You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

How do I get rid of Adobe flash update virus on Safari browser?

Hello. I've been having problems with a pop-up asking me to update my adobe flash player in my Safari browser. It blocks everything - and if I close it - it closes the entire site I was trying to reach. I know it's a virus/scam/malware because when I go to the adobe site, it says my flash is up to date.


This only occurs with the Safari browser - not with Chrome or firefox. I've tried using malwarebytes and Avast - and neither find the malware.


I've tried clearing my caches and that doesn't work either.


Does anyone have a solution?

MacBook Pro 13", macOS 10.13

Posted on Mar 4, 2020 11:50 PM

Reply
37 replies

Mar 6, 2020 2:03 AM in response to madisonNYC

Thanks.


I knowingly infected Safari on my Mac with this pop-up malware.

Are you seeing pop-ups as shown in the screenshots posted below?





Force quit followed by launching Safari with the shift key down resolved the issue.

To make sure that system is clean, I ran Malwarebytes for Mac and EtreCheck.

It is possible that what you are seeing is a variant of this adware.


Download EtreCheck: https://etrecheck.com/  and post the report here.

      Click, “Free Download” button and then  “Click to download” button,

      open Downloads folder, click on it to open, and then select ”Open”.

      “Choose a problem” from the popup menu box, and then “Start EtreCheck” in the dialog.

      Click “Share Report” button in the toolbar and select “Copy report”.

      Click the “Page” button in the toolbar at the bottom of this page and paste it when you reply.

      Note: This is a diagnostic test. 

Mar 11, 2020 2:53 PM in response to madisonNYC

Please follow this procedure to determine if the problem is isolated to your Mac, or lies elsewhere.


  1. Shut down your Mac.
  2. Load macOS Recovery by holding and r (two fingers) while you start your Mac with a third finger.
  3. When the macOS Utilities screen appears, release those two fingers.
  4. Choose Get Help Online.
  5. Safari will launch, but it will lack your bookmarks, favorites, history and other preferences.


Peruse your usual websites and determine if the phony pop-ups appear while using Safari in that mode. It probably won't.


If the problem does not occur in Recovery mode, but returns after restarting your Mac normally, please read If Safari is slow, stops responding, quits unexpectedly, or has other issues - Apple Support. The applicable section is likely to be "Remove Internet plug-ins and other add-ons" and the Support documents that follow "Learn more".


None of the Internet Plug-ins that appear in the report you posted are required for normal operation, so I suggest you remove all of them. For example, the Internet Plug-Ins, Input Methods, InputManagers, and ScriptingAdditions folders it describes in that Support document are either completely empty or absent on the Macs I typically use.


If you remain unable to resolve the problem, please write back.

Mar 11, 2020 12:53 PM in response to madisonNYC

Full drive access: Disabled


Please enable that feature (assuming that's an option for its free version—refer to its instructions, because I don't know) and capture another report.


And don't forget to clear Safari's history and website data:


Clear your browsing history in Safari on Mac - Apple Support

Manage cookies and website data in Safari on Mac - Apple ...

Mar 4, 2020 11:59 PM in response to madisonNYC

Have you tried the following steps to manually remove the redirection on your MAC?


1. Remove suspicious Login Items

Most malware will try to enable itself automatically when you log in to your mac.

a. Go to the Apple menu → System Preferences

b. Choose the Users & Groups section.

c. Make sure your username is highlighted. Open Login Items tab.

d. Choose any recently-added suspicious applications and use the "-" or minus sign to disable all the suspicious apps.

e. Restart your Mac for the changes to take place.


2. Remove malicious profiles

Some malware will install a malicious configuration profile that forced the home page of your browser.

Note: Profiles won't be visible until you have at least one profile installed. If there is none you may skip this step.

a. Go to the Apple menu → System Preferences

b. Click Profiles

c. Check if there is a profile named AdminPrefs or other profile you know that you did not set up on your Mac and delete it.


