ClamXav virus scan has found JS.Adware.Multiplug malware on my macbook air. How do I remove it?

http://www.thesafemac.com/mmg-antivirus/

Hope thomas_r will see this and helps you out.

Best.

I answered you on your other topic, but on that one you didn't mention this:

I started getting wierd adds popping up on my browser

This would not be related to that malware, which is not Mac malware as I indicated on your other topic, unless it is isolated to a specific site that has been hacked. You may, however, have installed some adware, which may not be detected by ClamXav. See if you have anything mentioned in my Adware Removal Guide installed, and if you do, follow the removal instructions there.

For fastest, most efficient assistance with questions such as this, visit the ClamXav Forum.

Luckyu44 wrote:

ClamXav virus scan has found JS.Adware.Multiplug malware on my macbook air.

We need to know exactly where it was found.

To get detailed information on what ClamXav has found, click in the top pane of the ClamXav window showing the Infection / File Name / Status to make sure it's in front and press the command and A keys, then command and C (or choose "Select-All", "Copy" from the "Edit" menu) to copy the information to your clipboard, then come back here and type command and V or choose "Paste" to show us what was found where.

From the infection name, I would have to say this is a javascript that provides adware, but in checking with virustotal.com, most of the other A-V scanners identify it as Windows only, so it may not necessarily the the cause of your problem.

Instructions for Dealing with Infected Files.

I suspect that you have a browser extension installed that is causing this, so start by disabling extensions if you are using Safari and read this Adware Removal Guide. If you use Glims I would start there.

A couple of us are still standing by here to hear what you have found. On the chance that it's something new, we'd like to know where to obtain a copy of it for analysis and to protect others, so please keep us in the loop with all the details you have.

What was the extension called? If you tell us, we may be able to identify where it came from so you can avoid similar problems in the future.

Luckyu44 wrote:

Unfortunately I don't remember.

Do any of these look familiar?

I've been having similar problems on my MacBookPro, but I've been using Chrome. ClamXav also found this js.adware.multiplug, but you're correct in that it was in the Safari plugins folder, which should not be affecting Chrome. Clam found no other viruses or infections, running an updated Definition file that I just completed running this evening (12/23/14 6pm).

The behavior I'm see so far only seems to affect Gmail, and it only happens intermittently. When I click on links that normally opens a new tab going outside Gmail, instead of going to the intended destination, it opens some ad page. Once I close the tab and try clicking the link again, it goes to the correct page as it should have originally. This happens to various links in emails that come from trusted companies that I get email from all the time (airline reservations, etc.). I did catch a tab once in mid-flight as it was stuck, and it tried to go to a URL at this domain:

pp.developunit.info

Any help would be appreciated.

henrus wrote:

I've been having similar problems on my MacBookPro, but I've been using Chrome. ClamXav also found this js.adware.multiplug, but you're correct in that it was in the Safari plugins folder, which should not be affecting Chrome.

There is no Safari plugins folder. There are Internet Plug-Ins folders which are used by most browsers and there is a ~/Library/Safari/Extensions/ folder. Where was it found and what is the exact name of the file it was found in?

henrus wrote:

I did catch a tab once in mid-flight as it was stuck, and it tried to go to a URL at this domain:

pp.developunit.info

That site has been the subject of discussion on the Adblock plus forum, but all the info seems to relate to Windows users.

In Chrome, select "Extensions" from the Chrome Windows menu and give me the names of all the installed extensions.

It was in ~/Library/Caches/com.apple.Safari/Extensions. I also removed the plugin after finding it so I don't recall the exact name, and can't find it in the Trash or anywhere else in the drive. Sorry.

Feedly 18.2 (in there twice unexpectedly)

Google Cast

Hangouts

iTube Studio

Pocket 1.5.6

RSS Feed Reader 5.2.2

save keep 1.3

Ok, Sophos found the following:

OSX/Geonei-A

filename: modinstaller.dmg

Was in my downloads folder. My son plays minecraft and has been installing mods, so that might be a culprit. Though if it did install on the system, other than the dmg file, I can't find any trace of this running on the system.