Q: Ad Pop ups coming in all browsers on Mac

Question

Mani-Singh

Level 1 (0 points)

Q: Ad Pop ups coming in all browsers on Mac

Since morning my Mac (running Yosemite) is showing pop ups with on the right bottom of all browsers and at times opens a new tab going to Mackeeper website. I tried various stuff posted on the forum like

searching for various items in Finder as described here by Apple Support
installing & scanning through AdwareMedic
removing all extensions from all browsers
off course rebooting the system
opening URLs in Incognito mode

These obscene pop ups keep showing up in All Browsers. Interestingly they do not appear on some websites or when I doing Google Search or viewing pages on Apple Forums but keep coming on most of the sites I m visiting. I tried visiting the same websites on by MacBook and every thing is clean there.

Only different thing than my usual work I did on this Mac was to download & install Audacity from audacity.sourceforge.net/download/mac. The other thing was I tried downloading Inkscape from https://inkscape.org/en/download/mac-os/ which asked me to install XQuartz from xquartz.macosforge.org which I stopped in between. Not sure if any of these is causing the issue.

More importantly, how do I get rid of these pop ups. Willing to buy any good paid software from Mac Store if that helps.

Thanks

iMac, OS X Yosemite (10.10.2)

Posted on Feb 21, 2015 12:21 AM

I have this question too

Solved

Mani-Singh

Level 1 (0 points)

A:

Thx Linc Davis, this has solved the issue. Here is what I found out and resolved:

Identifying the issue

As suggested, I checked the DNS settings on the local system (System Preference > Network > Advanced > DNS
Found that these DNS settings had been hacked on the router as one Primary DNS was pointing to some server in Ukraine and the other to 8.8.8.8

Solving the issue

Accessed the router through its control panel, I reckon general setting is http://168.192.1.1 or http://168.192.0.1
I was able to get the login password for this control panel from our ISP
Changed Primary & Secondary DNS settings in the router to the ones provided by our ISP
Restarted the router
Deleted cache in the browser (the pop ups were still coming when I had not deleted the cache)
Restarted the iMac
And everything works perfectly....

Thanks for all your support, this rocks!

Posted on Feb 23, 2015 12:38 AM

Q: Ad Pop ups coming in all browsers on Mac

All replies

Helpful answers

Page 2

by thomas_r.,

thomas_r. Feb 22, 2015 9:10 AM in response to tbirdvet
Level 7 (30,889 points)

Mac OS X

Feb 22, 2015 9:10 AM in response to tbirdvet

AdBlock will at best muddy the waters, and will not solve the underlying problem.
Reply options

Link to this post

by jmapth,

jmapth Apr 19, 2015 4:50 PM in response to Linc Davis
Level 1 (0 points)

Apr 19, 2015 4:50 PM in response to Linc Davis

Start time: 19:35:35 04/19/15

Revision: 1251

Model Identifier: MacBookAir6,2
System Version: OS X 10.10.3 (14D87p)
Kernel Version: Darwin 14.3.0
Time since boot: 19 minutes

UID: 502

USB

    Microsoft® Nano Transceiver v1.0 (Microsoft Corporation)

Activity

    CPU: user 13%, system 8%

CPU usage (%)

    syslog (UID 502): 94.7
    com.apple.WebKit (UID 502): 19.1
    com.apple.WebKit (UID 502): 17.0
    WindowServer (UID 0): 16.6

Firewall: On

Listeners

    cupsd: ipp

System caches/logs

    2149 MB:

Diagnostic reports

    2015-03-21 UserEventAgent crash x24
    2015-04-05 UserEventAgent crash x20
    2015-04-09 UserEventAgent crash
    2015-04-13 UserEventAgent crash x9
    2015-04-15 UserEventAgent crash
    2015-04-15 com.apple.WebKit.WebContent crash x12
    2015-04-17 Installer hang
    2015-04-17 cloudd crash

