-
All replies
-
Helpful answers
-
-
Sep 18, 2014 6:45 PM in response to Nielby 1nikkip,Is it safe to use? people have told me that most things like this just make it worse.
-
Sep 18, 2014 7:02 PM in response to 1nikkipby Enzo001,I've been told by the Apple techs that you don't need any third party software to manage your Mac. Is it really nessesary?
-
-
Sep 18, 2014 10:32 PM in response to 1nikkipby Linc Davis,Whether it's safe or not is something you would have to determine by doing your own research, not by taking anyone's word for it. In any case, you don't need to use that program.
You may have installed the "VSearch" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data before proceeding.
Step 1
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
Reset the home page and default search engine in all the browsers, if it was changed.
Step 2
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plistRestart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.pluginSome of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
This trojan is distributed on illegal websites that traffic in pirated content. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that this Internet criminal has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
-
Sep 21, 2014 1:35 PM in response to Linc Davisby DianeKE,Thank you so much, Linc Davis, for your detailed explanation of how to get rid of this malware. The problem of Safari opening a new tab every time I clicked on something began this afternoon, after I was online trying to find a link to listen to my favorite football team, since their games are not broadcast in my area. The first link I clicked on told me I needed to download some plugins, which I did, but still couldn't get it to work, so I went to audiopassnfl.com and purchased a subscription. I am explaining this because I now believe the first link that offered free steaming of the game and asked me to install or upgrade the plugins is probably where I picked up the malware.
Thankfully, when I looked the problem up here, I found your description of what it probably was and what to do. After following your instructions, I appear to be "back to normal". What a relief!
-
Nov 6, 2014 10:19 PM in response to Linc Davisby shuistorm9,Hi Linc Davis.
I had the same problem after i installed or upgraded to Yosemite. After reading your msg. It helps!
Really thankful as after so many years this whole one week i think i closes the most pop-ups and funny tabs in my iMac.
Great Help!! Thanks!
-
Jan 15, 2015 9:18 AM in response to Linc Davisby siamak exir,thank you Linc Davis
in my case it didn't reveal in finder or even from the GO option. any way
i found those files as you mentioned in the
user library and deleted them and then reinstalled safari extension add blocker ,and every thing s back to normal.
many thanks
-
Jan 20, 2015 7:41 AM in response to Linc Davisby annabelleh97,Hi Linc Davis, I did everything you say, and i have a question. Which selected text is the one that i'm going to copy and paste in finder?
-
-
Jun 23, 2015 11:04 AM in response to Linc Davisby mohamedfromlaramie,whenever I am connected to the internet, Safari keeps opening the same tab again and again. The tab contains the following address: https://c1.microsoft.com/c.gif?DI=4050&did=1&t= . Thank you in advance!
-
Jul 9, 2015 7:15 PM in response to mohamedfromlaramieby justinlewisfromrye,DDid anyone help as I have the exact same problem, about every 20 seconds it goes to that web address, and if I close down safari it reopens. Even if change default browser, it just opens that every 20 Seconds or so.
-
Jul 11, 2015 11:10 AM in response to justinlewisfromryeby mohamedfromlaramie,I have solved this problem by uninstalling the Microsoft Outlook software. it is the one responsible for this problem. I hope this gonna work for you.
-
Jul 12, 2015 3:50 PM in response to mohamedfromlaramieby justinlewisfromrye,TThanks, that did the trick