gsecurecontent

To ascertain the cause so that you can eliminate it, start by inspecting the contents of the following folder:

~/Library/LaunchAgents

To open that folder, copy the entire line above and paste it in the Finder's Go menu > Go to Folder... field. Make it look like this:

... and click the Go button.

A Finder window will open. Make sure all its file names are readable by selecting View > as List or other selection that shows that folder's complete contents. Then, take a screenshot of that Finder window.

• To learn how to capture a screenshot please read the Appendix in the following User Tip: Writing an effective Apple Support Communities question. It also includes instructions for posting a screenshot in a reply to this Discussion, so keep that Safari window open for now.

Often, there is nothing in that Launch Agents folder so don't be surprised to find it empty.

In the same manner as the above, navigate to this next folder:

/Library/LaunchDaemons

The Finder's Go menu > Go to Folder... field should look like this:

... and click the Go button once again.

Once again ensure all its files and their names are readable and capture a screenshot.

Then, repeat that exercise with the following folder:

/Library/LaunchAgents

Notice its pathname is different than the other two. The Finder's Go menu > Go to Folder... field should look like this:

In the end, you will have captured the contents of the following three separate folders:

~/Library/LaunchAgents

/Library/LaunchDaemons

/Library/LaunchAgents

All three will be saved to your Mac's Desktop with names "Screen Shot... " followed by the date and time they were captured. Please be sure to include or otherwise indicate the name of the folder that corresponds to each screenshot, so that you and I can keep track of which ones they are.

Post the entire contents of all three windows, one at a time, using the "picture" icon that appears below your reply text:

Please be advised the following reply is addressed to JRNiemiec's girlfriend and no one else, or their girlfriends.

First, ensure you have a reliable backup of your Mac, in case something should go wrong with continued troubleshooting. To learn how to do that, please read Back up your Mac with Time Machine.

• A backup is a fundamental prerequisite regardless of whatever method you may choose uninstall adware, and would apply even if your Mac were running perfectly well. Do not overlook this fundamental requirement. It's important.

Next: This step will prevent the scam products from loading so that they can be removed while they are inactive. Restart in "Safe Mode", and log in: Use safe mode to isolate issues with your Mac. Starting in Safe Mode takes longer than usual so let it finish. The rogue processes affecting that Mac are inoperative in "Safe Mode".

The following files and / or folders need to be deleted while using your Mac in "Safe Mode":

First screenshot:

Delete all the files shown in your first screenshot.

Second screenshot:

Delete all files except those with Adobe, Apple, and Citrix in their names.

Third screenshot:

Leave those files alone.

Drag the indicated selections of files to the Trash. You may be asked to authenticate. Confirm they are no longer present in that folder. Leave all the others alone for now.

Next: open Safari and select the Safari menu > Preferences... > Extensions. If you see any Safari Extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone. No Safari Extensions are required for normal operation. Then, select the General pane and review your Homepage selection. Repeat those equivalent actions for any other browser you may use (Brave, Firefox, or Opera for example).

There may also be adware-associated app icons in your Mac's Applications folder. Open it and examine its contents. Any unwanted or mysterious app icons should be obvious to you, but again please don't remove anything if you are uncertain—ask first. Identify any suspicious apps by name, or post another screenshot.

Next: In an abundance of caution, examine System Preferences > Extensions. Determine if there are any System Extensions that may have been installed without your knowledge. Ask if you're uncertain.

Remaining in System Preferences, check for the presence of any Profiles. Profiles are installed by organizations with a need to manage Macs deployed in institutional corporate or educational environments (for example), but have also been exploited by adware creators and similar malcontents. If any Profiles are installed on your Mac an icon like this will appear in System Preferences:

If you see that icon in System Preferences, select it. To remove a Profile, select it, then click the [—] (minus) button and authenticate.

Remaining in System Preferences, open Users & Groups. Select your User Account's Login Items. You may or may not find those Applications in its list. If you do, select them then click the [—] (minus) button to remove them from Login Items.

You can then restart your Mac and log in as usual. Evaluate its operation and ensure everything is working as you expect it should.

Next: if you want to eradicate all remaining adware remnants post a screenshot of the following folder, in the same manner as you did earlier:

~/Library/Application Support

It is normal for that folder to contain many items, but anything associated with the above adware may contain identical names. If you find a folder or folders bearing those names, drag those folders to the Trash. Without the files you already removed or the reintroduction of similar malware, they can do nothing but occupy space. These can be removed if you wish, but again don't remove anything if you are uncertain.

Finally: If any of the above actions result in abnormal operation or if something else stops working, the easiest way to recover would be to restore the Time Machine backup you created as a prerequisite, so the importance of that fundamental step cannot be overemphasized.

Please be advised the following reply is addressed to larkwest and no one else.