HID errors: 11

Kernel log

    Apr 17 03:54:48 SATA WARNING: IDENTIFY DEVICE checksum not implemented.
    Apr 17 04:27:32 Google Chrome (map: 0xffffff802d507000) triggered DYLD shared region unnest for map: 0xffffff802d507000, region 0x7fff85e00000->0x7fff86000000. While not abnormal for debuggers, this increases system memory footprint until the target exits.
    Apr 17 04:27:32 Google Chrome He (map: 0xffffff802cf61b40) triggered DYLD shared region unnest for map: 0xffffff802cf61b40, region 0x7fff85e00000->0x7fff86000000. While not abnormal for debuggers, this increases system memory footprint until the target exits.
    Apr 17 04:27:32 Google Chrome He (map: 0xffffff8026de7b40) triggered DYLD shared region unnest for map: 0xffffff8026de7b40, region 0x7fff85e00000->0x7fff86000000. While not abnormal for debuggers, this increases system memory footprint until the target exits.
    Apr 17 04:27:33 Google Chrome He (map: 0xffffff802a47ec30) triggered DYLD shared region unnest for map: 0xffffff802a47ec30, region 0x7fff85e00000->0x7fff86000000. While not abnormal for debuggers, this increases system memory footprint until the target exits.
    Apr 17 04:27:33 Google Chrome He (map: 0xffffff802d5072d0) triggered DYLD shared region unnest for map: 0xffffff802d5072d0, region 0x7fff85e00000->0x7fff86000000. While not abnormal for debuggers, this increases system memory footprint until the target exits.
    Apr 17 04:27:33 Google Chrome He (map: 0xffffff8033a384b0) triggered DYLD shared region unnest for map: 0xffffff8033a384b0, region 0x7fff85e00000->0x7fff86000000. While not abnormal for debuggers, this increases system memory footprint until the target exits.
    Apr 17 04:27:33 Google Chrome He (map: 0xffffff802df01a50) triggered DYLD shared region unnest for map: 0xffffff802df01a50, region 0x7fff85e00000->0x7fff86000000. While not abnormal for debuggers, this increases system memory footprint until the target exits.
    Apr 17 04:28:32 Google Chrome He (map: 0xffffff8033a382d0) triggered DYLD shared region unnest for map: 0xffffff8033a382d0, region 0x7fff85e00000->0x7fff86000000. While not abnormal for debuggers, this increases system memory footprint until the target exits.
    Apr 17 04:28:46 Google Chrome He (map: 0xffffff8033a38c30) triggered DYLD shared region unnest for map: 0xffffff8033a38c30, region 0x7fff85e00000->0x7fff86000000. While not abnormal for debuggers, this increases system memory footprint until the target exits.
    Apr 17 04:28:47 Google Chrome He (map: 0xffffff802a47ec30) triggered DYLD shared region unnest for map: 0xffffff802a47ec30, region 0x7fff85e00000->0x7fff86000000. While not abnormal for debuggers, this increases system memory footprint until the target exits.
    Apr 17 04:29:58 Google Chrome He (map: 0xffffff8033a38870) triggered DYLD shared region unnest for map: 0xffffff8033a38870, region 0x7fff85e00000->0x7fff86000000. While not abnormal for debuggers, this increases system memory footprint until the target exits.
    Apr 17 04:30:57 Google Chrome He (map: 0xffffff8033a38a50) triggered DYLD shared region unnest for map: 0xffffff8033a38a50, region 0x7fff85e00000->0x7fff86000000. While not abnormal for debuggers, this increases system memory footprint until the target exits.
    Apr 17 04:32:10 SATA WARNING: IDENTIFY DEVICE checksum not implemented.
    Apr 17 04:53:39 SATA WARNING: IDENTIFY DEVICE checksum not implemented.
    Apr 17 05:08:33 SATA WARNING: IDENTIFY DEVICE checksum not implemented.
    Apr 17 13:15:32 utun_start: ifnet_disable_output returned error 12
    Apr 17 15:24:04 SATA WARNING: IDENTIFY DEVICE checksum not implemented.
    Apr 17 15:36:12 SATA WARNING: IDENTIFY DEVICE checksum not implemented.
    Apr 17 21:54:58 USBF:    2107.141    IOUSBHIDDriver(IOUSBHIDDriver)::RearmInterruptRead returning error 0xe00002c0 (no such device), not issuing any reads to device
    Apr 17 21:54:58 USBF:    2107.143    USBF:    2107.143    IOUSBHIDDriver(IOUSBHIDDriver)::RearmInterruptRead returning error 0xe00002c0 (no such device), not issuing any reads to deviceIOUSBHIDDriver(IOUSBHIDDriver)::RearmInterruptRead returning error 0xe00002c0 (no such device), not issuing any reads to device
    Apr 18 18:44:08 utun_start: ifnet_disable_output returned error 12
    Apr 18 20:35:24 Limiting icmp unreach response from 331 to 250 packets per second
    Apr 18 21:29:28 ARPT: 17175.731951: directed SSID scan fail
    Apr 19 19:16:45 SATA WARNING: IDENTIFY DEVICE checksum not implemented.

