9 Replies Latest reply: Apr 23, 2014 9:10 AM by lzov
atmagee Level 1 Level 1 (5 points)

Hello,

 

Recently i have noticed that safari is displaying ads on some websites, example below on BBC. These ads do not belong to the site as they are not there with Fire fox. The ads can appear as a Pop up within the window or form what you would assume is part of the actual website. I have also seen them hijack links in Untitled.jpgUntitled1.jpg

sites and redirect me in the wrong direction. I have tried running iAntivirus but suspect this is a little more sofisticated.

 

Any help would ne appreciated.

 

Thanks


iMac, OS X Mountain Lion (10.8.1)
  • 1. Re: Safari displaying embedded ads?
    thomas_r. Level 7 Level 7 (27,960 points)

    If you're seeing these underlined words on all sites, you probably have some crapware installed. Check the Extensions tab in Safari's preferences, you've almost certainly got something installed there that is doing it.

     

    If that's not it, it could be a little more well-hidden as an internet plug-in. Copy the following command and paste it into the Terminal (found in /Applications/Utilities), then press return:

     

    ls -al ~/Library/Internet\ Plug-Ins; ls -al /Library/Internet\ Plug-Ins

     

    Then paste the results of that command into a message here.

     

    If that doesn't show anything promising, another possibility is that when you are using some free wifi networks, ads will be inserted like this as a way of paying for the free service. This isn't terribly common, but it does happen. If you see it happening on one particular network, it's an issue with that network and you should complain loudly to the owner of that network.

  • 2. Re: Safari displaying embedded ads?
    atmagee Level 1 Level 1 (5 points)

    Many Thanks, had some weird extension installed. All sorted now.

  • 3. Re: Safari displaying embedded ads?
    thomas_r. Level 7 Level 7 (27,960 points)

    What was the name of the extension? That would be interesting for others suffering from the same problem to know.

  • 4. Re: Safari displaying embedded ads?
    Manderse Level 1 Level 1 (0 points)

    I too am having this redirect problem  with Safari Version 6.0.2 (8536.26.17) on MacBook Pro Late 2008 Software  OS X 10.8.2 (12C60).  The redirects are constant now, so I can't even use Safari.  I also get hidden audio ads.  I tried the above fix in Terminal, and the results are copied below.  How do I find and remove possible hidden extensions? --Michael

     

    Macintosh-5:~ michaelandersen$ ls -al ~/Library/Internet\ Plug-Ins; ls -al /Library/Internet\ Plug-Ins

    total 24

    drwx------@  7 michaelandersen  michaelandersen   238 Jul 31 08:06 .

    drwx------@ 68 michaelandersen  michaelandersen  2312 Oct 11 15:15 ..

    -rw-------@  1 michaelandersen  michaelandersen  6148 May 20  2011 .DS_Store

    -rw-r--r--   1 michaelandersen  michaelandersen   288 Aug  2  2006 .GlobalPreferences.apple.plist

    drwxr-xr-x@  3 michaelandersen  michaelandersen   102 Oct 14  2009 Move-Media-Player.plugin

    drwxr-xr-x   3 michaelandersen  michaelandersen   102 Mar 29  2010 Picasa.plugin

    drwxr-xr-x@  3 michaelandersen  admin             102 Mar 30  2010 doubleTwistWebPlugin.bundle

    total 784

    drwxr-xr-x  22 root             wheel               748 Nov 10 16:51 .

    drwxr-xr-x+ 66 root             wheel              2244 Sep 20 08:04 ..

    -rw-r--r--@  1 michaelandersen  admin              6148 Sep  5  2009 .DS_Store

    drwxrwxr-x   3 root             wheel               102 Sep 11 20:26 AdobePDFViewer.plugin

    -rw-r--r--@  1 michaelandersen  admin            190164 Dec 30  2009 Citrix online plug-in

    drwxr-xr-x@  3 root             admin               102 Dec 29  2009 CitrixICAClientPlugIn.plugin

    drwxrwxrwx   3 michaelandersen  michaelandersen     102 Nov  2  2008 DRM Plugin.bundle

    drwxrwxr-x   3 root             admin               102 Feb  7  2011 DivXBrowserPlugin.plugin

    drwxrwxr-x   3 root             admin               102 Jul 29  2009 EPPEX Plugin.plugin

    drwxrwxr-x   3 root             admin               102 Sep 28  2010 Easy-WebPrint EX.plugin

