PetteriL

Q: My safari opens new tabs with sketchy websites and pop-up ads.

My safari opens random tabs all the time. It throws me on sketchy websites. I have tried a couple of ways to prevent this from happening, and for example an anti-malware app didn't find anything.

MacBook Pro (Retina, 13-inch,Early 2015), iOS 10

Posted on Sep 27, 2016 12:24 PM

Close

Q: My safari opens new tabs with sketchy websites and pop-up ads.

  • All replies
  • Helpful answers

Previous Page 2 of 3 last Next
  • by PetteriL,

    PetteriL PetteriL Sep 28, 2016 8:09 AM in response to Csound1
    Level 1 (9 points)
    Safari
    Sep 28, 2016 8:09 AM in response to Csound1

    I couldn't find anything with google nor spotlight. I don't know what I'm supposed to find.

  • by Csound1,

    Csound1 Csound1 Sep 28, 2016 9:07 AM in response to PetteriL
    Level 9 (51,151 points)
    Desktops
    Sep 28, 2016 9:07 AM in response to PetteriL

    I found this with Google, it took less than a second

     

    www.joshuawise.com

     

    As you don't know how you got it I suggest more effort in looking for and getting rid of it

  • by PetteriL,

    PetteriL PetteriL Sep 28, 2016 9:21 AM in response to Csound1
    Level 1 (9 points)
    Safari
    Sep 28, 2016 9:21 AM in response to Csound1

    Yes, I found that page but I didn't find anything there. I wasn't sure if that was the website you meant. I tried to spotlight words like Joshua, Virtex, HoRNDIS, GitHub and all the project names, but I didn't find anything.

  • by Csound1,

    Csound1 Csound1 Sep 28, 2016 9:50 AM in response to PetteriL
    Level 9 (51,151 points)
    Desktops
    Sep 28, 2016 9:50 AM in response to PetteriL

    Well you (or someone with hands on access to your Mac) had to download it or it wouldn't be where it is. Do a better search (use EasyFind from Devon Technologies if Spotlight can't find it (Spotlight can not find anything that is hidden) don't use the version from the App Store, go to the Devon Technology website and download the proper version. Then look, it is on your Mac and you have no idea what it does, are you OK with that?

  • by PetteriL,

    PetteriL PetteriL Sep 28, 2016 9:57 AM in response to Csound1
    Level 1 (9 points)
    Safari
    Sep 28, 2016 9:57 AM in response to Csound1

    I found a folder named joshuawise, but it was created today just a few hours ago. I deleted the folder.

  • by Csound1,

    Csound1 Csound1 Sep 28, 2016 10:05 AM in response to PetteriL
    Level 9 (51,151 points)
    Desktops
    Sep 28, 2016 10:05 AM in response to PetteriL

    Run another report, let's see if that helped.

  • by PetteriL,

    PetteriL PetteriL Sep 28, 2016 10:09 AM in response to Csound1
    Level 1 (9 points)
    Safari
    Sep 28, 2016 10:09 AM in response to Csound1

    I think the folder just had something to do with browsing history, because it was created at the time I first visited the website. It also reappears when I go to that website again. I ran the EtreCheck again and nothing changed.

  • by Csound1,

    Csound1 Csound1 Sep 28, 2016 10:25 AM in response to PetteriL
    Level 9 (51,151 points)
    Desktops
    Sep 28, 2016 10:25 AM in response to PetteriL

    Does that mean that joshuawise is still loading into your kernel  as an extension of it.

  • by John Galt,

    John Galt John Galt Sep 28, 2016 10:27 AM in response to PetteriL
    Level 9 (50,065 points)
    Mac OS X
    Sep 28, 2016 10:27 AM in response to PetteriL

        [loaded]    com.joshuawise.kexts.HoRNDIS (8 - SDK 10.6 - 2016-08-28)


    Please refer to

     

    http://www.joshuawise.com/horndis

     

    which states (in part)

     

    Heads up: HoRNDIS does NOT yet work on Mac OS X 10.11 (El Capitan)!


    and you are running

     

        OS X El Capitan 10.11.6 (15G1004)

     

    Excerpted from Effective defenses against malware and other threats:

     

    • Never install something without first knowing what it is, what it does, how it works, and how to get rid of it when you don’t want it any more.