System log

    Apr 19 19:17:05 cloudd: Stream 0x7fd1cbeca340 is sending an event before being opened
    Apr 19 19:17:05 cloudd: Stream 0x7fd1cbec9de0 is sending an event before being opened
    Apr 19 19:17:05 nsurlsessiond: Being asked if container with identifier com.apple.clouddocs.com.apple.SharedDocs is foreground before getting callback from BRContainersMonitor!
    Apr 19 19:17:05 nsurlsessiond: Being asked if container with identifier com.apple.clouddocs.com.apple.SharedDocs is foreground before getting callback from BRContainersMonitor!
    Apr 19 19:17:07 callservicesd: GVA warning: failed to get a service for display id: 4128832
    Apr 19 19:17:07 callservicesd: GVA warning: failed to get a service for display id: 4128833
    Apr 19 19:17:07 callservicesd: GVA warning: failed to get a service for display id: 4128835
    Apr 19 19:17:07 callservicesd: GVA warning: failed to get a service for display id: 4128834
    Apr 19 19:17:08 WindowServer: disable_update_timeout: UI updates were forcibly disabled by application "Stickies" for over 1.00 seconds. Server has re-enabled them.
    Apr 19 19:19:41 Service: AppleEvents: Send port for process has no send right, port=( port:30475/0x770b rcv:1,send:0,d:0 limit:5) (findOrCreate()/AEMachUtils.cp #526) com.apple.main-thread
    Apr 19 19:19:41 Service: AppleEvents: Send port for process has no send right, port=( port:30475/0x770b rcv:1,send:0,d:0 limit:5) (findOrCreate()/AEMachUtils.cp #526) com.apple.main-thread
    Apr 19 19:21:48 com.apple.kextcache: JMicronATA.kext has no Info.plist file.
    Apr 19 19:21:48 com.apple.kextcache: JMicronATA.kext has no Info.plist file.
    Apr 19 19:21:48 com.apple.kextcache: JMicronATA.kext has no Info.plist file.
    Apr 19 19:21:48 com.apple.kextcache: JMicronATA.kext has no Info.plist file.
    Apr 19 19:21:50 com.apple.kextcache: JMicronATA.kext has no Info.plist file.
    Apr 19 19:21:50 com.apple.kextcache: kext file:///System/Library/Extensions/NikeSportWatch.kext/ is in hash exception list, allowing to load
    Apr 19 19:22:07 fseventsd: Logging disabled completely for device:1: /Volumes/Recovery HD
    Apr 19 19:26:19 sharingd: 19:26:19.164 Connection closed (cancel suppressed)
    Apr 19 19:26:31 sharingd: 19:26:31.504 Connection closed (cancel suppressed)
    Apr 19 19:26:44 sharingd: 19:26:44.126 SDWormholeConnection::didReceiveError Error Domain=NSOSStatusErrorDomain Code=-9806 "The operation couldn’t be completed. (OSStatus error -9806.)" (errSSLClosedAbort: connection closed via error )
    Apr 19 19:26:44 sharingd: 19:26:44.127 SDWormholeConnection::didReceiveError suppressed
    Apr 19 19:27:06 sharingd: 19:27:06.485 Connection closed (cancel suppressed)
    Apr 19 19:27:10 sharingd: 19:27:10.012 SDWormholeConnection::didReceiveError Error Domain=NSOSStatusErrorDomain Code=-9806 "The operation couldn’t be completed. (OSStatus error -9806.)" (errSSLClosedAbort: connection closed via error )
    Apr 19 19:27:10 sharingd: 19:27:10.012 SDWormholeConnection::didReceiveError suppressed

