Help!! My website has been ruined by pop up ads, links, etc.

Question

Level 1

10 points

Help!! My website has been ruined by pop up ads, links, etc.

In the last few days my browsing has been plagued by a flood of pop ads, underlined links, etc. All very annoying, but when I came to view my website's home page, it was unrecognizeable - completely ruined by adware, malware, I don't know what! Please verify this by seeing for yourself:

http://www.lakesweddingmusic.com/Welcome.html

How this has happened, I have no idea. It means my two small businesses will suffer, that's for sure, so I would be really grateful for any help that can be offered.

However, no problems seems to exist when viewing the site from my iPad, so is there some horriffic malware installed on my MB Pro? If so, what? I've had a cursary search through Downloads, but there's nothing there that I can recognise as evil!

Maybe it is something installed on my MBP, but I would dearly love to know how to rid myself of it.

As always, any help would be gratefully received.

MacBook Pro, OS X Mavericks (10.9.1), Firefox 26

Posted on Apr 8, 2014 4:22 AM

Reply

Answer 1

Melophage

Level 5

7,213 points

Apr 8, 2014 10:10 AM in response to PeterUK

Peter,

try logging in as your administrative user and selecting the Users & Groups pane of System Preferences to create a new user (say, “Test”). Log out from your administrative user and log in as the new user. If you visit your Web site’s page in your browser from the new user’s account, do you still see the same unwelcome things that you saw when you were logged in as your normal user?

Reply

Answer 2

PeterUK Author

Level 1

10 points

Apr 8, 2014 11:29 AM in response to Melophage

Hi Melophage,

Thanks for your reply.

I did what you asked and ended up with no ads - Hurrah! However, before you replied I consigned Firefox to the trash and opened up Safari to see if things would improve. Using the links I had already set up below the address bar, no ads now appeared on my website - http://www.lakesweddingmusic.com

So, the problem seems to be just with my version of Firefox. What I would like to know is, would it be best to trash Firefox and do without it altogether, or would the ads reappear if I installed it again (as a download)?

Thanks for your help so far. The verdict seems to be Firefox - infected, Safari - clean.

Reply

Answer 3

Melophage

Level 5

7,213 points

Apr 8, 2014 7:44 PM in response to PeterUK

Peter,

so were the ads only present in Firefox under your own login? I use Firefox myself, so I’m not the best person to ask whether it would be best to trash it. 😉 If you drag Firefox out of the trash, and you log in as the new user and run Firefox, do the ads show up there? If they don’t show up there, then it must be an issue having to do with Firefox only under your usual login. For example, do you have a particular set of addons that you use in Firefox?

Reply

Answer 4

Linc Davis

Level 10

209,739 points

Apr 8, 2014 8:33 PM in response to PeterUK

Remove gophoto.it | Firefox Support Forum

Reply

Answer 5

MadMacs0

Level 5

5,233 points

Apr 8, 2014 11:01 PM in response to Linc Davis

Note that thomas_r. spent some time on Monday diagnosing the latest variant of GoPhoto.it and documented it in Mac adware menace continues as well as updating his removal instructions. Seems it now also installs Genieo 2.0, Jollywallet and VSearch (aka DownLite and Dynamicpricer).

Reply

Answer 6

PeterUK Author

Level 1

10 points

Apr 9, 2014 4:58 AM in response to Melophage

Hi again,

Yes, ads are only present when I use my personal login in Firefox. When I use a guest login - no ads. When I use Safari, using my login, no ads appear.

I'm not sure what you mean by 'a particular set of addons that you use in Firefox'? Should I look for some...where would I look and what are they likely to be called? I've never knowingly added any addons.

I just thought that by uninstalling Firefox completely, then downloading a fresh one, things may improve.

Is that right, possibly?

Linc, I don't have gophoto.it; not in Applications, or according to a Spotlight search.

MadMacs0, You mention Genieo 2.0, Jollywallet and VSearch (aka DownLite and Dynamicpricer). I've found none of these either.

Thanks to all of you. I'm open to further suggestions and I'll post if and when this blight comes to an end!

Reply

Answer 7

Linc Davis

Level 10

209,739 points

Apr 9, 2014 6:17 AM in response to PeterUK

I don't have gophoto.it; not in Applications, or according to a Spotlight search.

It's not an application, and you won't find it in a Spotlight search. It's a Firefox add-on, among other things. Please follow the instructions linked above to see whether it's present and remove it if it is. If it's not present, post again.

Reply

Answer 8

Melophage

Level 5

7,213 points

Apr 9, 2014 10:04 AM in response to PeterUK

Peter,

if you’ve never knowingly installed any add-ons, then that wouldn’t be an issue. However, the possibility exists that you might have unknowingly installed add-ons such as GoPhoto.it. To see if you have any add-ons installed, select Tools → Add-ons from the menu bar in Firefox, and then Extensions from the left-hand side of the active Firefox window or tab, to see if any add-ons are installed.