To fix it follow the instructions below. To learn how not to make that mistake again, please read How to install adware.

First, ensure you have a reliable backup of your Mac, in case something should go wrong with continued troubleshooting. To learn how to do that, please read Back up your Mac with Time Machine.

• A backup is a fundamental prerequisite regardless of whatever method you may choose uninstall adware, and would apply even if your Mac were running perfectly well. Do not overlook this fundamental requirement. It's important.

Next: This step will prevent the scam products from loading so that they can be removed while they are inactive. Restart in "Safe Mode", and log in: Use safe mode to isolate issues with your Mac. Starting in Safe Mode takes longer than usual so let it finish. The rogue processes affecting that Mac are inoperative in "Safe Mode".

The following files and / or folders need to be deleted while using your Mac in "Safe Mode":

First screenshot:

Nothing needs to be deleted from your first screenshot.

Second screenshot:

Delete all the files except those with Adobe and Dropbox in their names.

Third screenshot:

Leave those files alone.

Drag the indicated selections of files to the Trash. You may be asked to authenticate. Confirm they are no longer present in that folder. Leave all the others alone for now.

Next: open Safari and select the Safari menu > Preferences... > Extensions. If you see any Safari Extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone. No Safari Extensions are required for normal operation. Then, select the General pane and review your Homepage selection. Repeat those equivalent actions for any other browser you may use (Brave, Firefox, or Opera for example).

There may also be adware-associated app icons in your Mac's Applications folder. Open it and examine its contents. Any unwanted or mysterious app icons should be obvious to you, but again please don't remove anything if you are uncertain—ask first. Identify any suspicious apps by name, or post another screenshot.

Next: In an abundance of caution, examine System Preferences > Extensions. Determine if there are any System Extensions that may have been installed without your knowledge. Ask if you're uncertain.

Remaining in System Preferences, check for the presence of any Profiles. Profiles are installed by organizations with a need to manage Macs deployed in institutional corporate or educational environments (for example), but have also been exploited by adware creators and similar malcontents. If any Profiles are installed on your Mac an icon like this will appear in System Preferences:

If you see that icon in System Preferences, select it. To remove a Profile, select it, then click the [—] (minus) button and authenticate.

Remaining in System Preferences, open Users & Groups. Select your User Account's Login Items. You may or may not find those Applications in its list. If you do, select them then click the [—] (minus) button to remove them from Login Items.

You can then restart your Mac and log in as usual. Evaluate its operation and ensure everything is working as you expect it should.

Next: if you want to eradicate all remaining adware remnants post a screenshot of the following folder, in the same manner as you did earlier:

~/Library/Application Support

It is normal for that folder to contain many items, but anything associated with the above adware may contain identical names. If you find a folder or folders bearing those names, drag those folders to the Trash. Without the files you already removed or the reintroduction of similar malware, they can do nothing but occupy space. These can be removed if you wish, but again don't remove anything if you are uncertain.

Finally: If any of the above actions result in abnormal operation or if something else stops working, the easiest way to recover would be to restore the Time Machine backup you created as a prerequisite, so the importance of that fundamental step cannot be overemphasized.

Please be advised the following reply is addressed to schcatpet92 and no one else.

To fix it follow the instructions below. To learn how not to make that mistake again, please read How to install adware.

First, ensure you have a reliable backup of your Mac, in case something should go wrong with continued troubleshooting. To learn how to do that, please read Back up your Mac with Time Machine.

• A backup is a fundamental prerequisite regardless of whatever method you may choose uninstall adware, and would apply even if your Mac were running perfectly well. Do not overlook this fundamental requirement. It's important.

Next: This step will prevent the scam products from loading so that they can be removed while they are inactive. Restart in "Safe Mode", and log in: Use safe mode to isolate issues with your Mac. Starting in Safe Mode takes longer than usual so let it finish. The rogue processes affecting that Mac are inoperative in "Safe Mode".

The following files and / or folders need to be deleted while using your Mac in "Safe Mode":

First screenshot:

Delete all the files shown in your first screenshot.

Second screenshot:

Delete the file with RunApp in its name to the Trash.

Third screenshot:

Leave those files alone.

Drag those selections of files to the Trash. You may be asked to authenticate. Confirm they are no longer present in that folder. Leave all the others alone for now.

Next: open Safari and select the Safari menu > Preferences... > Extensions. If you see any Safari Extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone. No Safari Extensions are required for normal operation. Then, select the General pane and review your Homepage selection. Repeat those equivalent actions for any other browser you may use (Brave, Firefox, or Opera for example).

There may also be adware-associated app icons in your Mac's Applications folder. Open it and examine its contents. Any unwanted or mysterious app icons should be obvious to you, but again please don't remove anything if you are uncertain—ask first. Identify any suspicious apps by name, or post another screenshot.