Console log

    Apr 13 17:03:08 nsurlstoraged: asyncCacheDirectoryRemove - failed to remove old cache dir /var/folders/5t/qyvssdwn5fjfm8_259tlxw_m0000gp/T/fsCachedData_remove. Errno=2
    Apr 13 20:21:12 nsurlstoraged: The read-connection to the DB=/Users/USER/Library/Caches/com.apple.icloud.fmfd/Cache.db is NOT valid. Unable to determine schema version.
    Apr 14 17:02:52 nsurlstoraged: asyncCacheDirectoryRemove - failed to remove old cache dir /var/folders/5t/qyvssdwn5fjfm8_259tlxw_m0000gp/T/fsCachedData_remove. Errno=2
    Apr 15 21:59:15 nsurlstoraged: NetworkStorageDB:_openDBWriteConnections: failed to open write connection to DB @ /Users/USER/Library/Caches/com.VSearch.VSInstaller/Cache.db. Error=14. Cause=unable to open database file
    Apr 15 21:59:15 nsurlstoraged: NetworkStorageDB:_openDBReadConnections: failed to open read connection to DB @ /Users/USER/Library/Caches/com.VSearch.VSInstaller/Cache.db. Error=14. Cause=unable to open database file
    Apr 16 23:38:40 nsurlstoraged: purgeEntireFileSystemStore - failed to remove existing target dir /var/folders/5t/qyvssdwn5fjfm8_259tlxw_m0000gp/T/fsCachedData_remove. Errno=2
    Apr 16 23:38:40 nsurlstoraged: asyncCacheDirectoryRemove - failed to remove old cache dir /var/folders/5t/qyvssdwn5fjfm8_259tlxw_m0000gp/T/fsCachedData_remove. Errno=2
    Apr 17 00:25:00 ReportCrash: Invoking spindump for pid=37923 thread=1790943 percent_cpu=85 duration=106 because of excessive cpu utilization
    Apr 17 00:26:46 nsurlstoraged: NetworkStorageDB:_openDBWriteConnections: failed to open write connection to DB @ /Users/USER/Library/Caches/com.VSearch.VSInstaller/Cache.db. Error=14. Cause=unable to open database file
    Apr 17 00:26:46 nsurlstoraged: NetworkStorageDB:_openDBReadConnections: failed to open read connection to DB @ /Users/USER/Library/Caches/com.VSearch.VSInstaller/Cache.db. Error=14. Cause=unable to open database file
    Apr 17 00:28:44 nsurlstoraged: NetworkStorageDB:_openDBWriteConnections: failed to open write connection to DB @ /Users/USER/Library/Caches/com.VSearch.VSInstaller/Cache.db. Error=14. Cause=unable to open database file
    Apr 17 00:28:44 nsurlstoraged: NetworkStorageDB:_openDBReadConnections: failed to open read connection to DB @ /Users/USER/Library/Caches/com.VSearch.VSInstaller/Cache.db. Error=14. Cause=unable to open database file
    Apr 17 00:56:02 ReportCrash: Invoking spindump for pid=37922 thread=1790942 percent_cpu=72 duration=125 because of excessive cpu utilization
    Apr 17 01:16:12 nsurlstoraged: The read-connection to the DB=/Users/USER/Library/Caches/com.apple.icloud.fmfd/Cache.db is NOT valid. Unable to determine schema version.
    Apr 17 01:16:34 nsurlstoraged: asyncCacheDirectoryRemove - failed to remove old cache dir /var/folders/5t/qyvssdwn5fjfm8_259tlxw_m0000gp/T/fsCachedData_remove. Errno=2
    Apr 17 01:20:02 nsurlstoraged: asyncCacheDirectoryRemove - failed to remove old cache dir /var/folders/5t/qyvssdwn5fjfm8_259tlxw_m0000gp/T/fsCachedData_remove. Errno=2
    Apr 17 01:22:01 ReportCrash: Invoking spindump for pid=488 wakeups_rate=213 duration=212 because of excessive wakeups
    Apr 17 13:15:23 nsurlstoraged: The read-connection to the DB=/Users/USER/Library/Caches/com.apple.icloud.fmfd/Cache.db is NOT valid. Unable to determine schema version.
    Apr 17 15:24:18 nsurlstoraged: The read-connection to the DB=/Users/USER/Library/Caches/com.apple.icloud.fmfd/Cache.db is NOT valid. Unable to determine schema version.
    Apr 17 15:36:41 nsurlstoraged: The read-connection to the DB=/Users/USER/Library/Caches/com.apple.icloud.fmfd/Cache.db is NOT valid. Unable to determine schema version.
    Apr 18 17:59:46 ReportCrash: Invoking spindump for pid=353 wakeups_rate=243 duration=186 because of excessive wakeups
    Apr 19 19:17:05 nsurlstoraged: The read-connection to the DB=/Users/USER/Library/Caches/com.apple.icloud.fmfd/Cache.db is NOT valid. Unable to determine schema version.

Loaded kernel extensions

    com.avatron.AVExFramebuffer (3.0.1)
    com.avatron.AVExVideo (3.0.1)

Daemons

    com.apple.CrashReporterSupportHelper
    com.apple.iBooksX-SecureUserDefaults
    com.apple.watchdogd

Agents

    com.apple.AirPortBaseStationAgent
    com.apple.CallHistoryPluginHelper
    com.apple.photostream-agent
    com.apple.xpc.loginitemregisterd
    com.cinemapro1-2.agent
    com.extensions.updater69337.agent.plist
    com.teamviewer.desktop

User login items

    iTunesHelper
    - /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

ICLOUD errors

    cloudd 61
    bird 50
    Photos 36
    cloudphotosd 34
    Spotlight 15
    Finder 15
    comapple.CloudPhotosConfiguration 8
    Preview 3
    Mail 1

Continuity errors

    lsuseractivityd 84
    sharingd 22
    Safari 18
    Messages 16

Restricted files: 78

Contents of /System/Library/LaunchAgents/com.apple.AOSHeartbeat.plist
    - mod date: Sep 8 07:26:59 2014
    - checksum: 931332229

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    <key>RunAtLoad</key>
    <true/>
    <key>Label</key>
    <string>com.apple.AOSHeartbeat</string>
    <key>Program</key>
    <string>/System/Library/PrivateFrameworks/AOSKit.framework/Helpers/AOSHeartbeat .app/Contents/MacOS/AOSHeartbeat</string>
    <key>EnvironmentVariables</key>
    <dict>
    <key>NSRunningFromLaunchd</key>
    <string>1</string>
    </dict>
    <key>EnableTransactions</key>
    <true/>
    <key>LaunchEvents</key>
    <dict>
    <key>com.apple.xpc.activity</key>
    <dict>
    <key>com.apple.AOSHeartbeat.daily</key>
    <dict>
    <key>Priority</key>
    <string>Utility</string>

