iGardener

Q: help with overabundant ads

I would like to ask for some help from the support community.  The problem is overabundant ads on Safari and Firefox.  Having difficulty with a new machine after about 16 years as a mac driver. There are nine Apple products in the house.

 

The new machine ... here two days ... is at the low end of usable on familiar sites such as youtube for viewing traditional music. Problem noted on many other sites as well.  Sheer volume and persistence of ads is unlike anything I've seen before ... a bit of a circus ... and the overall experience falls somewhere on the spectrum between unpleasant and unusable.

 

Aside from this the machine itself is outstanding.

 

Background:

 

Beginning migration from baseline:

     iMac 27 Mid 2010 < fully backed up on two separate external drives

     OS X 10.8.5

     2.8 GHz Intel Core i5

     8 GB 1333 MHz DDR3

     Safari 6.2.8 (8537.85.17.9.1) < ghostery blocking all trackers - list updated 02/19/2016

     Firefox 43.0.4 < ghostery blocking 2079 trackers - not the up to date version of Firefox


Two days using new machine - migration not finished:

     iMac 27 Late 2015 - purchased as refurbished product

     OS X 10.11.3 < newest update

     4 GHz Intel Core i7

     8 GB 1867 MHz DDR3

     Safari 9.0.3 (11601.4.4) < newest update

     Firefox 44.0.2 < newest update

 

What happens:

     Some sites trouble free, for example support.apple.com; weather.gov.

     Ads show up on youtube that appear to come from youtube but that do not appear on the iMac Mid 2010 machine.

     Other ads appear on other sites ... a profusion of them.

     Some but not all ads are targeted, revealing what appears to be complete tracking of clicks.  A bit spooky.

     Ads pop up in the sidebar of youtube that do not appear on the iMac Mid 2010 machine.

     Safari accumulated cookies from 260 sites ... all but 6 never clicked on ... never such volume on iMac Mid 2010 machine.

 

Steps taken:

     Reviewed material available from Apple support -     Stop pop-up ads and adware in Safari - Apple Support - HT203987

     Reviewed some but not all previous threads on this topic.

     Deleted all cookies.

     Cleared history.

     Tried various combinations of the above with restart.

     Ran hardware reset of AirPort Extreme wireless router.  Reset IP address and wireless channel.

     Checked ghostery.com - previous version does not appear to be available there - new version does not have the same capability.

     Used Wireless Diagnostics - Utilities - to check traffic on the WAN.  New machine is busy in the background, apparently pre-fetching content.

     Reviewed settings for example firewall and "block pop-up ads" check box.

 

Next steps to evaluate:

     Carry out detailed steps in HT203987.

     Run a clean install of OS X 10.11.3 and start over.

 

The problems began immediately, right out of the box.  So I stopped migration, and at this time have little data at risk.  The clean install option is thus a reasonable next step.  The procedures outlined in HT203987 look more like dealing with malware than setting ad preferences.  With malware a clean install can be the best way to go.

 

Insight from more experienced members of the community would be welcome as to:

     What is the cause of the night and day difference between the experience on these two machines?

     Is there any wrong step I took that caused this?

     What is reasonable to expect when running Safari 9.0.3 on the iMac 27 Late 2015 and OS X 10.11.3.

     What next steps do you recommend?

   

Thank you!

iMac (Retina 5K, 27-inch, Late 2015), OS X El Capitan (10.11.3)

Posted on Feb 21, 2016 10:20 PM

Close

Q: help with overabundant ads

  • All replies
  • Helpful answers

  • by pinkstones,Helpful

    pinkstones pinkstones Feb 22, 2016 10:37 AM in response to iGardener
    Level 5 (4,209 points)
    Safari
    Feb 22, 2016 10:37 AM in response to iGardener

    One, do you have an ad blocker installed in your browser like Adblock or Adblock Plus (two separate extensions; they're not related), and two, if you do, it sounds like you might have adware/malware installed on your computer.  Could you please post screenshots of your LaunchAgents folder and your LaunchDaemons folder?  Alternately, you could go to http://www.etresoft.com/etrecheck and download/run EtreCheck — copy your status report and paste it here.  If there IS any adware/malware on your computer, it'll show up in your report.

  • by Linc Davis,

    Linc Davis Linc Davis Feb 22, 2016 6:26 AM in response to iGardener
    Level 10 (207,963 points)
    Applications
    Feb 22, 2016 6:26 AM in response to iGardener

    You may have installed ad-injection malware ("adware").

    Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

    Back up all data first.

    Some of the most common types of adware can be removed by following Apple's instructions. But before you follow those instructions, you can attempt an automatic removal.