3. Stop potentially unwanted process running on your Mac

a. Go to Utilities and open Activity Monitor

b. Look for suspicious processes you are not familiar with.

c. Double click the process. A new window will appear, then click Quit. Click Force Quit on the confirmation message to stop the process.


4. Remove potentially unwanted applications from your "Applications" folder:

a. Open your applications folder : Click Go> Applications

b. Look for any recently-added suspicious applications and drag them to the Trash.


5. Remove malicious extensions on your browser.

For Safari

1. Launch Safari.

2. On the top Menu, click Safari. Then select Preferences.

3. Click the Extensions icon, and then uninstall any recently-added suspicious extensions you want to remove.


For Chrome

1. Launch Chrome.

2. Click the menu on the top right corner. Then click More Tools → Extensions

3. A new Tab for Chrome’s Extension will open. Look for any recently-added suspicious extensions you want to remove and click the remove button.


For Firefox

1. Launch Firefox

2. Click the Menu bar on the top right corner and then select Add-Ons.

3. A new tab for Firefox’s add-ons will appear. Select the Extensions Tab. Look for any recently-added suspicious add-ons you want to remove and click the remove button


6. Remove related files and folders.

To manually delete any recently-added suspicious files. Do the following:

a. Click Go > Go to Folder

b. Type the following locations below and click go. (One at a time)


Look for any recently-added suspicious files in these locations.

~/Library/ApplicationSupport

~/Library/Caches

~/Library/containers

~/Library/LaunchAgents

~/Library/Logs

~/Library/Preferences

~/Library/Webkit

/Library/ApplicationSupport

/Library/Caches

/Library/Frameworks

/Library/LaunchAgents

/Library/LaunchDaemons

/Library/Preferences

/Library/Logs

/Library/Webkit


Delete any recently-added suspicious files you want to delete by dragging and dropping it to Trash.


7. After you complete all the steps, please empty your trash and restart your Mac


Hope it helps!

Mar 5, 2020 8:30 PM in response to Pactricia666

Thank you. I tried all of these steps. But it's back again this evening.


1.    I removed the login items.

2.    There is no "profiles icon" under my Apple preferences

3.    This step - I could not do. There are more than 100 "processes" running and I have no idea what a "suspicious" process would look like.

4.    I didn't see any suspicious applications listed, although I don't know what "adapter installer" is.

5.    There were no extensions at all listed in Safari preferences.

6.    I deleted my entire ~/library/caches files. (This took hours to do). 

7.    I emptied the trash, and when I rebooted - the adobe flash virus seemed to be gone.

But then this evening - it was back again.

So, I deleted the ~/library/caches file again (this time it only took couple of minutes), rebooted and the virus is again temporarily gone.


But how do I get it to stop coming back?

Mar 6, 2020 10:21 PM in response to dominic23

Yes, those are the pop-ups that I'm seeing.

When I clear the library caches, it seems to get rid of them temporarily - especially in the morning.

But by evening, they're back again.

I've tried to force quit safari - and then re-open with the shift key down, and it doesn't change anything. The pop-up virus is still there.


I'm not familiar with etrecheck.com - so I don't feel comfortable downloading it. I already have one virus, with the Adobe Flash scam - so I don't want to risk downloading another one. (I don't see etrecheck in the Apple store).

Are there any other suggestions for permanently getting rid of this virus? If so, I would really appreciate any suggestions.

Mar 6, 2020 11:08 PM in response to madisonNYC

Please load EtreCheck from the Mac App Store.

That tool then provides us with the hardware and software configuration details.

Otherwise, we basically tell you how to execute the many commands that EtreCheck uses, one at a rime.

This would be a more detailed path and very much akin to what Patricia666 was following.

Poke around the forums for the (many) other times this EtreCheck tool has been used.

Wouldn’t surprise me to find an add-on cleaner, add-on anri-malware, add-on anri-virus, add-on VPN client, or such.

Some of those are problematic, and others are sketchy.