    ...and 9 more line(s)

Contents of /System/Library/LaunchAgents/com.apple.CallHistoryPluginHelper.plist
    - Apple binary property list
    - mod date: Aug 29 21:33:59 2014
    - checksum: 2622390109

    Dict {
        POSIXSpawnType = Adaptive
        MachServices = Dict {
            com.apple.CallHistoryPluginHelper = true
        }
        EnableTransactions = true
        ProgramArguments = Array {
            /System/Library/PrivateFrameworks/CallHistory.framework/Support/CallHistoryPlug inHelper
        }
        LaunchEvents = Dict {
            com.apple.notifyd.matching = Dict {
                com.apple.CallHistoryPluginHelper.launchnotification = Dict {
                    Notification = com.apple.CallHistoryPluginHelper.launchnotification
                }
            }
        }
        EnablePressuredExit = true
        Label = com.apple.CallHistoryPluginHelper
    }

Contents of /System/Library/LaunchAgents/com.apple.cfprefsd.xpc.agent.plist
    - Apple binary property list
    - mod date: Sep 4 21:10:40 2014
    - checksum: 2120227459

    Dict {
        POSIXSpawnType = Adaptive
        LimitLoadToSessionType = Background
        MachServices = Dict {
            com.apple.cfprefsd.agent = true
        }
        DrainMessagesOnFailedInit = true
        EnableTransactions = true
        ProgramArguments = Array {
            /usr/sbin/cfprefsd
            agent
        }
        EnablePressuredExit = true
        Label = com.apple.cfprefsd.xpc.agent
    }

Contents of /System/Library/LaunchAgents/com.apple.fontd.useragent.plist
    - mod date: Sep 14 00:58:02 2014
    - checksum: 803288065

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    <key>Label</key>
    <string>com.apple.fontd</string>
    <key>MachServices</key>
    <dict>
    <key>com.apple.FontObjectsServer</key>
    <true/>
    <key>com.apple.FontServer</key>
    <true/>
    </dict>
    <key>ProgramArguments</key>
    <array>
    <string>/System/Library/Frameworks/ApplicationServices.framework/Frameworks/ATS .framework/Support/fontd</string>
    </array>
    <key>EnableTransactions</key>
    <true/>
    <key>POSIXSpawnType</key>
    <string>Adaptive</string>
    </dict>
    </plist>

Contents of /System/Library/LaunchAgents/com.apple.icloud.fmfd.plist
    - Apple binary property list
    - mod date: Aug 29 21:28:09 2014
    - checksum: 1376544387

    Dict {
        Umask = 23
        Label = com.apple.icloud.fmfd
        POSIXSpawnType = Adaptive
        MachServices = Dict {
            com.apple.icloud.fmfd.aps = true
            com.apple.icloud.fmfd = true
        }
        EnableTransactions = true
        WorkingDirectory = /var/empty
        EnablePressuredExit = true
        Program = /usr/libexec/fmfd
    }

Contents of /System/Library/LaunchAgents/com.apple.secd.plist
    - mod date: Aug 12 21:59:12 2014
    - checksum: 2685676326

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    <key>EnablePressuredExit</key>
    <true/>
    <key>EnableTransactions</key>
    <true/>
    <key>LimitLoadToSessionType</key>
    <string>Background</string>
    <key>POSIXSpawnType</key>
    <string>Interactive</string>
    <key>Label</key>
    <string>com.apple.secd</string>
    <key>MachServices</key>
    <dict>
    <key>com.apple.secd</key>
    <true/>
    <key>com.apple.securityd.xpc</key>
    <true/>
    </dict>
    <key>OnDemand</key>
    <true/>
    <key>ProgramArguments</key>
    <array>

    ...and 15 more line(s)

Contents of /System/Library/LaunchAgents/com.apple.universalaccessAuthWarn.plist
    - mod date: Aug 9 03:26:50 2014
    - checksum: 1975769629

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    <key>Label</key>
    <string>com.apple.universalaccessAuthWarn</string>
    <key>MachServices</key>
    <dict>
    <key>com.apple.universalaccessAuthWarn</key>
    <true/>
    </dict>
    <key>ProgramArguments</key>
    <array>
    <string>/System/Library/PrivateFrameworks/UniversalAccess.framework/Versions/A/ Resources/universalAccessAuthWarn.app/Contents/MacOS/universalAccessAuthWarn</st ring>
    <string>launchd</string>
    <string>-s</string>
    </array>
    <key>RunAtLoad</key>
    <false/>
    <key>EnableTransactions</key>
    <true/>
    <key>ThrottleInterval</key>
    <integer>5</integer>
    <key>POSIXSpawnType</key>
    <string>App</string>

    ...and 6 more line(s)

