HT201541: Update the software on your Mac
Learn about Update the software on your Mac
theratter
Q: remove adware popup ads
-
Apr 11, 2016 2:01 PMby Linc Davis,You installed a variant of the "Flashmall" trojan. To remove it, start by backing up all data.
Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.
Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.
1. Please triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents
Right-click or control-click the highlighted line and select
Services ▹ Open
from the contextual menu.* A folder named "LaunchAgents" should open.
In the folder, there may be one or more files with a name that begins in either of the following ways:
com.ShopTool
com.SoftwareUpdater
Move each such file to the Trash. You may be prompted for your administrator password.
2. Do as in Step 1 with this line:
~/Library/LaunchAgents
3. Log out or restart the computer.
4. Open the Applications folder in the Finder. It may have subfolders with any of these names:
SoftwareUpdater
ShopTool
Move each such subfolder to the Trash. Empty the Trash.
5. From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall all extensions you don't know you need, including one called "SearchTrust," if it's present. If in doubt, remove all of them. None is required for normal operation. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.