Or yes, generic adware.

Mar 7, 2020 5:07 PM in response to Pactricia666

I strongly counsel against disabling Flash updates.

Flash has had many security vulnerabilities over the years.

Disabling updates for an app that run untrusted, remotely-loaded apps is precarious.

If patches are inappropriate and for whatever reason, best to remove Flash altogether.

And this case does not appear to be Flash itself given the OP’s initial update checks, but rather malware.

Mar 8, 2020 9:28 PM in response to madisonNYC

Make sure you have a complete and current backup. This in general, and given this is an old hard disk.


Remove the two add-on anti-virus apps per the vendor's’ instructions, reboot, and try again.


You’re short on physical memory, and this hard disk looks like it might be headed for hardware problems.


Remove Java, unless you’re using that.


I’d likely remove Google apps, as those have a habit of being resource-intensive.


Remove Flash, unless you’re using that.


Remove Microsoft Silverlight.


There’s some truly ancient software on this Mac, too. That Easy-WebPrint app is a decade old.


Upgrade Paragon, or remove it.


Check for browser plug-ins, too.


Looking at what’s loaded here, I’d be inclined to back up, wipe, install High Sierra again, and load new copies of the necessary apps. And a RAM upgrade, and an SSD, if you want to try to get a few more years.

Mar 8, 2020 10:21 PM in response to MrHoffman

But if I do all of that, will it get rid of the adobe flash virus? I'm concerned that I'll do all of that - and the virus will still be there. :(


The reason I have the two anti-virus apps was to get rid of viruses and malware - and they actually worked in the past. But they didn't spot this one. ... Won't removing those two apps make me more vulnerable to malware?


Yes, it's an old MacBook Pro. But I love having all of the USB ports and SD card slot - which all of the newer models don't offer. (I'm not a fan of dongles - and I'd need lots of them in the newer models as I plug everything into my laptop - speakers, cameras, digital recorders, etc. ). ...... I increased my RAM a few years ago. (I think it's at the max now for this laptop). I know I'm going to have to bite the bullet and go with a newer model soon (since Apple excluded my laptop for the first time from the latest OS upgrade), but I'm hanging onto this one for as long as possible.

Mar 8, 2020 10:38 PM in response to MrHoffman

Wow. I didn't know that about Avast.

Thanks for letting me know! I'll definitely remove it.


I'm also going to try to remove the apps that you mentioned.


But I don't think I'll do a reinstall of High Sierra. I ran into a LOT of problems when I did the upgrade the first time - I wound up having to do it twice - everything was frozen - was awful. I had the Apple folks help me by phone with it. But it was a nightmare. I had done all of the previous OS upgrades with no problem - but HIgh Sierra was awful.

Mar 8, 2020 11:03 PM in response to madisonNYC

Your upgrade issues were quite probably all the odd and the old bits here, and the add-on security bits. Which is why I suggested the path I did. Wipe, install, migrate files and docs, and load just the needed apps. Add-on anti-malware has a long history of causing problems. There’s comparatively little Mac “virus” malware around. Most of the malware—there’s a fair amount of it—is stuff that the user intentionally installs, and which means the anti-malware really can’t easily tell if it’s a feature that the user wants and needs, or if it’s junk... `The Apple anti-malware does a decent job with the most pernicious junk that’s around, too.

Mar 10, 2020 7:08 AM in response to madisonNYC

Some of those pop-ups are just straight up website scam postings. Web sites you visit, with themselves or their advertisers trying to get you to load malware.


As for your configuration, Adobe Flash, Silverlight, both add-on anti-virus apps, Java, Google, and the old Paragon NTFS have all been removed, and you are still getting not-website-ads pop-ups?


You’ve probably also flush Safari cookies and apps, and remove extensions?


If so... Enable full drive access in EtreCheck and then post another report, as that’ll be able to show more:

https://www.etrecheck.com/faq

How do I get rid of Adobe flash update virus on Safari browser?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.