Contents of /System/Library/LaunchAgents/com.apple.wifi.WiFiAgent.plist
    - mod date: Sep 19 02:01:07 2014
    - checksum: 1487835276

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    <key>LimitLoadToSessionType</key>
    <array>
    <string>Aqua</string>
    <string>LoginWindow</string>
    </array>
    <key>Label</key>
    <string>com.apple.wifi.WiFiAgent</string>
    <key>KeepAlive</key>
    <dict>
    <key>SuccessfulExit</key>
    <false/>
    <key>Crashed</key>
    <true/>
    </dict>
    <key>Program</key>
    <string>/System/Library/CoreServices/WiFiAgent.app/Contents/MacOS/WiFiAgent</st ring>
    <key>MachServices</key>
    <dict>
    <key>com.apple.wifi.WiFiAgent</key>
    <true/>
    </dict>

    ...and 10 more line(s)

Contents of /System/Library/LaunchAgents/com.apple.xpc.loginitemregisterd.plist
    - mod date: Aug 9 03:42:09 2014
    - checksum: 2819274882

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    <key>Label</key>
    <string>com.apple.xpc.loginitemregisterd</string>
    <key>EnablePressuredExit</key>
    <true/>
    <key>Program</key>
    <string>/usr/libexec/loginitemregisterd</string>
    <key>MachServices</key>
    <dict>
    <key>com.apple.xpc.loginitemregisterd</key>
    <true/>
    </dict>
    </dict>
    </plist>

Contents of /System/Library/LaunchDaemons/com.apple.CrashReporterSupportHelper.plist
    - mod date: Sep 8 07:15:07 2014
    - checksum: 328361227

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    <key>Label</key>
    <string>com.apple.CrashReporterSupportHelper</string>
    <key>ProgramArguments</key>
    <array>
    <string>/System/Library/CoreServices/CrashReporterSupportHelper</string>
    <string>server-init</string>
    </array>
    <key>EnableTransactions</key>
    <true/>
    <key>ProcessType</key>
    <string>Adaptive</string>
    <key>MachServices</key>
    <dict>
    <key>com.apple.CrashReporterSupportHelper</key>
    <true/>
    </dict>
    </dict>
    </plist>

Contents of /System/Library/LaunchDaemons/com.apple.diagnosticd.plist
    - Apple binary property list
    - mod date: Aug 11 23:40:12 2014
    - checksum: 3339321460

    Dict {
        Label = com.apple.diagnosticd
        EnvironmentVariables = Dict {
            __CF_USER_TEXT_ENCODING = 0x0:0:0
            __CFPREFERENCES_AVOID_DAEMON = 1
        }
        POSIXSpawnType = Adaptive
        MachServices = Dict {
            com.apple.diagnosticd = true
        }
        EnableTransactions = true
        LaunchEvents = Dict {
            com.apple.diagnosticd.events = Dict {
                Events = Dict {
                }
            }
        }
        EnablePressuredExit = true
        Program = /usr/libexec/diagnosticd
    }

Contents of /System/Library/LaunchDaemons/com.apple.fontd.plist
    - mod date: Sep 14 00:58:02 2014
    - checksum: 1750763369

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    <key>Label</key>
    <string>com.apple.fontd</string>
    <key>MachServices</key>
    <dict>
    <key>com.apple.FontObjectsServer</key>
    <true/>
    <key>com.apple.FontServer</key>
    <true/>
    </dict>
    <key>ProgramArguments</key>
    <array>
    <string>/System/Library/Frameworks/ApplicationServices.framework/Frameworks/ATS .framework/Support/fontd</string>
    </array>
    <key>EnableTransactions</key>
    <true/>
    <key>UserName</key>
    <string>_atsserver</string>
    <key>GroupName</key>
    <string>_atsserver</string>
    <key>POSIXSpawnType</key>
    <string>Adaptive</string>

    ...and 2 more line(s)

Contents of /System/Library/LaunchDaemons/com.apple.networkd.plist
    - Apple binary property list
    - mod date: Aug 8 10:12:35 2014
    - checksum: 1217832652

    Dict {
        Program = /usr/libexec/networkd
        EnablePressuredExit = true
        GroupName = _networkd
        POSIXSpawnType = Adaptive
        MachServices = Dict {
            com.apple.symptoms.symptomsd.managed_events = true
            com.apple.usymptomsd = true
            com.apple.networkd = true
            com.apple.symptom_analytics = true
        }
        EnableTransactions = true
        UserName = _networkd
        LaunchEvents = Dict {
            com.apple.notifyd.matching = Dict {
                com.apple.airport.userNotification = Dict {
                    Notification = com.apple.airport.userNotification
                }
            }
        }
        WatchPaths = Array {
            /Library/Managed Preferences/mobile/com.apple.networkd.plist
            /Library/Preferences/com.apple.networkd.plist
        }
        Label = com.apple.networkd

