scam, and "ZipCloud," which, if not actually a scam, has a dubious reputation. Ask if you need instructions to remove those items.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates
if it's not already checked.

Similar Messages

My safari has random pop ups and opens new ad tabs

Hi there!
Ever since a few days I have some issues with random advertisements, pop-ups and my safari even opens up new tabs, when I open up another tab. It's really annoying and I read that it could be a virus that's constantly changing, so 'old' solutions might not be applicable anymore, so that is why I am opening a new discussion. Also, I read about firstly making a back-up, does this need to be done with an external hard drive?
Thanks so much in advance!
These are print screens of the pop ups

There is no need to download anything to solve this problem.
You may have installed the "VSearch" trojan. Remove it as follows.
Malware is always changing to get around the defenses against it. These instructions are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data before proceeding.
Step 1
From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
Reset the home page and default search engine in all the browsers, if it was changed.
Step 2
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
          Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
The problem may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the Internet criminal behind VSearch has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing has not done so, even though it's aware of the problem. This failure of oversight has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Adware pop ups and redirects to strange websites....

I have the 10.9.3 software on my mac. I recently downloaded the adware removal tool from thesafemac because I had a bunch of pop ups and redirects in safari. Here are a few examples of whats popping up: mackeeperapp2.zeobit.com & unizz.exclusiverewards.dollfield.eu
It also started affecting both my wife’s and my iPhones 5s and ipad air in safari - lots of redirects and taking me to the App Store…
Any idea how to move forward with this?

There are two possibilities: either the router has been hacked to direct DNS queries to a malicious server, or it's using the right DNS servers, but those servers have been hacked. The first possibility is more likely.
Follow the manufacturer's instructions to reset the router to the default state. Usually that involves inserting the end of a straightened paper clip or a similar tool into a pinhole somewhere in the back of the device, and pressing a switch inside for about 15 seconds. The pinhole may be marked "RESET."
Repeat the initial setup process. Make sure the router does not allow remote setup from the Internet (WAN port), if it has that feature—most do. The DNS servers should be set automatically by your ISP. If you still have trouble with those servers selected, contact your ISP.
Another option, if your ISP fails to secure its servers promptly, is to use an alternative DNS service such as Google DNS or OpenDNS. I don't recommend either one. Don't believe the marketing hype about OpenDNS, in particular. There are no advantages to using it if your ISP is delivering the service you pay for.
If you have a wireless network, it must be secured with WPA 2 encryption. The passwords for the network and the router must each be a string of at least 10 random upper- and lower-case letters and digits, and they should be different. Any password that you can remember is weak.

Pop-ups and new tabs opening when I try to browse

Hello
I'm having trouble with pop-ups and new tabs for 'Mackeeper' among others, launching themselves in Safari on my MacBook Air. This has only just started after having the laptop for 3 months.
Operating system: OS X 10.9.4 (13E28)
Speed: 1.4 GHz Intel Core i5
Storage capacity: 4 GB 1600 MHz DDR3
I have tried troubleshooting by looking in 'Extensions' but there's nothing to remove. I've also tried Forum Member Linc Davis' advice, but unfortunately that's not working either.
I've tried all of the suggestions below, but nothing's working. It is driving me bonkers, so if anyone can help I would be most grateful.
Thank you
Jess
Linc DavisJul 10, 2014 8:22 AM Re: ANNOYING MACKEEPER TABS AND POPUP ADS
Re: ANNOYING MACKEEPER TABS AND POPUP ADSin response to chickashnaz
You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
          Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Click here and follow the instructions, or if there’s a type of adware not covered by them on the computer, these ones. If you're willing to use a tool to remove it(you don't need to, but may find it easier), you can instead run Adware Medic; this link is a direct download.
(122872)

I am having trouble with a lot of pop ups and causing websites and screens to roll slowly, firewall is on, how do i prevent this

I am having trouble with a lot of pop ups and causing websites and screens to roll slowly, firewall is on, how do i prevent this

You installed adware along with something else.
You can either follow Apple's manual instructions for removing it, or use the free automated tool, AdwareMedic.

How do I get rid of spam pop ups and ads?

how do I get rid of spam pop ups and ads?

It's malware.
Help here ..
The Safe Mac » Adware Removal Guide
The Safe Mac » Genieo
The Safe Mac » Mac Malware Guide

The content tab will not open on the options pannel so i can deal with pop ups and adds and its driving me nutts

i get pop ups and ads and i am tired of it, and "Do these suggestions help" over and over again is not helping.

