This discussion is locked
GautamAmsterdam

Q: How to remove Vsearch

Hi all,

My Sophos anti-virus detected "Vsearch a"...  but can't remove it with anti-sophos... I really want to remove this virus, but I am complete idiot with computers.

Can someone please help me out!??

MacBook Pro, iOS 7.1, null

Posted on Apr 14, 2015 10:11 PM

Close

Q: How to remove Vsearch

  • All replies
  • Helpful answers

  • by GautamAmsterdam,

    GautamAmsterdam GautamAmsterdam Apr 14, 2015 10:02 PM in response to GautamAmsterdam
    Level 1 (0 points)
    Apr 14, 2015 10:02 PM in response to GautamAmsterdam

    I did a test with the following results:

     

    Boot Mode: Normal

     

    Model: MacBookPro7,1

     

    Battery cycles: 1059

     

    System load advisory

     

       combined level = Bad

       - user level = OK

       - battery level = Bad

       - thermal level = Great

     

    System diagnostics

     

       2015-03-19 Microsoft Word spin

       2015-03-20 Microsoft Word hang

       2015-04-02 AdobeReader spin

     

    User diagnostics

     

       2015-03-17 iPhoto crash

       2015-03-20 Microsoft Error Reporting crash

       2015-03-31 Captive Network Assistant crash

       2015-04-14 Captive Network Assistant crash

     

    Kernel messages

     

       Apr 10 16:12:27   wl0: Roamed or switched channel, reason #2, bssid 00:3a:99:a2:54:b2

       --- last message repeated 4 times ---

       Apr 10 16:39:38   MacAuthEvent en1 Auth result for: 00:3a:99:a2:54:b2 Auth timed out

       Apr 10 16:39:38   wl0: Roamed or switched channel, reason #2, bssid 00:3a:99:a2:6a:62

       Apr 10 16:45:04   wl0: Roamed or switched channel, reason #2, bssid 00:3a:99:a2:54:b2

       --- last message repeated 1 time ---

       Apr 10 23:03:55   wl0: Roamed or switched channel, reason #4, bssid c8:d3:a3:35:9a:4a

       --- last message repeated 2 times ---

       Apr 10 23:04:46   wl0: Roamed or switched channel, reason #8, bssid c8:d3:a3:35:9a:4a

       Apr 10 23:06:53   wl0: Roamed or switched channel, reason #4, bssid c8:d3:a3:35:9a:4a

       Apr 12 22:22:25   wl0: Roamed or switched channel, reason #8, bssid c8:d3:a3:35:9a:4a

       Apr 13 14:25:38   wl0: Roamed or switched channel, reason #8, bssid 00:3a:99:a2:6a:62

       Apr 13 14:32:05   wl0: Roamed or switched channel, reason #4, bssid c4:0a:cb:df:99:f3

       Apr 13 14:32:28   wl0: Roamed or switched channel, reason #2, bssid c4:0a:cb:df:86:73

       Apr 13 14:32:37   wl0: Roamed or switched channel, reason #1, bssid c4:0a:cb:df:99:f3

       Apr 13 16:01:24   wl0: Roamed or switched channel, reason #8, bssid 00:3a:99:a2:6a:62

       Apr 14 01:51:29   wl0: Roamed or switched channel, reason #8, bssid c8:d3:a3:35:9a:4a

       Apr 14 11:01:32   MacAuthEvent en1 Auth result for: c4:0a:cb:df:99:f3 Auth timed out

       Apr 14 11:01:42   wl0: Roamed or switched channel, reason #1, bssid c4:0a:cb:df:99:f3

       Apr 14 12:15:41   wl0: Roamed or switched channel, reason #2, bssid 00:3a:99:a2:6a:62

       --- last message repeated 2 times ---

       Apr 14 12:31:59   wl0: Roamed or switched channel, reason #2, bssid 00:3a:99:a2:54:b2

       Apr 14 12:37:25   wl0: Roamed or switched channel, reason #2, bssid 00:3a:99:a2:6a:62

       Apr 14 13:35:09   wl0: Roamed or switched channel, reason #4, bssid c4:0a:cb:df:99:fc

       Apr 14 13:58:37   wl0: Roamed or switched channel, reason #1, bssid c4:0a:cb:df:99:f3

     

    Total CPU usage: user 13%, system 12%

     