    If you're not already running the latest version of OS X ("El Capitan"), updating or upgrading in the App Store may cause the adware to be removed automatically. If you're already running the latest version of El Capitan, you can nevertheless download the current updater from the Apple Support Downloads page and run it. Again, some kinds of malware will be removed—not all. There is no such thing as automatic removal of all possible malware, either by OS X or by third-party software. That's why you can't rely on software to protect you.

    If the malware is removed in your case, you'll still need to make changes to the way you use the computer to protect yourself from further attacks. Ask if you need guidance.

    If the malware is not removed automatically, and you can't remove it yourself by following Apple's instructions, see below.

    This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.

    Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

    If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. That will disable the malware temporarily.

    Step 1

    Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

    ~/Library/LaunchAgents

    In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

    If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

    There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

    Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

    Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

    Leave the folder open for now.

    Step 2

    Do as in Step 1 with this line:

    /Library/LaunchAgents

    The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

    Step 3

    Repeat with this line:

    /Library/LaunchDaemons

    This time the folder will be named "LaunchDaemons."

    Step 4

    Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

    Step 5

    If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

  • by iGardener,

    iGardener iGardener Feb 22, 2016 8:39 AM in response to pinkstones
    Level 1 (0 points)
    Feb 22, 2016 8:39 AM in response to pinkstones

    Thank you pinkstones and others for the constructive help.

    No ad blocker or other extensions in Safari at this time.

    Screen Shot 2016-02-22 at 8.24.16 AM.png

     

    No filess in \Library\LaunchAgents folder.

    Screen Shot 2016-02-22 at 8.19.13 AM.png

     

    No files in \Library\LaunchDaemons folder.

    Screen Shot 2016-02-22 at 8.20.47 AM.png

    Here's the EtreCheck report:

     

    EtreCheck version: 2.9.6 (256)

    Report generated 2016-02-22 08:33:47

    Download EtreCheck from http://etrecheck.com

    Runtime 1:18

    Performance: Excellent

     

    Click the [Support] links for help with non-Apple products.

    Click the [Details] links for more information about that line.

     

    Problem: Other problem

    Description:

    too many ads

     

    Hardware Information:

        iMac (Retina 5K, 27-inch, Late 2015)

        [Technical Specifications] - [User Guide] - [Warranty & Service]

        iMac - model: iMac17,1

        1 4 GHz Intel Core i7 CPU: 4-core

        8 GB RAM Upgradeable - [Instructions]

            BANK 0/DIMM0

                4 GB DDR3 1867 MHz ok

            BANK 0/DIMM1

                Empty  

            BANK 1/DIMM0

                4 GB DDR3 1867 MHz ok

            BANK 1/DIMM1

                Empty  

        Bluetooth: Good - Handoff/Airdrop2 supported

        Wireless:  en1: 802.11 a/b/g/n/ac

     

    Video Information:

        AMD Radeon R9 M395 - VRAM: 2048 MB

            iMac 5120 x 2880

     

    System Software:

        OS X El Capitan 10.11.3 (15D21) - Time since boot: less than an hour

     

    Disk Information:

        APPLE HDD ST2000DM001 disk0 : (2 TB) (Rotational)

            EFI (disk0s1) <not mounted> : 210 MB

            Recovery HD (disk0s3) <not mounted>  [Recovery]: 650 MB

            Macintosh HD (disk2) / : 2.11 TB (2.09 TB free)

                Core Storage: disk1s2 120.99 GB Online

                Core Storage: disk0s2 2.00 TB Online

     

        APPLE SSD SM0128G disk1 : (121.33 GB) (Solid State - TRIM: Yes)

            EFI (disk1s1) <not mounted> : 210 MB

            Boot OS X (disk1s3) <not mounted> : 134 MB

            Macintosh HD (disk2) / : 2.11 TB (2.09 TB free)

                Core Storage: disk1s2 120.99 GB Online

                Core Storage: disk0s2 2.00 TB Online

     

    USB Information:

        Broadcom Corp. Bluetooth USB Host Controller

        Apple Inc. FaceTime HD Camera (Built-in)

     

    Thunderbolt Information:

        Apple Inc. thunderbolt_bus

     

    Gatekeeper:

        Mac App Store and identified developers

     

    System Launch Agents:

        [loaded]    160 Apple tasks

        [running]    76 Apple tasks

     

    System Launch Daemons:

        [loaded]    199 Apple tasks

        [running]    88 Apple tasks

     

    User Login Items:

        iTunesHelper    Application  (/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

     

    Other Apps:

        [running]    com.apple.xpc.launchd.oneshot.0x10000003.EtreCheck (2016-02-20)

     

    Internet Plug-ins:

        Default Browser: 601 - SDK 10.11 (2016-02-19)

        QuickTime Plugin: 7.7.3 (2016-02-19)

     

    3rd Party Preference Panes:

        None

     

    Time Machine:

        Time Machine not configured!

