Anon4876

Q: How to remove Adware?

Recently i've downloaded something and now I have all this adware on safari. Pop up ads and Certain words are highlited that when clicked go to ads for surveys and stuff etc. I've tried everything but i cant get rid of the highlighted text. Does anyone know how to fix this?

MacBook Pro

Posted on Mar 5, 2014 2:06 AM

Close

Q: How to remove Adware?

  • All replies
  • Helpful answers

first Previous Page 6 of 14 last Next
  • by amals4,

    amals4 amals4 Sep 21, 2014 3:27 PM in response to Linc Davis
    Level 1 (0 points)
    Sep 21, 2014 3:27 PM in response to Linc Davis

    Linc Davis,

     

    I too have this issue and and ran the shell script as per your instructions in this thread.

     

    Boot Mode: Normal

     

     

    Model: MacBookAir6,2

     

     

    System load advisory

     

     

       combined level = Bad

       - user level = OK

       - battery level = Bad

       - thermal level = Great

     

     

    System diagnostics

     

     

       2014-09-19 PluginProcess spin

       2014-09-19 PluginProcess spin

       2014-09-19 PluginProcess spin

       2014-09-19 PluginProcess spin

       2014-09-19 PluginProcess spin

       2014-09-19 com.apple.WebKit.WebContent spin

       2014-09-20 Meeting Center spin

       2014-09-20 TeamViewer_Desktop shutdownStall

       2014-09-21 PluginProcess spin

       2014-09-21 com.apple.WebKit.WebContent spin

     

     

    User diagnostics

     

     

       2014-09-01 PluginProcess crash

       2014-09-04 PluginProcess crash

       2014-09-05 PluginProcess crash

       2014-09-05 PluginProcess crash

       2014-09-14 PluginProcess crash

     

     

    Kernel messages

     

     

       Sep 15 09:47:15   wl0: Roamed or switched channel, reason #8, bssid f8:e4:fb:00:c2:0b

       --- last message repeated 2 times ---

       Sep 16 16:57:26   process com.apple.WebKit[24580] thread 1390535 caught burning CPU! It used more than 50% CPU (Actual recent usage: 57%) over 180 seconds. thread lifetime cpu usage 194.250762 seconds, (187.732446 user, 6.518316 system) ledger info: balance: 90008906425 credit: 192142642590 debit: 102133736165 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 157867370395

       Sep 17 04:19:39   wl0: Roamed or switched channel, reason #2, bssid f8:e4:fb:00:c2:0b

       Sep 18 14:23:06   wl0: Roamed or switched channel, reason #8, bssid f8:e4:fb:00:c2:0b

       --- last message repeated 6 times ---

       Sep 19 23:50:40   process com.apple.WebKit[1001] thread 90194 caught burning CPU! It used more than 50% CPU (Actual recent usage: 55%) over 180 seconds. thread lifetime cpu usage 145.540020 seconds, (127.756049 user, 17.783971 system) ledger info: balance: 90056562313 credit: 136663263333 debit: 46606701020 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 163231654813

       Sep 20 08:24:38   wl0: Roamed or switched channel, reason #8, bssid f8:e4:fb:00:c2:0b

       --- last message repeated 2 times ---

       Sep 20 11:36:43   Process Setup Assistant [178] disabling system-wide I/O Throttling

       Sep 20 11:36:43   Process Setup Assistant [178] disabling system-wide CPU Throttling

       Sep 21 12:11:21   wl0: Roamed or switched channel, reason #8, bssid f8:e4:fb:00:c2:0b

       --- last message repeated 3 times ---

     

     

    Extrinsic daemons

     

     

       jp.co.canon.MasterInstaller

       com.vsearch.helper

       com.teamviewer.service

       com.period.searchprotectd

       com.oracle.java.Helper-Tool

       com.mozy.backup

       com.microsoft.office.licensing.helper

       com.adobe.fpsaud

     

     

    Extrinsic agents

     

     

       com.vsearch.agent

       com.teamviewer.desktop

       com.teamviewer.teamviewer

       com.oracle.java.Java-Updater

       com.mozy.status

     

     

    launchd items

     

     

       /Library/LaunchAgents/com.mozy.status.plist

        (com.mozy.status)

       /Library/LaunchAgents/com.oracle.java.Java-Updater.plist

        (com.oracle.java.Java-Updater)

       /Library/LaunchAgents/com.teamviewer.teamviewer.plist

        (com.teamviewer.teamviewer)

       /Library/LaunchAgents/com.teamviewer.teamviewer_desktop.plist

        (com.teamviewer.desktop)

       /Library/LaunchAgents/com.vsearch.agent.plist

        (com.vsearch.agent)

       /Library/LaunchDaemons/com.adobe.fpsaud.plist

        (com.adobe.fpsaud)