    CPU usage by process "Activity Monitor" with UID 501: 13,5%

     

    Loaded extrinsic kernel extensions

     

       com.sophos.nke.swi (9.2.50)

       com.sophos.kext.sav (9.2.50)

     

    Extrinsic daemons

     

       com.sophos.scan

       com.sophos.webd

    com.sophos.autoupdate

    com.sophos.notification

       com.sophos.sxld

       com.sophos.configuration

    com.sophos.common.servicemanager

    com.oracle.java.JavaUpdateHelper

    com.oracle.java.Helper-Tool

    com.microsoft.office.licensing.helper

       com.adobe.fpsaud

     

    Extrinsic agents

     

       com.sophos.uiserver

    com.oracle.java.Java-Updater

    com.google.keystone.user.agent

    com.facebook.videochat.gautamkumar.updater

       com.adobe.ARM.UUID

     

    launchd items

     

    /Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist

                (com.adobe.AAM.Startup-1.0)

    /Library/LaunchAgents/com.oracle.java.Java-Updater.plist

                (com.oracle.java.Java-Updater)

    /Library/LaunchAgents/com.sophos.uiserver.plist

                (com.sophos.uiserver)

    /Library/LaunchDaemons/com.adobe.fpsaud.plist

                (com.adobe.fpsaud)

    /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

                (com.microsoft.office.licensing.helper)

    /Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist

                (com.oracle.java.Helper-Tool)

    /Library/LaunchDaemons/com.oracle.java.JavaUpdateHelper.plist

                (com.oracle.java.JavaUpdateHelper)

    /Library/LaunchDaemons/com.sophos.common.servicemanager.plist

                (com.sophos.common.servicemanager)

    Library/LaunchAgents/com.adobe.ARM.UUID.plist

                (com.adobe.ARM.UUID)

    Library/LaunchAgents/com.facebook.videochat.gautamkumar.plist

                (com.facebook.videochat.gautamkumar.updater)

    Library/LaunchAgents/com.google.keystone.agent.plist

                (com.google.keystone.user.agent)

     

    Extrinsic loadable bundles

     

    /System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle

                (com.apple.SecurityAgentPlugin.HomeDirMechanism)

    /System/Library/CoreServices/SecurityAgentPlugins/KerberosAgent.bundle

                (com.apple.KerberosAgent)

    /System/Library/CoreServices/SecurityAgentPlugins/loginwindow.bundle

                (com.apple.securityAgentPlugins.loginwindowUI)

    /System/Library/CoreServices/SecurityAgentPlugins/MCXMechanism.bundle

                (com.apple.securityAgentPlugin.MCXMechanism)

    /System/Library/CoreServices/SecurityAgentPlugins/PKINITMechanism.bundle

                (com.apple.PKINITMechanism)

    /System/Library/CoreServices/SecurityAgentPlugins/RestartAuthorization.bundle

                (com.apple.securityAgentPlugin.RestartAuthorization)

    /System/Library/Extensions/AMDRadeonVADriver.bundle

                (com.apple. AMDRadeonVADriver)

    /System/Library/Extensions/AMDRadeonX3000.kext

                (com.apple.AMDRadeonX3000)

    /System/Library/Extensions/AMDRadeonX3000GLDriver.bundle

                (com.apple.AMDRadeonX3000GLDriver)

    /System/Library/Extensions/AMDRadeonX4000.kext

                (com.apple.AMDRadeonX4000)

    /System/Library/Extensions/AMDRadeonX4000GLDriver.bundle

                (com.apple.AMDRadeonX4000GLDriver)

    /System/Library/Extensions/AppleFSCompressionTypeLZVN.kext

                (com.apple.AppleFSCompression.AppleFSCompressionTypeLZVN)

    /System/Library/Extensions/AppleIntelHD3000Graphics.kext

                (com.apple.driver.AppleIntelHD3000Graphics)

    /System/Library/Extensions/AppleIntelHD3000GraphicsGA.plugin

                (com.apple.driver.AppleIntelHD3000GraphicsGA)

    /System/Library/Extensions/AppleIntelHD3000GraphicsGLDriver.bundle

                (com.apple.driver.AppleIntelHD3000GraphicsGLDriver)

    /System/Library/Extensions/AppleIntelHD3000GraphicsVADriver.bundle

                (com.apple.AppleIntelHD3000GraphicsVADriver)