Uninstalling and reïnstalling Firefox won’t affect the installed add-ons, since the add-ons are stored in user-specific folders which are independent of the Firefox application folder.

Reply

Answer 9

PeterUK Author

Level 1

10 points

Apr 9, 2014 4:05 PM in response to Melophage

Hi Melophage & Linc D,

Thanks to you both, I have found GoPhoto.it in Tools>Extensions. However, unlike an Amazon add-on I have -

'Add to Amazon Wish List Button', there is no 'Remove' button, only a 'Disable' button. Is it sufficient just to diable GoPhoto.it, or is there more to do?

Thanks again for the help thus far.

Reply

Answer 10

Linc Davis

Level 10

209,739 points

Apr 9, 2014 5:05 PM in response to PeterUK

Please see the page I linked to earlier.

Reply

Answer 11

thomas_r.

Level 7

32,031 points

Apr 10, 2014 5:34 AM in response to PeterUK

Is it sufficient just to diable GoPhoto.it, or is there more to do?

There's more to removing GoPhoto.it than just disabling the extension. See:

http://www.thesafemac.com/arg-gophotoit/

Also, in my experience, GoPhoto.it rarely "travels alone," so you may very well have some other adware installed as well. See my Adware Removal Guide for help identifying and removing anything else you may have.

Reply

Answer 12

PeterUK Author

Level 1

10 points

Apr 10, 2014 7:45 AM in response to thomas_r.

Hi Thomas,

Thanks for your reply.

I already looked at your Adware Removal Gude. First read-through was a bit daunting, but I'm getting braver, the more I re-read, thanks to your very clear writing style,.

I've concluded that my problem is with GoPhoto.it, which I have disabled, but have not been able to remove, as I said previously.

Just a couple of points:

1. I found the two files: "prefs.js" and "user.js" which you say I should delete, thus removing the malicious code. According to Finder, "prefs.js" was modified this morning and "user.js" was modified 11th July 2013. So, as I have no backup for 'prefs.js', prior to the adware's arrival, waht do I do with this file? Also, do I go ahead and delete "user.js"?

2. As I am unable to remove GoPhoto.it directly from Extensions, you suggest I remove the folder ec8030f7, etc.

I've located this folder, but need some reassurance about deleting it. Is the whole file a malicious addition?

Do I just trash it and delete it from Trash?

I'm making progress thanks to you, but if you could answer the points raised, I would be grateful.

Reply

Answer 13

thomas_r.

Level 7

32,031 points

Apr 10, 2014 7:55 AM in response to PeterUK

1. I found the two files: "prefs.js" and "user.js" which you say I should delete, thus removing the malicious code. According to Finder, "prefs.js" was modified this morning and "user.js" was modified 11th July 2013. So, as I have no backup for 'prefs.js', prior to the adware's arrival, waht do I do with this file? Also, do I go ahead and delete "user.js"?

You may have a variant of GoPhoto.it that doesn't modify those files. What is the size of the prefs.js file? If it's only a few Kb, it's fine. If it's large - in the neighborhood of almost 800 Kb, by my observations - then it's "infected" and will need to be removed.

As for the user.js file, it is probably newer than it's reporting, and that file is not normally found in a standard Firefox install. I'm sure there are cases where it could be installed by something else, but the only one I'm familiar with is GoPhoto.it.

If you're nervous about deleting them, just move them to the desktop temporarily. You can always put them back later, if necessary.

2. As I am unable to remove GoPhoto.it directly from Extensions, you suggest I remove the folder ec8030f7, etc.

I've located this folder, but need some reassurance about deleting it. Is the whole file a malicious addition?

Yes, that whole folder is all part of GoPhoto.it, and should be removed in its entirety. This will remove the GoPhoto.it extension completely, rather than just disabling it.

Reply

Answer 14

PeterUK Author

Level 1

10 points

Apr 10, 2014 10:59 AM in response to thomas_r.

OK, so I've moved the two .js files to the desktop. The prefs.js was a whopping 1.2MB, so I guess badly infected.

user.js is 123bytes.

I've also moved the GoPhoto.it folder to the Trash.

What happens to the "prefs.js" file, now I've removed it to the desktop?

Reply

Answer 15

thomas_r.

Level 7

32,031 points

Apr 10, 2014 11:53 AM in response to PeterUK

Next time you open Firefox, it will re-create a default prefs.js file. Some preferences will be lost, but it should be easy to re-set them, unless you have really tweaked and customized Firefox extensively.

Reply