    drwxrwxr-x   3 root             wheel               102 Nov 10 16:51 Flash Player.plugin

    drwxrwxr-x   3 root             admin               102 Jan 13  2011 Flip4Mac WMV Plugin.plugin

    drwxrwxr-x   3 root             admin               102 Jan 13  2011 Flip4Mac WMV Plugin.webplugin

    drwxr-xr-x@  5 michaelandersen  admin               170 May  6  2010 Google Earth Web Plug-in.plugin

    lrwxr-xr-x   1 root             wheel                80 Nov 12  2011 JavaAppletPlugin.plugin -> //System/Library/Java/Support/CoreDeploy.bundle/Contents/JavaAppletPlugin.plugi n

    drwxr-xr-x   3 root             admin               102 Feb  7  2011 OVSHelper.plugin

    drwxr-xr-x   3 root             wheel               102 Jun 20 15:50 Quartz Composer.webplugin

    drwxr-xr-x   3 root             wheel               102 Jun 20 15:18 QuickTime Plugin.plugin

    drwxrwxr-x   3 root             admin               102 Apr 11  2012 Silverlight.plugin

    -rw-rw-r--   1 root             admin               856 Oct 28 18:32 flashplayer.xpt

    drwxrwxr-x   3 root             admin               102 Jul 14  2008 iPhotoPhotocast.plugin

    -rw-r--r--   1 root             wheel              2394 Jul 31 01:19 nsIQTScriptablePlugin.xpt

    Macintosh-5:~ michaelandersen$

  • 5. Re: Safari displaying embedded ads?
    thomas_r. Level 7 Level 7 (27,960 points)

    You have a number of items installed that I am unfamiliar with. First, quit Safari. Then, in the Finder, hold down the option key and choose Library from the Go menu. In the window that opens, select the Internet Plug-Ins folder and move everything except the Picasa.plugin item to the desktop. (That one is fine.)

     

    The difficulty is that there is a hidden item in there that shouldn't be there, which is highly suspicious. Open the Terminal and paste in the following command:

     

    mv ~/Library/Internet\ Plug-Ins/.GlobalPreferences.apple.plist ~/Desktop/GlobalPreferences.apple.plist

     

    That should move the hidden item to the desktop and also rename it so that it's visible.

     

    Next, go to the Library folder at the root level of your hard drive and open the Internet Plug-Ins folder there. The items that I am not familiar with are:

     

    AdobePDFViewer.plugin

    Citrix online plug-in

    CitrixICAClientPlugIn.plugin

    DRM Plugin.bundle

    DivXBrowserPlugin.plugin

    EPPEX Plugin.plugin

    Easy-WebPrint EX.plugin

    Google Earth Web Plug-in.plugin

    OVSHelper.plugin

    Silverlight.plugin

     

    Note that the ones I think you should probably try removing are marked with a bold font, but be sure you're actually using the functionality of the others. If you're not, remove them as well. (Note that Safari is perfectly capable of displaying PDF files without the AdobePDFViewer plugin, though that plugin doesn't have any relevance to this particular problem.)

     

    Once you have removed all suspicious or unused plugins, open Safari again and see if the problem is gone.

     

    Note that if you want to find out exactly which item caused the problem, you can remove these plugins one at a time, quitting Safari each time and reopening for testing. When the problem goes away, whichever one you last removed is the culprit.

  • 6. Re: Safari displaying embedded ads?
    stefdaza Level 1 Level 1 (0 points)

    Hi thomasr I am currently having the same exact problem, but i have nothing installed on the safari estension and I did what said to atmagee and these are the results

    total 8

    drwxr-xr-x  11 root  wheel   374 12 Apr 17:41 .

    drwxr-xr-x+ 63 root  wheel  2142 12 Apr 14:38 ..

    drwxr-xr-x   3 root  wheel   102 24 Nov 03:10 Default Browser.plugin

    drwxrwxr-x   3 root  wheel   102 12 Apr 14:38 Flash Player.plugin

    drwxr-xr-x   3 root  wheel   102 25 Aug  2013 Quartz Composer.webplugin

    drwxr-xr-x   3 root  wheel   102 24 Nov 03:12 QuickTime Plugin.plugin

    drwxrwxr-x@  3 root  admin   102 25 Aug  2010 SharePointBrowserPlugin.plugin

    drwxrwxr-x   3 root  admin   102 25 Aug  2010 SharePointWebKitPlugin.webplugin

    drwxrwxr-x   3 root  admin   102 14 Feb 10:35 Silverlight.plugin

    -rw-r--r--   1 root  wheel   856 27 Mar 02:53 flashplayer.xpt

    -rw-r--r--   1 root  wheel  2394 20 Jan 21:25 nsIQTScriptablePlugin.xpt

    MacBook-Pro-de-ANDREA:~ ANDREA$

  • 7. Re: Safari displaying embedded ads?
    stefdaza Level 1 Level 1 (0 points)