    /System/Library/Extensions/AppleIntelHD4000Graphics.kext

                (com.apple.driver.AppleIntelHD4000Graphics)

    /System/Library/Extensions/AppleIntelHD4000GraphicsGLDriver.bundle

                (com.apple.driver.AppleIntelHD4000GraphicsGLDriver)

    /System/Library/Extensions/AppleIntelHD4000GraphicsVADriver.bundle

                (com.apple.AppleIntelHD4000GraphicsVADriver)

    /System/Library/Extensions/AppleIntelHD5000Graphics.kext

                (com.apple.driver.AppleIntelHD5000Graphics)

    /System/Library/Extensions/AppleIntelHD5000GraphicsGLDriver.bundle

                (com.apple.driver.AppleIntelHD5000GraphicsGLDriver)

       /System/Library/Extensions/AppleIntelHD5000GraphicsVADriver.bundle

                (com.apple.AppleIntelHD5000GraphicsVADriver)

    /System/Library/Extensions/AppleIntelHDGraphicsGLDriver.bundle

                (com.apple.driver.AppleIntelHDGraphicsGLDriver)

    /System/Library/Extensions/AppleIntelHSWVA.bundle

                (com.apple.AppleIntelHSWFBVA)

    /System/Library/Extensions/AppleIntelIVBVA.bundle

                (com.apple.AppleIntelIVBFBVA)

    /System/Library/Extensions/AppleIntelMCEReporter.kext

                (com.apple.driver.AppleIntelMCEReporter)

    /System/Library/Extensions/ATIRadeonX2000.kext

                (com.apple.ATIRadeonX2000)

    /System/Library/Extensions/ATIRadeonX2000GA.plugin

                (com.apple.ATIRadeonX2000GA)

    /System/Library/Extensions/ATIRadeonX2000GLDriver.bundle

                (com.apple.ATIRadeonX2000GLDriver)

    /System/Library/Extensions/ATIRadeonX2000VADriver.bundle

                (com.apple.ATIRadeonX2000VADriver)

    /System/Library/Extensions/GeForce.kext

                (com.apple.GeForce)

    /System/Library/Extensions/GeForceGA.plugin

                (com.apple.GeForceGA)

    /System/Library/Extensions/GeForceGLDriver.bundle

                (com.apple.GeForceGLDriver)

    /System/Library/Extensions/GeForceTesla.kext

                (com.apple.GeForceTesla)

    /System/Library/Extensions/GeForceTeslaGLDriver.bundle

                (com.apple.GeForceTeslaGLDriver)

    /System/Library/Extensions/GeForceTeslaVADriver.bundle

                (com.apple.GeForceTeslaVADriver)

    /System/Library/Extensions/GeForceVADriver.bundle

                (com.apple.GeForceVADriver)

    /System/Library/Extensions/hp_designjet_series.kext

                (com.hp.print.hpio.Designjet.kext)

    /System/Library/Extensions/hp_Deskjet_io_enabler.kext

                (com.hp.print.hpio.Deskjet.kext)

    /System/Library/Extensions/hp_Inkjet1_io_enabler.kext

                (com.hp.print.hpio.Inkjet1.kext)

    /System/Library/Extensions/hp_Inkjet2_io_enabler.kext

                (com.hp.print.hpio.Inkjet2.kext)

    /System/Library/Extensions/hp_Inkjet3_io_enabler.kext

                (com.hp.print.hpio.Inkjet3.kext)

    /System/Library/Extensions/hp_Inkjet4_io_enabler.kext

                (com.hp.print.hpio.Inkjet4.kext)

       /System/Library/Extensions/hp_Inkjet5_io_enabler.kext

                (com.hp.print.hpio.Inkjet5.kext)

    /System/Library/Extensions/hp_Inkjet7_io_enabler.kext

                (com.hp.print.hpio.inkjet7.kext)

    /System/Library/Extensions/hp_Inkjet8_io_enabler.kext

                (com.hp.print.hpio.inkjet8.kext)

    /System/Library/Extensions/hp_Inkjet_io_enabler.kext

                (com.hp.print.hpio.Inkjet.kext)

    /System/Library/Extensions/hp_io_printerclassdriver_enabler.kext

                (com.hp.hpio.hp_io_printerclassdriver_enabler)