     

    Despite the EtreCheck report I have no idea whether it is related to your heart rate monitor, or if it is even related to the problem you originally asked about. My guess is that it probably isn't related to that problem, but "horndis" is clearly something that should not be installed on your Mac.

     


     

    Please restart your Mac in "Safe Mode" and determine if the Safari tabs keep opening: Try safe mode if your Mac doesn't finish starting up - Apple Support.

  • by Csound1,

    Csound1 Csound1 Sep 28, 2016 10:28 AM in response to John Galt
    Level 9 (51,151 points)
    Desktops
    Sep 28, 2016 10:28 AM in response to John Galt
    • Never install something without first knowing what it is, what it does, how it works, and how to get rid of it when you don’t want it any more.

    I totally agree.

  • by PetteriL,

    PetteriL PetteriL Sep 28, 2016 10:30 AM in response to John Galt
    Level 1 (9 points)
    Safari
    Sep 28, 2016 10:30 AM in response to John Galt

    Actually, the weird part about this is that I haven't seen ANY of those popup tabs today, so it looks like I somehow got rid of that problem. I'm still kind of worried about this "horndis". I have no idea how it got on my computer and how to get rid of it, and it concerns me.

  • by John Galt,

    John Galt John Galt Sep 28, 2016 10:39 AM in response to PetteriL
    Level 9 (50,065 points)
    Mac OS X
    Sep 28, 2016 10:39 AM in response to PetteriL

    John Galt wrote:

     

    Despite the EtreCheck report I have no idea whether it is related to your heart rate monitor,

     

    I have reason to believe that FlowSync and "horndis" are not related at all:

     

    http://support.polar.com/us-en/support/how_do_i_install_polar_flowsync_on_mac?pr oduct_id=64182

     

    Kernel Extensions:

            /Applications/FlowSync.app

        [loaded]    com.joshuawise.kexts.HoRNDIS (8 - SDK 10.6 - 2016-08-28)

     

    That makes me question whether EtreCheck is erroneously associating the two, which then makes me question whether it is failing to identify the underlying problem with Safari.

     

    "Safe Mode" will be instructive, so please write back with those results. There will be additional troubleshooting steps to follow.

  • by John Galt,

    John Galt John Galt Sep 28, 2016 10:41 AM in response to PetteriL
    Level 9 (50,065 points)
    Mac OS X
    Sep 28, 2016 10:41 AM in response to PetteriL

    I have no idea how (horndis) got on my computer and how to get rid of it, and it concerns me.

     

    From that same link:

     

    If, for some reason, you need to uninstall HoRNDIS, you can simply drag the extension to the trash. In the Finder, go to the “Go” menu, and select “Go to folder...”; in that, type ”/System/Library/Extensions”. Find “HoRNDIS.kext”, and drag it to the trash. When prompted, type your password. Do the same for the “HoRNDIS.kext” that lives in ”/Library/Extensions”, as well. Then, restart your Mac to be sure it is unloaded.

     

    I have not attempted to duplicate it, but those instructions seem to be accurate.

  • by PetteriL,

    PetteriL PetteriL Sep 28, 2016 11:01 AM in response to John Galt
    Level 1 (9 points)
    Safari
    Sep 28, 2016 11:01 AM in response to John Galt

    I followed the instructions but EtreCheck report is still the same.

  • by John Galt,

    John Galt John Galt Sep 28, 2016 11:06 AM in response to PetteriL
    Level 9 (50,065 points)
    Mac OS X
    Sep 28, 2016 11:06 AM in response to PetteriL

    PetteriL wrote:

     

    I followed the instructions but EtreCheck report is still the same.

     

    In that case I would disregard it. The only question that really matters is whether the problem with Safari is fixed or not. If it isn't, please write back for additional suggestions.

Previous Page 2 of 3 last Next