     

    Top Processes by CPU:

             5%    launchd

             2%    fontd

             2%    WindowServer

             1%    Activity Monitor

             1%    kernel_task

     

    Top Processes by Memory:

        777 MB    kernel_task

        631 MB    com.apple.WebKit.WebContent(4)

        188 MB    Mail

        180 MB    Safari

        115 MB    Activity Monitor

     

    Virtual Memory Information:

        4.19 GB    Free RAM

        3.81 GB    Used RAM (1.02 GB Cached)

        0 B    Swap Used

     

    Diagnostics Information:

        Feb 22, 2016, 07:54:51 AM    Self test - passed

  • by iGardener,

    iGardener iGardener Feb 22, 2016 8:42 AM in response to Eric Root
    Level 1 (0 points)
    Feb 22, 2016 8:42 AM in response to Eric Root

    Thank you Eric Root and others.  Will study the resources you've pointed out.

  • by pinkstones,

    pinkstones pinkstones Feb 22, 2016 8:42 AM in response to iGardener
    Level 5 (4,209 points)
    Safari
    Feb 22, 2016 8:42 AM in response to iGardener

    Well, it doesn't appear you have any malware or adware installed on your system, in fact, it looks pretty good!  I would download an ad blocker and see if that helps.

  • by iGardener,

    iGardener iGardener Feb 22, 2016 9:21 AM in response to Linc Davis
    Level 1 (0 points)
    Feb 22, 2016 9:21 AM in response to Linc Davis

    Thank you Linc Davis and others for the prompt help with this problem.

     

    As Linc Davis stated:


    you'll still need to make changes to the way you use the computer to protect yourself from further attacks. Ask if you need guidance.

     

    This does look like an area where I will need guidance.

     

    Setting up the TimeMachine volume for the new iMac 27 is work in progress.  Little data migrated at this time so there's not much at risk.

     

    Will return to HT203987 and study that further.

     

    Had not thought of downloading and re-installing Safari 9.0.3.  Easy enough.  Thank you for that suggestion.

     

    As Linc Davis stated:

     

    Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

     

    Also,

     

    "display ads in its own windows" and "intrusive popup ads"

     

    could easily be what I'm looking at on the new machine for the first time.

     

    There appear to be no contents in /Library/LaunchAgents or /Library/LaunchDaemons.  Folder contents posted in earlier reply on this thread.

     

    No extensions installed in Firefox

    Screen Shot 2016-02-22 at 8.50.06 AM.png

     

    Here's the Mac Extensions screen:

     

    Screen Shot 2016-02-22 at 8.46.33 AM.png

  • by Linc Davis,

    Linc Davis Linc Davis Feb 22, 2016 9:48 AM in response to iGardener
    Level 10 (207,963 points)
    Applications
    Feb 22, 2016 9:48 AM in response to iGardener

    There are two LaunchAgents folders. Did you look in both of them?

     

    Also, your original question indicates that the Safari extension "Ghostery" was installed, yet now it isn't. Did you remove any other extensions, and if so, was there any change after removing them?

     

    Do the other devices have ad-blocking software installed on them?

  • by iGardener,

    iGardener iGardener Feb 22, 2016 10:34 AM in response to Linc Davis
    Level 1 (0 points)
    Feb 22, 2016 10:34 AM in response to Linc Davis

    Thank you Linc Davis for the follow up.

     

    Checked both ~\Library\LaunchAgents and \Library\LaunchAgents

     

    Screen Shot 2016-02-22 at 10.25.03 AM.png

    Screen Shot 2016-02-22 at 10.28.29 AM.png

     

    Ghostery is installed on Safari on the baseline iMac 27 Mid 2010 machine.  That machine does not show an excess of ads.

     

    Ghostery is not installed on Safari on the new iMac Late 2015 machine.  The version of Ghostery I've used on the old machine does not appear to be available for download now.  On the new machine I have not installed or removed any extensions or ad-blocking software.

     

    Other devices on the property do have ad-blocking software installed, for example Ghostery.

  • by Linc Davis,Solvedanswer

    Linc Davis Linc Davis Feb 22, 2016 10:42 AM in response to iGardener
    Level 10 (207,963 points)
    Applications
    Feb 22, 2016 10:42 AM in response to iGardener

    Ghostery does block some ads, and it's still available. From the Safari menu, select Safari Extensions... and search for it on the page that opens.

  • by iGardener,

    iGardener iGardener Feb 22, 2016 11:07 AM in response to Linc Davis
    Level 1 (0 points)
    Feb 22, 2016 11:07 AM in response to Linc Davis

    Success!

     

    The difference was selecting Safari Extensions from the Safari menu.  Previously I had navigated to ghostery.com.  From the Safari Extensions gallery loading and launching Ghostery was easy.

     

    Quick trial run on youtube shows ad problem is corrected.

     

    Thank you again Linc Davis and others.