       /System/Library/Extensions/hp_Laserjet_io_enabler.kext

                (com.hp.print.hpio.Laserjet.kext)

    /System/Library/Extensions/hp_Officejet_io_enabler.kext

                (com.hp.print.hpio.Officejet.kext)

    /System/Library/Extensions/hp_Photosmart_io_enabler.kext

                (com.hp.print.hpio.Photosmart.kext)

    /System/Library/Extensions/hp_PhotosmartPro_io_enabler.kext

                (com.hp.print.hpio.PhotosmartPro.kext)

    /System/Library/Extensions/hp_qc_io_enabler.kext

                (com.hp.hpio.hp_psa530_630_io_enabler)

    /System/Library/Extensions/LexmarkUSBMerge.kext

                (com.lexmark.print.usbmerge)

       /Library/Audio/MIDI Drivers/EmagicUSBMIDIDriver.plugin

                (info.emagic.driver.unitor)

    /Library/Audio/Plug-Ins/HAL/AirPlay.driver

                (com.apple.audio.AirTunesHALPlugin)

    /Library/Audio/Plug-Ins/HAL/AppleAVBAudio.driver

                (com.apple.audio.AppleAVBAudio)

    /Library/Audio/Plug-Ins/HAL/BluetoothAudioPlugIn.driver

                (com.apple.audio.BluetoothAudioPlugIn)

    /Library/Audio/Plug-Ins/HAL/iSightAudio.driver

                (com.apple.iSightAudio)

    /Library/Extensions/EPSONUSBPrintClass.kext

                (com.epson.print.kext.USBPrintClass)

    /Library/Extensions/SophosNetworkInterceptor.kext

                (com.sophos.nke.swi)

    /Library/Extensions/SophosOnAccessInterceptor.kext

                (com.sophos.kext.sav)

       /Library/Internet Plug-Ins/AdobeAAMDetect.plugin

                (com.AdobeAAMDetectLib.AdobeAAMDetect)

       /Library/Internet Plug-Ins/AdobePDFViewer.plugin

                (com.adobe.acrobat.pdfviewer)

       /Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin

                (com.adobe.acrobat.pdfviewerNPAPI)

       /Library/Internet Plug-Ins/CANONiMAGEGATEWAYDL.plugin

                (jp.Canon.cig.npdownload)

       /Library/Internet Plug-Ins/CANONiMAGEGATEWAYLI.plugin

                (jp.Canon.cig.nplogin)

       /Library/Internet Plug-Ins/CitrixICAClientPlugIn.plugin

                (com.citrix.citrixicaclientplugIn)

       /Library/Internet Plug-Ins/Default Browser.plugin

                (com.apple.DefaultBrowser.PlugIn)

       /Library/Internet Plug-Ins/DirectorShockwave.plugin

                (com.adobe.director_12_0.shockwave.pluginshim)

       /Library/Internet Plug-Ins/Flash Player.plugin

                (com.macromedia.Flash Player.plugin)

       /Library/Internet Plug-Ins/iPhotoPhotocast.plugin

                (com.apple.plugin.iPhotoPhotocast)

       /Library/Internet Plug-Ins/JavaAppletPlugin.plugin

                (com.oracle.java.JavaAppletPlugin)

       /Library/Internet Plug-Ins/Quartz Composer.webplugin

                (com.apple.QuartzComposer.webplugin)

       /Library/Internet Plug-Ins/QuickTime Plugin.plugin

                (com.apple.QuickTime Plugin.plugin)

       /Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin

                (com.microsoft.sharepoint.browserplugin)

       /Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin

                (com.microsoft.sharepoint.webkitplugin)

       /Library/Internet Plug-Ins/Silverlight.plugin

                (com.microsoft.SilverlightPlugin)

    /Library/iTunes/iTunes Plug-ins/Quartz Composer Visualizer.bundle

                (com.apple.QuartzComposer.iTunesPlugIn)

    /Library/PreferencePanes/Citrix online plug-in.prefPane

                (com.citrix.StandAlone)

       /Library/PreferencePanes/Flash Player.prefPane

                (com.adobe.flashplayerpreferences)

    /Library/PreferencePanes/JavaControlPanel.prefPane

                (com.oracle.java.JavaControlPanel)

    /Library/QuickTime/AppleMPEG2Codec.component

                (com.apple.AppleMPEG2Codec)

