JustPerfect

Q: Anyone have adware called Brappui

I have a wacky green Adware toolbar, about 3/4' in size--calls itself "Brappui bar" and it drops down (in BOTH Safari AND Chrome) below the bookmarks bar in Amazon and eBay. I inherited it when I went--as many of us do--looking for a coupon or a code to get a lower price on something that I wanted to purchase. WELL...it's freakin' IMPOSSIBLE to get rid of! I have gone into source via terminal and entered "rem" in front of the code lines; I've run Malwarebytes a dozen times; I run Avira antivirus; I've even gone as far as restoring from a Time Machine backup that PREDATED the adware by a month--NO LUCK! It keeps coming back like Cancer. Anyone have a clue on how to dump this "Brappui" piece of crap???

MacBook Pro (15-inch Mid 2012), OS X Mavericks (10.9), 16Gb RAM; Eikon Biometrics

Posted on Jun 19, 2016 6:25 AM

Close

Q: Anyone have adware called Brappui

  • All replies
  • Helpful answers

  • by Esquared,

    Esquared Esquared Jun 19, 2016 6:34 AM in response to JustPerfect
    Level 6 (8,405 points)
    Mac OS X
    Jun 19, 2016 6:34 AM in response to JustPerfect

    Makers of ad-injection software – because that's what this is – know very well that people can be tempted by a 'good offer'. So you simply cannot trust any of these sites.

     

    You'll find many topics on this subject on this site. Like this one: Adware keeps coming back . See if the instructions by Linc Davis can help you get rid of it.

  • by Linc Davis,

    Linc Davis Linc Davis Jun 19, 2016 7:13 AM in response to JustPerfect
    Level 10 (207,925 points)
    Applications
    Jun 19, 2016 7:13 AM in response to JustPerfect

    You may have installed ad-injection malware ("adware").

    Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. You've already seen that it doesn't work.

    Back up all data first.

    If you're not already running the latest version of OS X, updating or upgrading in the App Store may cause the adware to be removed automatically. If you are already running the latest version, please log out or restart the computer. Again, some kinds of malware will be removed—not all. There is no such thing as automatic removal of all possible malware, either by OS X or by third-party software. That's why you can't rely on software to protect you.

    If the malware is removed in your case, you'll still need to make changes to the way you use the computer to protect yourself from further attacks. Ask if you need guidance.

    If the malware is not removed automatically, see below.

    This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.

    Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

    If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. The malware will be disabled temporarily.

    Step 1

    Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

    ~/Library/LaunchAgents

    In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

    If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

    There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

    Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

    Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

    Leave the folder open for now.

    Step 2

    Do as in Step 1 with this line:

    /Library/LaunchAgents

    The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

    Step 3

    Repeat with this line:

    /Library/LaunchDaemons

    This time the folder will be named "LaunchDaemons."

    Step 4

    Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

    Step 5

    If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

  • by RivaGe,

    RivaGe RivaGe Jun 27, 2016 12:15 AM in response to JustPerfect
    Level 1 (4 points)
    Jun 27, 2016 12:15 AM in response to JustPerfect

    Are you using any greasemonkey/tampermonkey scripts? I had the same issue and it was loading via one of my scripts.

  • by AnilYanamandra,

    AnilYanamandra AnilYanamandra Sep 1, 2016 12:54 PM in response to Linc Davis
    Level 1 (4 points)
    Sep 1, 2016 12:54 PM in response to Linc Davis

    Hey Linc,

    Can you help?

    These are the screenshots in order. I keep seeing a green bar from "SimilarDeals.net" on online stores.Screen Shot 2016-09-01 at 12.53.41 PM.png

     

    Screen Shot 2016-09-01 at 12.47.07 PM.pngScreen Shot 2016-09-01 at 12.47.59 PM.pngScreen Shot 2016-09-01 at 12.48.25 PM.png