Next: In an abundance of caution, examine System Preferences > Extensions. Determine if there are any System Extensions that may have been installed without your knowledge. Ask if you're uncertain.

Remaining in System Preferences, check for the presence of any Profiles. Profiles are installed by organizations with a need to manage Macs deployed in institutional corporate or educational environments (for example), but have also been exploited by adware creators and similar malcontents. If any Profiles are installed on your Mac an icon like this will appear in System Preferences:

If you see that icon in System Preferences, select it. To remove a Profile, select it, then click the [—] (minus) button and authenticate.

Remaining in System Preferences, open Users & Groups. Select your User Account's Login Items. You may or may not find those Applications in its list. If you do, select them then click the [—] (minus) button to remove them from Login Items.

You can then restart your Mac and log in as usual. Evaluate its operation and ensure everything is working as you expect it should.

Next: if you want to eradicate all remaining adware remnants post a screenshot of the following folder, in the same manner as you did earlier:

~/Library/Application Support

It is normal for that folder to contain many items, but anything associated with the above adware may contain identical names. If you find a folder or folders bearing those names, drag those folders to the Trash. Without the files you already removed or the reintroduction of similar malware, they can do nothing but occupy space. These can be removed if you wish, but again don't remove anything if you are uncertain.

Finally: If any of the above actions result in abnormal operation or if something else stops working, the easiest way to recover would be to restore the Time Machine backup you created as a prerequisite, so the importance of that fundamental step cannot be overemphasized.

In anticipation of others piling on with additional "me too" requests consider the following general instructions for eradicating adware. These things are always the result of deliberately downloading and installing something. You never need to download and install something else to fix it.

To learn how not to make that mistake again, please read How to install adware.

The subject dialog always takes this form, as described in Safely open apps on your Mac:

Move to Trash is the correct response. When that message becomes persistent though, the cause is always the same: one or more files that spawn the process resulting in its appearance.

General instructions applicable to all similarly categorized malware are as follows:

• Back up the affected Mac with Time Machine which everyone ought to be doing anyway
• Boot Safe Mode
• While in Safe Mode, identify all the files that result in creating the process that causes the dialog above, and drag them to the Trash.

The folders to be examined are these three:

~/Library/LaunchAgents

/Library/LaunchDaemons

/Library/LaunchAgents

There should only be few files, if any, in each of the above folders. You should have a passing familiarity with what they are and the reason you need them. If you're unsure, ask.

Legitimate products that deposit system-altering components in those folders commonly include Adobe, Amazon, Citrix, Dropbox, Google and Microsoft, including its product Skype. Teamviewer also, assuming you really need it. Less common but equally legitimate products include Steam (games), various non-Apple "cloud backup" products that don't work very well, and device drivers for external hardware such as printers and non-Apple input devices. It's incumbent upon every Mac user to know the products they install on your Mac, so the files they deposit in those folders will never come as a surprise.

Illegitimate products notorious for causing trouble include any non-Apple product that claims to "clean", "enhance", "optimize", "protect", or "scan" your Mac. Anything in that broad category of junk should be uninstalled according to their instructions and never reinstalled, ever again.

Everything else should be regarded as suspicious. Some malware will litter those folders with hundreds of randomly named files in a pathetic attempt to obscure itself. For one particularly egregious example refer to notice unysgar.app, but if you have no explanation for any particular file in those folders you need to investigate.

Among a few examples are files containing the following in their names:

calculator

confcloud

copypaste

date

fixer

helper

hlpr

mafntask

moniter 🙄

pcv

scan

search

systemExtr

spigot

techyutil

time

updService

util

utilty

vlm

... files containing nothing but a random string of long alphanumeric text

... among a few others, but deleting those is a good place to start.

Then, reset your desired Search Engine, uninstall any strange Extensions, remove any unwanted Login Items, delete any unwanted apps, examine System Preferences for the existence of any Profiles, and finally restart your Mac (normally; not Safe Mode).

Then, evaluate its operation. If something still isn't right re-examine those three folders and determine if you overlooked anything. If something really gets messed up you have Time Machine to fall back on, so keep that important fact in mind.

That in a nutshell is how you get rid of adware, on your own, without having to install some sketchy tool or even ask anyone else for help. If you prefer individual attention specifically tailored to your needs though, then by all means please post a new Discussion. To do that click the Post link above right, and choose Discussion from the dropdown menu:



Need to get rid of gsecurecontent.com invading my safari

Attached are the three screenshots:

1st) /Library/LaunchAgents

2nd) ~/Library/LaunchAgents

3rd) LaunchDaemons

I apprecaite your help, John.

My girlfriend has this problem so as of now limiting use of the laptop until more is understood. But here are the screenshots of the 3 files. Additionally this prompt attempts to gain control of the web browser and was clicked on "Don't allow". Now system repeatedly attempts to open a bad Request to gscurecontent.com.

