HT203987: Stop pop-up ads in Safari
Learn about Stop pop-up ads in Safari
-
All replies
-
Helpful answers
-
Feb 10, 2016 2:58 PM in response to Jessxi95by ckuan,There's no virus.
Use EtreCheck from www.etrecheck.com and see what's running on your Mac
-
Feb 14, 2016 4:33 PM in response to Jessxi95by Linc Davis,★HelpfulYou may have installed ad-injection malware ("adware").
Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.
Back up all data first.
Some of the most common types of adware can be removed by following Apple's instructions. But before you follow those instructions, you can attempt an automatic removal.
If you're not already running the latest version of OS X ("El Capitan"), updating or upgrading in the App Store may cause the adware to be removed automatically. If you're already running the latest version of El Capitan, you can nevertheless download the current updater from the Apple Support Downloads page and run it. Again, some kinds of malware will be removed—not all. There is no such thing as automatic removal of all possible malware, either by OS X or by third-party software. That's why you can't rely on software to protect you.
If the malware is removed in your case, you'll still need to make changes to the way you use the computer to protect yourself from further attacks. Ask if you need guidance.
If the malware is not removed automatically, and you can't remove it yourself by following Apple's instructions, see below.
This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.
Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.
If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. That will disable the malware temporarily.
Step 1
Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:
~/Library/LaunchAgents
In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.
If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.
There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.
Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.
Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.
Leave the folder open for now.
Step 2
Do as in Step 1 with this line:
/Library/LaunchAgents
The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.
Step 3
Repeat with this line:
/Library/LaunchDaemons
This time the folder will be named "LaunchDaemons."
Step 4
Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.
Step 5
If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.
-
-
Feb 14, 2016 5:29 PM in response to Jessxi95by Linc Davis,A
Please back up all data before making any changes.
In the first folder arranged as shown in the screenshots, please delete these items:
#1 ("CleanMyMac")
In the second folder:
#3 ("CleanMyMac")
#6 ("VSearch")
You may be prompted for your password.
Restart the computer. Until you've done that, the malware will still be active, even after you delete the file.
Uninstall any Safari extensions you don't know you need. If in doubt, remove all of them. None is needed for normal operation.
Do the equivalent in the Chrome and Firefox browsers, if you use either of those.
Reset the Safari home page, if it was changed. You may need to do the same in the other browsers.
From the Applications folder (not shown in the screenshots), delete items with any of the following names:
MPlayerX
These steps will permanently inactivate the malware, as long as you never reinstall it. A few small files may remain in hidden folders, but they have no effect.
B
"CleanMyMac" is a scam and a common cause of instability and poor performance. Follow the developer's instructions to remove it.
C
You installed the "malwarebytes" anti-malware product. It failed to remove the malware. That's what is always to be expected of such products: failure, or worse. I strongly recommend that you get rid of it and never install any "anti-malware" or "anti-virus" product again.
-
-
Feb 16, 2016 7:00 AM in response to gayle Stephensby Eric Root,Try removing EasyShopper using the developer's uninstall instructions. Also remove Spigot.
-
-
Mar 2, 2016 9:13 AM in response to Tasty Geezerby Tasty Geezer,I have the same problem regarding Mackeeper and other insane ads appearing in safari I have added the above screenshots? What do I do now thanks Dave
-
Mar 3, 2016 7:28 AM in response to Tasty Geezerby Eric Root,Delete Easyshopper files.
You do not need to use cleaning programs. They can destroy your computer operation as they may already have done.
After un-installing, use this program to make sure you got all the pieces.