    ...and 1 more line(s)

Contents of /System/Library/LaunchDaemons/com.apple.security.syspolicy.plist
    - mod date: Sep 17 02:15:36 2014
    - checksum: 3053564149

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    <key>Disabled</key>
    <false/>
    <key>EnableTransactions</key>
    <false/>
    <key>Label</key>
    <string>com.apple.security.syspolicy</string>
    <key>MachServices</key>
    <dict>
    <key>com.apple.security.syspolicy</key>
    <true/>
    </dict>
    <key>ProgramArguments</key>
    <array>
    <string>/usr/libexec/syspolicyd</string>
    </array>
    <key>POSIXSpawnType</key>
    <string>Adaptive</string>
    <key>LaunchEvents</key>
    <dict>
    <key>com.apple.xpc.activity</key>
    <dict>

    ...and 15 more line(s)

Contents of /System/Library/LaunchDaemons/org.apache.httpd.plist
    - mod date: Mar 6 16:34:10 2015
    - checksum: 3012644940

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    <key>Disabled</key>
    <true/>
    <key>Label</key>
    <string>org.apache.httpd</string>
    <key>EnvironmentVariables</key>
    <dict>
    <key>XPC_SERVICES_UNAVAILABLE</key>
    <string>1</string>
    </dict>
    <key>ProgramArguments</key>
    <array>
    <string>/usr/sbin/httpd-wrapper</string>
    <string>-D</string>
    <string>FOREGROUND</string>
    </array>
    <key>OnDemand</key>
    <false/>
    </dict>
    </plist>

Contents of Library/LaunchAgents/com.cinemapro1-2.agent.plist
    - mod date: Apr 16 23:58:02 2015
    - checksum: 3056660028

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    <key>KeepAlive</key>
    <false/>
    <key>Label</key>
    <string>com.cinemapro1-2.agent</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Users/USER/Library/cinemapro1-2/Service.app/Contents/MacOS/Service</st ring>
    <string>--service</string>
    <string>--unique_id=UUID</string>
    <string>--unique_data=UUID</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    </dict>
    </plist>

Contents of Library/LaunchAgents/com.extensions.updater69337.agent.plist
    - mod date: Apr 16 23:58:04 2015
    - checksum: 1042625508

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
    <key>Label</key>
    <string>com.extensions.updater69337.agent.plist</string>
    <key>ProgramArguments</key>
    <array>
    <string>/Users/USER/Library/LaunchAgents/UpdateDownloader</string>
    <string>cmpId=2702</string>
    <string>ibic=UUID</string>
    <string>verifier=UUID</string>
    <string>extId=69337</string>
    <string>updatejsondomain=http://update.staticclientstorage.com</string>
    <string>statsdomain=http://stats.staticclientstorage.com</string>
    <string>eventsdomain=http://logs.staticclientstorage.com</string>
    <string>errorsdomain=http://errors.staticclientstorage.com</string>
    <string>installerversion=01-27</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>StartInterval</key>
    <integer>86400</integer>
    </dict>
    </plist>

Extensions

    /Library/Extensions/AVFrameBuffer.kext
    - com.avatron.AVExFramebuffer
    /Library/Extensions/AVVideoCard.kext
    - com.avatron.AVExVideo
    /System/Library/Extensions/LivescribeSmartpen.kext
    - com.livescribe.kext.LivescribeSmartpen
    /System/Library/Extensions/NikeSportWatch.kext
    - com.nike.sportwatch

Frameworks

    /Library/Frameworks/Adobe AIR.framework
    - com.adobe.AIR
    /Library/Frameworks/TSLicense.framework
    - net.telestream.license

PrefPane

    /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/deploy/JavaControlPanel.pref Pane
    - com.oracle.java.JavaControlPanel
    /Library/PreferencePanes/Flash Player.prefPane
    - com.adobe.flashplayerpreferences
    /Library/PreferencePanes/Flip4Mac WMV.prefPane
    - net.telestream.wmv.prefpane

Bundles

    /Library/Address Book Plug-Ins/RCAgentAB.bundle
    - com.ringcentral.RCAgentAB AgentAB
    /Library/Address Book Plug-Ins/RCFaxAB.bundle
    - com.ringcentral.RCFaxAB FaxAB
    /Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/AdobeCP15.plugin
    - com.adobe.adobecp
    /Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/Flash Player.plugin
    - com.macromedia.FlashPlayer-10.6.plugin
    /Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/adobecp.plugin
    - com.adobe.adobecp20
    /Library/Internet Plug-Ins/AdobePDFViewer.plugin
    - com.adobe.acrobat.pdfviewer
    /Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin
    - com.adobe.acrobat.pdfviewerNPAPI
    /Library/Internet Plug-Ins/Flash Player.plugin
    - com.macromedia.Flash Player.plugin
    /Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin
    - net.telestream.wmv.plugin
    /Library/Internet Plug-Ins/JavaAppletPlugin.plugin
    - com.oracle.java.JavaAppletPlugin
    /Library/Internet Plug-Ins/LogitechHarmony.plugin
    - com.logitech.harmony.LogitechHarmony
    /Library/Internet Plug-Ins/RogersOneNumber_67648.plugin
    - com.Rogers.onenumber
    /Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin
    - com.microsoft.sharepoint.browserplugin
    /Library/Internet Plug-Ins/Silverlight.plugin
    - com.microsoft.SilverlightPlugin
    /Library/Widgets/Intego Backup Assistant Widget.wdgt
    - com.intego.widget.backupassistant
    /System/Library/Extensions/NVMeSMARTLib.plugin
    - com.apple.NVMeSMARTLib

