Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Socks Proxy Keeps Turning On.

I am not computer savvy. SOCKS proxy keeps turning on. The EtreCheck Report is attached to this post.


Please advise. Thank you!!


MacBook Pro 13″, macOS 10.13

Posted on Apr 14, 2021 10:36 AM

Reply
Question marked as Best reply

Posted on Apr 14, 2021 11:11 AM

You have adware installed on your Mac. Remove it.




From the report:

Adware - Adware detected.

Launchd: /Library/LaunchDaemons/com.SearchForWordsDaemon.plist

Reason: Adware pattern match

Executable: /Library/Application Support/com.SearchForWordsDaemon/SearchForWords r

Launchd: ~/Library/LaunchAgents/com.SearchForWords.plist

Reason: Adware pattern match

Executable: ~/Library/Application Support/com.SearchForWords/SearchForWords r

Unsigned Files:

Launchd: /Library/LaunchDaemons/com.SearchForWordsP.plist

Executable: /var/root/.SearchForWords/SearchForWordsDaemon pd Details: Domain name invalid - possibly adware

Launchd: /Library/LaunchDaemons/com.3451890843140963949.10917369688.plist


Executable: /Library/Application Support/com.3520623699645199661/5798495561749875614 D852871C-4F0F-4815-B180-57506B120719 49988F3B-ABCD-4EAA-9AA4-AEB0EE989B86

Details: Domain name invalid - possibly adware

Launchd: ~/Library/LaunchAgents/com.EB283FA7.59CB.44E1.AE3D.47EB19E4AC37.plist Executable: /usr/bin/python '/Users/***/Library/Application

Support/.E5BF1744-D3A1-4200-8C39-F44EAD25EDF2/.2168B241-E615-4EBC-B7F7-BBCB2D567F1F' Details: Domain name invalid - possibly adware

Launchd: ~/Library/LaunchAgents/com.SmsgylxrdiKcOXSJLngvAgent.plist

Executable: ~/Library/Application Support/com.SmsgylxrdiKcOXSJLngvAgent/SmsgylxrdiKcOXSJLngv

com.SmsgylxrdiKcOXSJLngvAgent

Details: Domain name invalid - possibly adware






Go step by step and test.


   1. Remove unknown profiles if present.

      System Preferences > Profiles

      Open System Preferences,  select “General and click  the “Profiles” icon ( a checkmark on a gear) .

      When Profiles pane opens, select the unknown profile and click the minus button at the bottom.

      Section: Remove a configuration profile from your Mac

      Profiles: https://support.apple.com/guide/mac-help/configuration-profiles-standardize-settings-mh35561/mac


  2. Remove unknown extensions:  Safari > Preferences > Extensions

      https://support.apple.com/guide/safari/use-safari-extensions-sfri32508/m

   3. Check for adware.


       Run the latest release of Malwarebytes for Mac to remove malware/adware, if installed on your Mac.

       For instructions: Install Malwarebytes for Mac v4      Uninstall Malwarebytes for Mac

       Click the “FREE DOWNLOAD” button.

       Click the “Scan” button. Once done, quit Malwarebytes for Mac.

       Restart the computer and relaunch Safari holding the shift key down.

       Scan for Malware again.


       Additional steps  if necessary.

  4. Reset search engine:    https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac

  5. Reset  Homepage.   https://support.apple.com/guide/safari/set-your-homepage-ibrw1020/mac 

  6. Check proxies. SOCKS?

      System Preferences > Network > Advanced > Proxies

      Deselect   any  proxies if selected.   

   7. Restart the Mac. Relaunch Safari holding the Shift key down. 

1 reply
Question marked as Best reply

Apr 14, 2021 11:11 AM in response to onyisraw

You have adware installed on your Mac. Remove it.




From the report:

Adware - Adware detected.

Launchd: /Library/LaunchDaemons/com.SearchForWordsDaemon.plist

Reason: Adware pattern match

Executable: /Library/Application Support/com.SearchForWordsDaemon/SearchForWords r

Launchd: ~/Library/LaunchAgents/com.SearchForWords.plist

Reason: Adware pattern match

Executable: ~/Library/Application Support/com.SearchForWords/SearchForWords r

Unsigned Files:

Launchd: /Library/LaunchDaemons/com.SearchForWordsP.plist

Executable: /var/root/.SearchForWords/SearchForWordsDaemon pd Details: Domain name invalid - possibly adware

Launchd: /Library/LaunchDaemons/com.3451890843140963949.10917369688.plist


Executable: /Library/Application Support/com.3520623699645199661/5798495561749875614 D852871C-4F0F-4815-B180-57506B120719 49988F3B-ABCD-4EAA-9AA4-AEB0EE989B86

Details: Domain name invalid - possibly adware

Launchd: ~/Library/LaunchAgents/com.EB283FA7.59CB.44E1.AE3D.47EB19E4AC37.plist Executable: /usr/bin/python '/Users/***/Library/Application

Support/.E5BF1744-D3A1-4200-8C39-F44EAD25EDF2/.2168B241-E615-4EBC-B7F7-BBCB2D567F1F' Details: Domain name invalid - possibly adware

Launchd: ~/Library/LaunchAgents/com.SmsgylxrdiKcOXSJLngvAgent.plist

Executable: ~/Library/Application Support/com.SmsgylxrdiKcOXSJLngvAgent/SmsgylxrdiKcOXSJLngv

com.SmsgylxrdiKcOXSJLngvAgent

Details: Domain name invalid - possibly adware






Go step by step and test.


   1. Remove unknown profiles if present.

      System Preferences > Profiles

      Open System Preferences,  select “General and click  the “Profiles” icon ( a checkmark on a gear) .

      When Profiles pane opens, select the unknown profile and click the minus button at the bottom.

      Section: Remove a configuration profile from your Mac

      Profiles: https://support.apple.com/guide/mac-help/configuration-profiles-standardize-settings-mh35561/mac


  2. Remove unknown extensions:  Safari > Preferences > Extensions

      https://support.apple.com/guide/safari/use-safari-extensions-sfri32508/m

   3. Check for adware.


       Run the latest release of Malwarebytes for Mac to remove malware/adware, if installed on your Mac.

       For instructions: Install Malwarebytes for Mac v4      Uninstall Malwarebytes for Mac

       Click the “FREE DOWNLOAD” button.

       Click the “Scan” button. Once done, quit Malwarebytes for Mac.

       Restart the computer and relaunch Safari holding the shift key down.

       Scan for Malware again.


       Additional steps  if necessary.

  4. Reset search engine:    https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac

  5. Reset  Homepage.   https://support.apple.com/guide/safari/set-your-homepage-ibrw1020/mac 

  6. Check proxies. SOCKS?

      System Preferences > Network > Advanced > Proxies

      Deselect   any  proxies if selected.   

   7. Restart the Mac. Relaunch Safari holding the Shift key down. 

Socks Proxy Keeps Turning On.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.