How to remove info.com, x hide ad, visual match from my macbook air?

Question

Level 1

8 points

How to remove info.com, x hide ad, visual match from my macbook air?

Hi all there,

I'm a new member of Mac'world, I have a MacBook Air and just few days ago I've been connected it to the net, I didn't know Mac could have been attacked from virus, so I was late with my antivirus. Since then everytime I go in the net happens the same thing: google is still okay, but if I open one of the sites from the page lists some advertisments pop up comes, I saw info.com, x hide ad, visual match and on top of it some words become green underlining as link.

I use safari as browser and I checked already to block them from the preferences.

Please to help me cos I'm very stressed about that, I can't use my Mac safely with all these popup!

Thank you very much in advance

MacBook Air, OS X Mavericks (10.9.2)

Posted on Apr 15, 2014 7:28 AM

Reply

Answer 1

dominic23

Level 10

83,904 points

Apr 15, 2014 9:29 AM in response to DebPn

Identify and remove Adware

http://www.thesafemac.com/arg/

Reply

Answer 2

Linc Davis

Level 10

209,535 points

Apr 15, 2014 10:46 AM in response to DebPn

You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.

Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of the date it was posted, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment after a few days from now should look for more recent discussions or start a new one.

Back up all data.

Triple-click anywhere in the line below on this page to select it:

/Library/Application Support/VSearch

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.

Repeat with each of these lines:

/Library/LaunchAgents/com.vsearch.agent.plist /Library/LaunchDaemons/com.vsearch.daemon.plist /Library/LaunchDaemons/com.vsearch.helper.plist /Library/LaunchDaemons/Jack.plist /Library/PrivilegedHelperTools/Jack /System/Library/Frameworks/VSearch.framework

Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

Restart and empty the Trash. Don't try to empty the Trash until you have restarted.

From the Safari menu bar, select

Safari ▹ Preferences... ▹ Extensions

Uninstall any extensions you don't know you need, including any that have the word "Spigot" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.

You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. It must be said that this failure of oversight is inexcusable and has seriously compromised the value of Gatekeeper and the Developer ID program. You cannot rely on Gatekeeper alone to protect you from harmful software.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Reply

Answer 3

DebPn Author

Level 1

8 points

Apr 16, 2014 10:31 AM in response to Linc Davis

Linc Davis I'd like to thanking you, following your istruction my Mac seems back running well! 🙂

Reply

Answer 4

DebPn Author

Level 1

8 points

Apr 16, 2014 10:32 AM in response to dominic23

Thank you Dominic23 for your suggestion I'm going to download that app you told me!

Reply

Answer 5

Jun 22, 2014 11:16 PM in response to Linc Davis

Hi Linc,

I am facing the same issue. Are you able to also assist me.

I tried clicking on the text above but I think it may have expired now as you had mentioned.

Thanks

Reply

Answer 6

thomas_r.

Level 7

31,989 points

Jun 23, 2014 7:25 AM in response to Community User

There have been no changes to the Downlite adware since Linc posted those instructions, as far as I know. If they are not working for you, you may not have Downlite. Try the link that dominic23 posted.

Reply

Answer 7

Jun 27, 2014 2:14 PM in response to Linc Davis

Thank you Linc!!!!

Reply

Answer 8

natty135

Level 1

0 points

Jun 29, 2014 9:42 PM in response to Linc Davis

Thank you so much Linc!

Reply

Answer 9

Brogz007

Level 1

0 points

Jul 7, 2014 7:17 PM in response to Linc Davis

Still working, and my trojan came from trying the VeeHD plugin 😟

Many thanks Linc

Reply

Answer 10

Jul 11, 2014 4:12 AM in response to Linc Davis

Hey Linc Davis,

Please help. Recently my mbp has started to act weird. Apart from being slow, heating up more ( even during normal web browsing or other non demanding works), and throwing a lot of ads via visual search etc. I have cleared the cache, factory reset the safari, deleted the vsearch files as mentioned in your other post. Changed google "search settings" as well.

The ads have now stopped. But browsing is still slow. Another issue I am encountering is that clicks randomly doesn't work, unless I click in some other tab and then re-click on the previous one, for e.g. while closing a tab in safari.

Here is the diagnosis report. Thanks.

Start time: 14:49:32 07/11/14

Model Identifier: MacBookPro9,1

System Version: OS X 10.9.4 (13E28)

Kernel Version: Darwin 13.3.0

Boot Mode: Normal

Time since boot: 15:02

USB

USB Receiver (Logitech Inc.)

Diagnostic reports

2014-06-23 Mail crash

2014-06-25 Soundflowerbed crash

2014-07-01 Soundflowerbed crash

2014-07-09 FaceTime crash

2014-07-11 PluginProcess crash

Log

Jul 10 22:41:55 Sound assertion in AppleHDAController at line 5544

Jul 10 22:41:55 Sound assertion in IOHDACodecDevice at line 144

Jul 10 22:41:55 Sound assertion in AppleHDANode at line 291

Jul 10 22:41:55 Sound assertion in AppleHDACodecGeneric at line 1342

Jul 10 22:41:55 Sound assertion in AppleHDADriver at line 3609

Jul 10 22:41:55 Sound assertion in AppleHDADriver at line 3383

Jul 10 22:41:59 AppleKeyStore: operation failed (pid: 649 sel: 12 ret: e00002ce)

Jul 10 22:41:59 AppleKeyStore: operation failed (pid: 649 sel: 12 ret: e00002d8)

Jul 11 03:47:53 en1: Error configuring antenna diversity (index = -1).

Jul 11 03:47:53 en1: Error configuring transmit antenna (index = -1).