    Hi thomasr I am currently having the same exact problem, but i have nothing installed on the safari estension and I did what said to atmagee and these are the results

    total 8

    drwxr-xr-x  11 root  wheel   374 12 Apr 17:41 .

    drwxr-xr-x+ 63 root  wheel  2142 12 Apr 14:38 ..

    drwxr-xr-x   3 root  wheel   102 24 Nov 03:10 Default Browser.plugin

    drwxrwxr-x   3 root  wheel   102 12 Apr 14:38 Flash Player.plugin

    drwxr-xr-x   3 root  wheel   102 25 Aug  2013 Quartz Composer.webplugin

    drwxr-xr-x   3 root  wheel   102 24 Nov 03:12 QuickTime Plugin.plugin

    drwxrwxr-x@  3 root  admin   102 25 Aug  2010 SharePointBrowserPlugin.plugin

    drwxrwxr-x   3 root  admin   102 25 Aug  2010 SharePointWebKitPlugin.webplugin

    drwxrwxr-x   3 root  admin   102 14 Feb 10:35 Silverlight.plugin

    -rw-r--r--   1 root  wheel   856 27 Mar 02:53 flashplayer.xpt

    -rw-r--r--   1 root  wheel  2394 20 Jan 21:25 nsIQTScriptablePlugin.xpt

    MacBook-Pro-de-ANDREA:~ ANDREA$

     

    Im sorry im new in all this discussion chat :S

  • 8. Re: Safari displaying embedded ads?
    thomas_r. Level 7 Level 7 (27,960 points)

    This is a very old discussion, and mostly no longer relevant. For info on solving your problem, see my Adware Removal Guide.

  • 9. Re: Safari displaying embedded ads?
    lzov Level 1 Level 1 (0 points)

    Would appreciate support here as well. I am getting a recurrent popup ad that is hides a chunk of my safari windo and then i have text that becomes green and double underlined. Plugging in the above code in the terminal, I get the following. Any thoughts on how to resolve this?

     

    This is the second time this happens in the space of two weeks. The first time it happened, I had just gotten the computer recently so I was in a position to just erase my entire computer and rebuild it. I just finished rebuilding it and here we go again... Any advice would be appreciated.

     

    L

     

     

    total 0

    drwx------+  2 Lynn  staff    68 Apr 19 20:51 .

    drwx------+ 49 Lynn  staff  1666 Apr 23 07:34 ..

    total 8

    drwxr-xr-x  13 root  wheel   442 Apr 23 07:24 .

    drwxr-xr-x+ 64 root  wheel  2176 Apr 22 22:00 ..

    drwxr-xr-x   3 Lynn  staff   102 Apr 23 07:23 AdobeAAMDetect.plugin

    drwxr-xr-x   3 root  wheel   102 Dec 21 07:42 AdobePDFViewer.plugin

    drwxr-xr-x   3 root  wheel   102 Dec 21 07:42 AdobePDFViewerNPAPI.plugin

    drwxr-xr-x   3 root  wheel   102 Jan 17 12:07 Default Browser.plugin

    drwxrwxr-x   3 root  wheel   102 Apr 20 17:50 Flash Player.plugin

    drwxr-xr-x   3 root  wheel   102 Aug 25  2013 Quartz Composer.webplugin

    drwxr-xr-x   3 root  wheel   102 Jan 15 09:04 QuickTime Plugin.plugin

    drwxrwxr-x@  3 root  admin   102 Aug 25  2010 SharePointBrowserPlugin.plugin

    drwxrwxr-x   3 root  admin   102 Aug 25  2010 SharePointWebKitPlugin.webplugin

    -rw-r--r--   1 root  wheel   856 Apr 12 21:43 flashplayer.xpt

    -rw-r--r--   1 root  wheel  2394 Apr 19 20:18 nsIQTScriptablePlugin.xpt