       /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

        (com.microsoft.office.licensing.helper)

       /Library/LaunchDaemons/com.mozy.backup.plist

        (com.mozy.backup)

       /Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist

        (com.oracle.java.Helper-Tool)

       /Library/LaunchDaemons/com.perion.searchprotectd.plist

        (com.period.searchprotectd)

       /Library/LaunchDaemons/com.teamviewer.teamviewer_service.plist

        (com.teamviewer.service)

       /Library/LaunchDaemons/com.vsearch.daemon.plist

        (com.vsearch.daemon)

       /Library/LaunchDaemons/com.vsearch.helper.plist

        (com.vsearch.helper)

       /Library/LaunchDaemons/jp.co.canon.MasterInstaller.plist

        (jp.co.canon.MasterInstaller)

     

     

    Extrinsic loadable bundles

     

     

       /Library/Internet Plug-Ins/Flash Player.plugin

        (com.macromedia.Flash Player.plugin)

       /Library/Internet Plug-Ins/JavaAppletPlugin.plugin

        (com.oracle.java.JavaAppletPlugin)

       /Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin

        (com.microsoft.sharepoint.browserplugin)

       /Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin

        (com.microsoft.sharepoint.webkitplugin)

       /Library/PreferencePanes/Flash Player.prefPane

        (com.adobe.flashplayerpreferences)

       /Library/PreferencePanes/JavaControlPanel.prefPane

        (com.oracle.java.JavaControlPanel)

       /Library/PreferencePanes/MozyHome.prefPane

        (com.mozy.configpane)

       Library/Internet Plug-Ins/WebEx64.plugin

        (com.cisco_webex.plugin.gpc64)

     

     

    Global login items

     

     

       /Library/Printers/SPanel/Samsung/SPanel.app

       /Library/Printers/Samsung/Daemon/DaemonManager/DaemonManager.app

     

     

    User login items

     

     

       iTunesHelper

       WDDriveUtilityHelper

       WDDriveUtilityHelper

       Dropbox.app

     

     

    Restricted user files: 46

     

     

    Font problems: 21

     

     

    Elapsed time (s): 79

  • by MadMacs0,

    MadMacs0 MadMacs0 Sep 21, 2014 3:30 PM in response to amals4
    Level 5 (4,791 points)
    Sep 21, 2014 3:30 PM in response to amals4

    Linc is probably not monitoring this thread any longer and rarely responds to "me to" entries either.

     

    Start a new discussion item, describe your problem in much greater detail (there's a lot of adware around) with screen-shots of what you see, if possible. Don't post Linc's shell script until asked for.

     

    That's just the way this forum works best.

  • by flipflopguy,

    flipflopguy flipflopguy Sep 22, 2014 10:52 PM in response to Anon4876
    Level 1 (0 points)
    Sep 22, 2014 10:52 PM in response to Anon4876

    I had similar problem. Downloaded Admedic and fixed problem in about 1 minute. Don't recommend "thesafemac" which is essentially adware. Be careful with downloading Admedic because adware companies have links on the page.

  • by MadMacs0,

    MadMacs0 MadMacs0 Sep 22, 2014 11:28 PM in response to flipflopguy
    Level 5 (4,791 points)
    Sep 22, 2014 11:28 PM in response to flipflopguy

    flipflopguy wrote:

     

    Downloaded Admedic and fixed problem in about 1 minute. Don't recommend "thesafemac" which is essentially adware.

    You are very much mistaken. The owner of TheSafeMac is thomas_r. the developer of AdMedic (now called AdwareMedic http://www.thesafemac.com/adwaremedic/) who has posted previously to this particular discussion and hundreds of others in this forum. He is the recognized malware guru here.

    Be careful with downloading Admedic because adware companies have links on the page.

    That may be true as we have already seen MacUpdate and Softpedia pick it up. If you find a link where the installer includes adware, please let thomas_r. know so that he can issue a cease and desist order to them. Best to only download it from TheSafeMac link I gave above or the AdwareMedic site.

  • by thomas_r.,

    thomas_r. thomas_r. Sep 23, 2014 3:38 AM in response to flipflopguy
    Level 7 (30,924 points)
    Mac OS X
    Sep 23, 2014 3:38 AM in response to flipflopguy

    flipflopguy wrote:

     

    Don't recommend "thesafemac" which is essentially adware. Be careful with downloading Admedic because adware companies have links on the page.

     

    Can you clarify why you believe that The Safe Mac is adware? The Safe Mac is a website, not a program, and I assure you (as the owner of that site) that there are no ads whatsoever on The Safe Mac, nor any adware being distributed there. If there is someone doing something unethical in the name of The Safe Mac, I want to hear about it so I can put an end to it!