Hey there! Agreed with the previous posts, you may have unintentionally downloaded malware from the web.

As BDAqua said, I know Malware Bytes for Mac is awesome at finding known malware if the OS is up to date, and a simple restart doesn’t eliminate it.

And as John Galt said, you can manually search for suspicious items in those locations if still having symptoms.

Other locations to check may be /Internet Plugins, /Startup Items, and ~/Internet Plugins.

However these crafty people are programming new scams everyday, other good locations to check if you think you downloaded this stuff are:

System Preferences > Profiles, if you have this category and see anything there you don’t recognize or install yourself, you can remove it by highlighting and pressing the “-“ sign.

Next, if still having issues, I’d check, also in System Preferences > Users and Groups > Login Items. Also if you see anything there you don’t recognize, remove using the same method. (This doesn’t delete any apps, just prevents them from opening every time you log in).

If what was downloaded is affecting your network connectivity, I’d also check out:

System Preferences > Network > Proxies, if any proxy is enabled there that you, or your network administrator didn’t enable, you can also remove, just remember to click “Apply” afterwards. (A lot of the times the bottom proxy setting is enabled, usually that’s okay).

In case an Extension was installed in your browser that you didn’t install your self, check;

Safari > Preferences > Extensions, if you see something there unfamiliar, you can uninstall it.

For Chrome:

Chrome > Preferences > Extensions, you can do the same there.

Also in those browser settings you can check the Search Engines to make sure those are how you set them, and even the home page settings, if not, you should be able to change them back again to your preference. Restarting after each step is a good idea too.

There are other useful built in functions, such as Show Status Bar option in Safari,

From the top menu, select View > Show status bar. This way, when you hover the cursor over a web link, it shows the actual web address on the bottom. You never know, a link may say one thing, but is something else totally.

Likewise, secure websites are addresses as “https”, as opposed to “http”. Not to say that the latter site isn’t legit, it’s just not as protected, (You’d also see a lock icon on the top left of the address bar if secure).

And of course, another vital Safari Function Is to “Block Pop Ups”, in Safari > Preferences > Security.

But for the most part, the best and easiest thing to do is to keep the OS up to date, (And being cautious of course), as there are already many people at Apple working at this 247, so that’s the path of least resistance and hopefully fixes it in your case!

Hope that helps!

Hey there! I see several suspicious items in there, in particular MacUpper.plist, if you don’t see the name of an app or their developer after you recognize after “com.” Most likely you can delete/restart and test.

If you are uncertain of what apps these items belong to, you can save a copy of them, while de activating them, and if you have a particular app not working properly after restarting, can simply put the file with that apps name back and restart again.

A way to do this for all files, (Or just some suspect files), is:

Select the files in question, select File > New Folder With (Selected Items). Then hit okay.

This moved the files into the new folder essentially de-activating them, afterwards you can restart and test the issue.

If their happens to be an issue with a particular app, (For instance Dropbox), you can simply move the “com.dropbox” file back into the parent folder it used to be in and restart.

Typically though I rarely see an issue with doing this, those files typically re generate during use. But if you do see a file with a namesake you don’t recognize it’s typically safe to delete, just make sure you restart before testing.

Hi I'm having same issue with pop ups. What is next?

What's next is creating your own Discussion. That way, you will receive the individual attention you deserve.

Chilli Pepper hasn't replied yet and may never reply. If and when that happens the solution will have been buried under a bunch of "me too" posts, making it difficult to find.

To create your own Discussion, click the Post link at the top of this page, then choose Discussion from the dropdown menu. You can include the requested screenshots if you wish, but you have to include your own screenshots. Not someone else's.

You may wish to follow general instructions. That's ok, and simple enough to do, just bear in mind everyone's Mac is different meaning those three folders are certain to contain different items. The likelihood of creating a mess by following instructions addressed to someone other than you is just as certain.

If nothing else, the order in which the screenshots is significant. When I refer to "the first screenshot", "the second screenshot" and so forth, it refers to the order in which those screenshots appear in that person's reply. Ok?

Do I delete things in those folders?

Yes but not everything, which is another reason you should create your own Discussion.

Anyone experiencing the same problem should do that, unless of course they want to follow along to learn how to fix it on their own, or adapt a general procedure to their own particular installation. I'll provide that general procedure presently.

Sounds like a new variation of the Adware going around..

The free Malwarebytes may take care of it...

https://www.malwarebytes.com/mac/

👍

Now tell others how to fix it. Of course it's best not to install adware to begin with, but if you are deceived into installing it, removing it is not difficult.

Update the firewall was not on and is now on with laptop now powered off

Hi I'm having same issue with pop ups. What is next? Do I delete things in those folders?