Bundles (new)

    /Applications/1Password.app
    - com.agilebits.onepassword-osx
    /Applications/Apple Configurator.app
    - com.apple.configurator
    /Applications/Final Cut Pro.app
    - com.apple.FinalCut
    /Applications/Leap Motion Orientation.app
    - unity.Leap Motion.Playground
    /Applications/Leap Motion.app
    - com.leapmotion.Leap-Motion
    /Applications/MPlayerX.app
    - org.niltsh.MPlayerX
    /Applications/Microsoft Office 2011/Office/Add-Ins/Solver.app
    - com.microsoft.ASApplication
    /Applications/Microsoft Office 2011/Office/Microsoft Query.app
    - com.microsoft.Query
    /Applications/OneDrive.app
    - com.microsoft.OneDrive-mac
    /Users/USER/Applications/cinemapro1-2.app
    - com.cinemapro1-2.AppHelper
    /Users/USER/Library/Application Support/MPlayerX/bundles/MPlayerX.mplayer.bundle
    - org.niltsh.MPlayerX-mplayer
    /Users/USER/Library/cinemapro1-2/Service.app
    - com.cinemapro1-2.Service

Library paths

    /Applications/Microsoft Office 2011/Office/MicrosoftSetupUI.framework/Libraries/mbupgx.dylib
    /Applications/Microsoft Office 2011/Office/OPF.framework/Versions/14/Resources/OPF_Common.dylib
    /Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/Fm20.dylib
    /Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/MicrosoftOLE2TypesLib.dylib
    /Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/RefEdit.dylib
    /Applications/Microsoft Office 2011/Office/Visual Basic for Applications.framework/Versions/14/Frameworks/RichEdit.dylib
    /Library/Application Support/Livescribe/PenComm/libPenCommSdk.dylib
    /Library/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/WebKit.dylib

App extensions

    com.pixelmatorteam.pixelmator.Repair-Tool-Action-Extension

Installations

    PlugIn: 2013-08-20, 10:59 PM
    Leap Motion Software: 2013-08-17, 12:34 PM
    Leap Motion Software: 2013-08-11, 8:24 PM
    SkyDrive (1): 2013-08-03, 12:48 PM
    Office 2011 14.3.6 Update: 2013-08-01, 11:01 AM

Elapsed time (sec): 251
Reply options

Link to this post

by thomas_r.,

thomas_r. Apr 20, 2015 3:54 AM in response to jmapth
Level 7 (30,889 points)

Mac OS X

Apr 20, 2015 3:54 AM in response to jmapth

You have adware installed. See my Adware Removal Guide for help removing it.

(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com.)
Reply options

Link to this post

Page 2

Accepted Answer · Feb 23, 2015 12:38 AM

Mani-Singh

Level 1 (0 points)

Feb 23, 2015 12:38 AM in response to Linc Davis

Thx Linc Davis, this has solved the issue. Here is what I found out and resolved:

Identifying the issue

As suggested, I checked the DNS settings on the local system (System Preference > Network > Advanced > DNS
Found that these DNS settings had been hacked on the router as one Primary DNS was pointing to some server in Ukraine and the other to 8.8.8.8

Solving the issue

Accessed the router through its control panel, I reckon general setting is http://168.192.1.1 or http://168.192.0.1
I was able to get the login password for this control panel from our ISP
Changed Primary & Secondary DNS settings in the router to the ones provided by our ISP
Restarted the router
Deleted cache in the browser (the pop ups were still coming when I had not deleted the cache)
Restarted the iMac
And everything works perfectly....

Thanks for all your support, this rocks!

HT203987: Stop pop-up ads in Safari

Q: Ad Pop ups coming in all browsers on Mac

All replies

Helpful answers

by thomas_r.,

by Mani-Singh,Solvedanswer

by jmapth,

by thomas_r.,

HT203987: Stop pop-up ads in Safari

Q: Ad Pop ups coming in all browsers on Mac

All replies Helpful answers

by thomas_r.,

by Mani-Singh,Solvedanswer

by jmapth,

by thomas_r.,

All replies

Helpful answers