     

    As for AdwareMedic, there are absolutely no ads on the official AdwareMedic page (www.adwaremedic.com). There are ads on the MacUpdate and Softpedia pages for AdwareMedic, which I have no control over. Those ads include some for junk software, but none for adware to my knowledge. If you have seen AdwareMedic available for download somewhere else, with more dangerous ads on the page, please let me know where that is.

  • by flipflopguy,

    flipflopguy flipflopguy Sep 23, 2014 9:18 AM in response to thomas_r.
    Level 1 (0 points)
    Sep 23, 2014 9:18 AM in response to thomas_r.

    With the adware on infected computer and clicking on "thesafemac" website, user is directed to other adware sites attempting to sell software to clean mac of adware (not AdMedic). The problem is not be with "thesafemac" website but with adware infected computer. This is what happened on my daughter's computer when we tried to go to "thesafemac." AdMedic worked perfectly to delete adware.

  • by MadMacs0,

    MadMacs0 MadMacs0 Sep 23, 2014 9:47 AM in response to flipflopguy
    Level 5 (4,791 points)
    Sep 23, 2014 9:47 AM in response to flipflopguy

    flipflopguy wrote:

     

    With the adware on infected computer and clicking on "thesafemac" website, user is directed to other adware sites attempting to sell software to clean mac of adware (not AdMedic).

    Yes, of course, but it will do that for any site you try to go to. TheSafeMac site itself doesn't contain anything that would cause this to happen.

  • by thomas_r.,

    thomas_r. thomas_r. Sep 23, 2014 9:50 AM in response to flipflopguy
    Level 7 (30,924 points)
    Mac OS X
    Sep 23, 2014 9:50 AM in response to flipflopguy

    Ahh, I understand. You're right, that's not due to The Safe Mac, but is caused by the adware injecting ads into The Safe Mac pages. It's very easy to mistake the source of those ads as belonging to The Safe Mac, or whatever other site they may appear on.

     

    If you ever see an ad on The Safe Mac, or on the AdwareMedic site, you should take that as an indication that you have adware installed, or have some other ad-related problem, such as a possible network compromise. There will NEVER be ads on either of those sites (I can say that definitively, as the owner of those sites), since ads would be counter to the mission of both sites.

  • by tucsondon,

    tucsondon tucsondon Oct 7, 2014 12:51 PM in response to Anon4876
    Level 1 (0 points)
    Oct 7, 2014 12:51 PM in response to Anon4876

    I had the exact same problem that plagued Safari and Google Chrome for months. I was at my wits end trying to find the malicious code that was causing this. Some people were saying that it was code by rz.zeobit.com, but after finding all of that code and removing it, I still had the same problems.

     

    Finally, I found a little piece Donationware called AdwareMedic. This little program worked like a charm for me. AdwareMedic will not install anything on your system. When it is opened, it will connect to adwaremedic.com to check for and/or download the latest adware "signatures" (a small text file that tells AdwareMedic how to identify adware components). AdwareMedic requires a Mac running Mac OS X 10.7 (Lion) or later.

     

    If this corrects your problem like it did mine, you should consider saying thanks with a donation.

  • by levisNvans,

    levisNvans levisNvans Oct 11, 2014 10:29 AM in response to Linc Davis
    Level 1 (0 points)
    Oct 11, 2014 10:29 AM in response to Linc Davis

    Thank you! I had extra extensions that I did not authorize.

  • by Ai242,

    Ai242 Ai242 Oct 15, 2014 12:55 AM in response to Linc Davis
    Level 1 (0 points)
    Oct 15, 2014 12:55 AM in response to Linc Davis

    Linc Davis-

    You rock. Thanks for posting this. Saved my (MBP) life.

    Seriously, I have tried stuff from several posts. None worked.

    This is gold.

    Thanks again,

  • by tvelocity514,

    tvelocity514 tvelocity514 Oct 19, 2014 11:38 AM in response to Linc Davis
    Level 1 (0 points)
    Oct 19, 2014 11:38 AM in response to Linc Davis

    Removed

  • by cmturney,

    cmturney cmturney Oct 20, 2014 4:54 PM in response to Linc Davis
    Level 1 (0 points)
    Oct 20, 2014 4:54 PM in response to Linc Davis

    I seem to be having the same issue with ads everywhere (my kid tried to DL a MineCraft mod).  However, the message I get when I reveal is this "The operation can’t be completed because the item can’t be found."  So I wonder what else it could be...

  • by MadMacs0,

    MadMacs0 MadMacs0 Oct 20, 2014 6:27 PM in response to cmturney
    Level 5 (4,791 points)
    Oct 20, 2014 6:27 PM in response to cmturney

    cmturney wrote:

     

    I seem to be having the same issue with ads everywhere (my kid tried to DL a MineCraft mod).  However, the message I get when I reveal is this "The operation can’t be completed because the item can’t be found."