    /Library/QuickTime/CanonMJPEGAVI.component

                (jp.co.canon.MJPEGAVIExporter)

    /Library/Spotlight/GBSpotlightImporter.mdimporter

                (com.apple.garageband.spotlightimporter)

    /Library/Spotlight/iBooksAuthor.mdimporter

                (com.apple.MDImporter.iBooksAuthor)

    /Library/Spotlight/iWork.mdimporter

                (com.apple.MDImporter.iWork)

    /Library/Spotlight/Microsoft Office.mdimporter

                (com.microsoft.MDImporter.Office)

       Library/Address Book Plug-Ins/SkypeABDialer.bundle

                (com.skype.skypeabdialer)

       Library/Address Book Plug-Ins/SkypeABSMS.bundle

                (com.skype.skypeabsms)

       Library/Internet Plug-Ins/FacebookVideoCalling.bundle

                (com.skype.FacebookVideoCalling)

    Library/iTunes/iTunes Plug-ins/TuneUp/TuneUp Visualizer.bundle

                (com.TuneUp.app.iTuneUp Visualizer)

    Library/Services/ENService.app

                (com.ThomsonResearchSoft.EndNote.ENService)

    Library/Spotlight/EndNote.mdimporter

                (com.ThomsonResearchSoft.EndNote)

     

    Extrinsic shared libraries

     

    /usr/lib/dtrace/libdtrace_dyld.dylib

    /usr/lib/libgmalloc.B.dylib

    /usr/lib/libruby.2.0.0.dylib

    /usr/lib/libXplugin.1.dylib

     

    Profiles: 1

     

    hosts

     

       127.0.0.1     activate.adobe.com

       127.0.0.1     practivate.adobe.com

       127.0.0.1     ereg.adobe.com

       127.0.0.1     wip3.adobe.com

       127.0.0.1     activate.wip3.adobe.com

       127.0.0.1     3dns-3.adobe.com

       127.0.0.1     3dns-2.adobe.com

       127.0.0.1     adobe-dns.adobe.com

       127.0.0.1     adobe-dns-2.adobe.com

       127.0.0.1     adobe-dns-3.adobe.com

       127.0.0.1     ereg.wip3.adobe.com

       127.0.0.1     activate-sea.adobe.com

       127.0.0.1     wwis-dubc1-vip60.adobe.com

       127.0.0.1     activate-sjc0.adobe.com

       127.0.0.1     hl2rcv.adobe.com

       127.0.0.1     lm.licenses.adobe.com

       127.0.0.1     na2m-pr.licenses.adobe.com

       127.0.0.1     ims-na1-prprod.adobelogin.com

       127.0.0.1     na4r.services.adobe.com

       127.0.0.1     na1r.services.adobe.com

     

    User login items

     

       iTunesHelper

       Dropbox

       uTorrent

       Android File Transfer Agent

     

    Safari extensions

     

       Omnibar

       Searchme

     

    Restricted user files: 338

     

    Font problems: 45

     

    Bad plists

     

    Library/Preferences/com.apple.iphotomosaic.plist

     

    Elapsed time (s): 358

  • by Niel,

    Niel Niel Apr 14, 2015 10:03 PM in response to GautamAmsterdam
    Level 10 (311,763 points)
    Apr 14, 2015 10:03 PM in response to GautamAmsterdam

    Click here and follow the instructions. If you're willing to use a tool to remove it(you don't need to, but may find it easier), you can instead run Adware Medic; this link is a direct download.


    (125997)

  • by thomas_r.,

    thomas_r. thomas_r. Apr 15, 2015 4:39 AM in response to GautamAmsterdam
    Level 7 (30,889 points)
    Mac OS X
    Apr 15, 2015 4:39 AM in response to GautamAmsterdam

    It does not actually appear that you have any components of VSearch installed, but you do have other adware installed. See Neil's reply for help with that.

     

    More concerning is the fact that your computer has been hacked to block access to many Adobe servers. The only reason to do that is to allow you to run a stolen copy of some Adobe software, by preventing it from connecting to the activation servers. This not only involves obvious ethical problems, it also means you have potentially exposed your computer to actual malware, rather than just adware.

     

    Remove the stolen Adobe product and fix the hacked hosts file:

     

    Fixing a hacked /etc/hosts file

     

    However, due to the possible exposure to malware, you may wish to erase the hard drive and reinstall everything from scratch.