Start Firefox in <u>[[Safe Mode|Safe Mode]]</u> to check if one of the extensions (Firefox/Firefox/Tools > Add-ons > Extensions) or if hardware acceleration is causing the problem (switch to the DEFAULT theme: Firefox/Firefox/Tools > Add-ons > Appearance).
*Do NOT click the Reset button on the Safe Mode start window.
*https://support.mozilla.org/kb/Safe+Mode
*https://support.mozilla.org/kb/Troubleshooting+extensions+and+themes

Bad pop ups and this thing called macsweeper. what us it and how do I get rid of it

I gave bad pop ups and this thing called macsweeper. What is it and how do I get rid of it. Thanks

There is no need to download anything to solve this problem.
You may have installed one or more of the common types of ad-injection malware. Follow the instructions on this Apple Support page to remove it. It's been reported that some variants of the "VSearch" malware block access to the page. If that happens, start in safe mode by holding down the shift key at the startup chime, then try again.
Back up all data before making any changes.
One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those. If Safari crashes on launch, skip that step and come back to it after you've done everything else.
If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, ask for further instructions.
Make sure you don't repeat the mistake that led you to install the malware. It may have come from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.
Malware is also found on websites that traffic in pirated content such as video. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates (OS X 10.10 or later)
or
Download updates automatically (OS X 10.9 or earlier)
if it's not already checked.

Pop-ups and redirects

I am getting a ton of pop-ups and redirects when connected to my home internet service. My ISP claims it not them. This doesn't happen when I travel or when I use my business internet service from another provider. My wife has the same issue. Between us we have three iPads and all exhibit the same issue.

You could try a pop up blocker on the iPad - I use this one
Adblock Mobile — Protect your phone from annoying ads. Best ad blocker to block advertisements on your iPhone and iPad. by Jennifer Hernandez
https://appsto.re/gb/2uU02.i

I downloaded Yosemite and now I have lots of pop ups and my safari isn't working correctly. How do I remove Yosemite?

I downloaded Yosemite and now I have lots of pop ups and my safari isn't working correctly. How do I remove Yosemite?

Click here and follow the instructions, or if desired, run Adware Medic; the second link is a direct download.
(115459)

My MAC is running slowly and I am having to continually remove unwanted pop ups and leave unwanted pages which appear including MACkeeper. If I am on a sports website, betting pages appear - any ideas?

My MAC is running slowly and I am having to continually remove unwanted pop ups and leave unwanted pages which appear including MACkeeper. If I am on a sports website, betting pages appear - any ideas?

Click here and follow the instructions, or if there’s a type of adware not covered by them on the computer, these ones. If you're willing to use a tool to remove it(you don't need to, but may find it easier), you can instead run Adware Medic; this link is a direct download.
(120718)

I updated to mozilla firefox 18.0.2. the fox is gone, but there are lots of pop-ups and no way to disable them. i want to TALK to someone, please

Last week i downloaded Filezilla to edit my web page. When i did so, the firefox page looked weird -- there was no fox. The page has a WhiteSmoke icon instead. So i updated to mozilla firefox 18.0.2. The fox is still gone, but there are lots of pop-ups and no way to disable them. i want to TALK to someone, please

Sorry this is really your only support option. The live chat support option was closed down last year.
Maybe attaching some screen shots will help us understand your problem. I am not sure I understand about ''the fox is gone'' & ''he page has a WhiteSmoke icon instead. ''
* see [[How do I create a screenshot of my problem?]]

Inappropriate websites and now my computer has all these pop ups and ads.

Younger cousin was on "xxx" websites and I need help stopping pop ups and ads from computer. Any solutions?
It is on google chrome and my safari. Please help me figure out how to get this off my MacBook Air
<Edited by Host>

You may have installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
          Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot" or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

I have adblock but still get pop ups and ads

I get pop ups and ads on both safari and google chrome and have an adblocker on both. These pop ups are ads in many different ways most common is a new tab opening usually that stupid mac keeper website.

You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
          Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
Restart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
          Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot" or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
          Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Just installed Malwarebyte and i am still getting unwanted pop ups and new windows.

Just installed Malwarebyte and i am still getting unwanted pop ups and new windows.

You can supplement your Malwarebytes Anti-Malware scan with some other tools Firefox users have found effective. See: [[Troubleshoot Firefox issues caused by malware]].
But it also makes sense to check a couple of things manually.
(1) Extensions installed in Firefox
Open the Add-ons page using either:
* Ctrl+Shift+a
* orange Firefox button (or Tools menu) > Add-ons
In the left column, click Extensions. Then take a careful look and disable everything you either don't recognize or don't use regularly. If Firefox prompts you to restart to make the change effective, you can do that as the last step after completing your review of the list.
(2) Windows Control Panel, Uninstall a Program
Click the "Installed on" column heading to bring the most recent infections, I mean, additions, to the top. This is useful in revealing bundles that may have snuck unwanted software onto your PC. Remove everything you don't remember choosing intentionally.
Any improvement?

Pop-ups and possible virus?

Similar Messages

Maybe you are looking for