    If it's just one or two files, that's OK because not all versions of Downlite (VSearch) install all of those files.

     

    If none of them are found, then you probably have installed a different brand of adware. At last count there were over twenty and some with multiple versions.

    AdwareMedic is a tool developed by one of this forum's foremost malware guru's and a colleague of mine. It's the safest, most effective way to identify all currently known adware and optionally offer to remove it for you or you can do so manually.

     

    If for some reason you don't want to try that, post a screenshot of what you are seeing so that we can identify what you have and point you to a different set of manual removal instructions.

  • by datadavid,

    datadavid datadavid Nov 3, 2014 3:25 PM in response to thomas_r.
    Level 1 (0 points)
    Nov 3, 2014 3:25 PM in response to thomas_r.

    I got this printout from the terminal:

    No root access

     

    Boot Mode: Normal

     

    Model: MacBook2,1

     

    Total RAM (GB): 2

     

    RAM details

     

            BANK 0/DIMM0:

     

              Size: 1 GB

              Speed: 667 MHz

              Status: OK

              Manufacturer: 0x7F7F7F7FCB000000

     

            BANK 1/DIMM1:

     

              Size: 1 GB

              Speed: 667 MHz

              Status: OK

              Manufacturer: 0x7F7F7F7FCB000000

     

    System load advisory

     

       combined level = Bad

       - user level = OK

       - battery level = Bad

       - thermal level = Great

     

    System diagnostics

     

       2014-10-28 vnetd crash

       2014-10-28 vnetd crash

       2014-10-28 vnetd crash

       2014-10-28 vnetd crash

       2014-10-28 vnetd crash

       2014-10-28 vnetd crash

       2014-10-28 vnetd crash

       2014-10-28 vnetd crash

       2014-10-28 vnetd crash

       2014-10-28 vnetd crash

     

    User diagnostics

     

       2014-10-26 plugin-container crash

     

    Kernel messages

     

       Fri Oct 24   kernel[0]: AppleSmartBatteryManager::setPowerState(0x4c77e00, 0 -> 1) timed out after 10123 ms

     

    Total CPU usage: user 19%, system 8%

     

    CPU usage by process "firefox" with UID 501: 47.6%

     

    Extrinsic agents

     

       edu.mit.Kerberos.KerberosAgent

       com.zteevdo.UDiskService

       com.spotify.webhelper

       edu.mit.Kerberos.CCacheServer

     

    launchd items

     

       /Library/LaunchAgents/com.zteevdo.UDiskService.plist

           (com.zteevdo.UDiskService)

       /Library/LaunchDaemons/com.adobe.fpsaud.plist

           (com.adobe.fpsaud)

       /Library/LaunchDaemons/com.apple.third_party_32b_kext_logger.plist

           (com.apple.third_party_32b_kext_logger)

       /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

           (com.microsoft.office.licensing.helper)

       /Library/LaunchDaemons/com.voddler.vnetd.plist

           (com.voddler.vnetd)

       Library/LaunchAgents/com.spotify.webhelper.plist

           (com.spotify.webhelper)

     

    Extrinsic loadable bundles

     

       /System/Library/Extensions/ModemDriverMac.kext

           (com.ZTE.driver.ModemDriverMac)

       /System/Library/Extensions/ssuddrv.kext

           (com.devguru.driver.SamsungComposite)

       /Library/Internet Plug-Ins/JavaAppletPlugin.plugin

           (com.apple.java.JavaAppletPlugin)

       /Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin

           (com.microsoft.sharepoint.browserplugin)

       /Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin

           (com.microsoft.sharepoint.webkitplugin)

       /Library/Internet Plug-Ins (Disabled)/Flash Player.plugin

           (com.macromedia.Flash Player.plugin)

       /Library/PreferencePanes/Flash Player.prefPane

           (com.adobe.flashplayerpreferences)

       /Library/PreferencePanes/VoddlerNet.prefPane

           (com.voddler.VoddlerNet)

       Library/Address Book Plug-Ins/SkypeABDialer.bundle

           (com.skype.skypeabdialer)

       Library/Address Book Plug-Ins/SkypeABSMS.bundle

           (com.skype.skypeabsms)

       Library/Internet Plug-Ins/PersonalPlugin.bundle

           (com.jattesaker.macid2.NPPlugin)

       Library/Internet Plug-Ins/SkypeWebPlugin.bundle

           (com.skype.webplugin.plugin)

     

    User login items

     

       iTunesHelper

       Spotify

       KiesAgent

       fuspredownloader

     

    Restricted user files: 43

     

    Font problems: 20

     

    Elapsed time (s): 1274

     

     

     

    Not sure what to do with it, any help is welcome! My computer is very far from working properly!

    Thanks!

first Previous Page 6 of 14 last Next