Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

How to I remove macsave adversiting support?

I installed what seems to be a virus by accident. There are a lot of advertisements and pop up ads that show up when use safari. It leads me to this link but i dont know how to remove the virus.


http://advertising-support.com/privacy.php?type=3&zone=552148&pid=1749&ext=MacSa ve


I searched "macsave" in spotlight and 2 files poped up and i dragged them in the trash and deleted them, thinking it would solve my problem, but now i can't find the virus anywhere in my mac but it's still here. Help?

MacBook Pro, OS X Mavericks (10.9.2)

Posted on Apr 19, 2014 11:42 AM

Reply
21 replies

Apr 19, 2014 12:43 PM in response to pjllelis

I think i found the solution. I don't think it's a malicious virus, but rather a very annoying "extension" to safari. What i did is:

1. Click "Safari" in the toolbar

2. Select "Preferences"

3. Go to "Extensions"

4. Delete the "MacSave" extension


I dont know if this will solve the problem, but really hope so! If not i'll have to go to the apple store.

Apr 19, 2014 5:36 PM in response to simonc.93

Did you do a web search (google) MacSave to discover what it is?


Do you know that Spotlight does not find everything on your Mac, but there are apps that do, such as the free EasyFind from Devontech?


In additon, you can also install a reliable ad blocker like the Safari extension AdBlock, which I've found makes all the difference when browsing. So much less junk on the page, if any.


And configure Safari preferences to block pop-ups.

Apr 19, 2014 8:03 PM in response to simonc.93

Thanks it seems like it worked. I hadn't thought of this because I assumed it wasn't an extension or anything because it affected not only my Safari but Chrome as well. I was also able to find a bunch of other unnecessary extensions that seemed to have installed themselves on both browsers. Macsave was a real pain because it slowed down the browsers so much that I would have no choice but to quit. Nevertheless my Mac virusless streak lives on. Cheers! from one 93 baby to another (if thats what your username represents).

Apr 20, 2014 6:41 AM in response to simonc.93

Do any of you have a link to where this MacSave extension was downloaded from? I track Mac adware, and provide removal instructions on my website, but have never heard of this one. It must be new.


A lot of times, an extension like this may only be the most visible portion of the adware, and there may be other components hidden more deeply in your system, possibly still tracking your surfing even after the visible symptoms are gone. And in other cases, the extension is all there is. I'd like to be able to identify whether there's anything else that needs removing, but can't do that without being able to run tests with a copy of this adware.

Apr 20, 2014 8:25 AM in response to simonc.93

I was having the same problem. This is the first time I have found anything on the internet referring to MacSave. I agree, this must be a new virus and I also got mine from mp3juices. Usually content just downloads automatically, but the other day was the first time it asked me to do something weird.


Thanks for the help! I just deleted the extension!

Apr 20, 2014 10:48 AM in response to simonc.93

I am not able to find anything that installs a Safari extension called MacSave there.


However, I did find that this site generates pop-ups for MacKeeper, which is absolute garbage and is currently the subject of a class-action lawsuit accusing the developers of fraud. It also generates pop-ups for what looks like a pornographic online game. Worst of all, it links to an installer that installs both the Genieo adware/malware as well as the complete garbage scamware TuneUpMyMac.


I would also point out that this site's supposed purpose (which is does not actually appear to fulfill) is to download commercial music for free, which is illegal. Any site offering such illegal downloads should never be visited, period. If you find yourself on such a site, you should leave immediately without downloading anything. If something is downloaded automatically, you should delete it immediately without opening it. (Keeping your Downloads folder clean helps with identifying the product of this kind of stealthy download.)

Apr 20, 2014 3:16 PM in response to thomas_r.

Mp3juices usually has a checkbox above the list of mp3s after you conduct a successful search. You are given the option to download your desired mp3 file using their download helper. Installing the disc image for that download helper causes the Macsave extension to install itself. However the checkbox for the download helper is not always present after searching for a file and will appear every now and then. I don't know how exactly to make it appear, but it could also be because the site runners are aware of the possible malware attached to the app and are trying to fix the problem. I never noticed the mackeeper and hentai popups until reading your comment and checking today. There is definitely something wrong with the mp3juices site at the moment and I will refrain from visiting it in the meantime.

Apr 20, 2014 4:46 PM in response to pjllelis

Yeah, I see the checkbox sometimes (reloading the page enough times makes it appear), but the state of that checkbox doesn't seem to matter. Clicking any of the Download buttons sends me to a page offering a Genieo download, not the download manager. I do sometimes get a page on download.macdownloadpro.com instead, but that page is always blank and nothing is downloaded. This item may already have been removed


If anyone still has a copy of this "download manager" installer, please contact me privately at thomas at thesafemac dot com. Alternately, if you'd prefer not to do that, upload the disk image containing the installer to VirusTotal, then post a link to the VirusTotal results page that loads after it finishes analyzing the file. I'll be able to get the file from there.

May 28, 2014 4:29 AM in response to simonc.93

I seem to be having the same problems. These shady surveys and ads keep poping up on my webpages. 😠

I am not sure how the **** this virus got on to my comp as I have not been downloading squat. When I click on "hide these ads" or whatever, it takes me to an advertising support website which looks pretty sketchy or like it's part of macsave. There is no indication that there is any advice on findng a solution.


Hope somebody fins out wth is going on with macsave,


_s.i.m.o.n_

May 28, 2014 5:32 AM in response to Community User

_When I click on "hide these ads" or whatever, it takes me to an advertising support website which looks pretty sketchy


That sounds like the Downlite adware. See my Adware Removal Guide for removal instructions.


(Fair disclosure: The Safe Mac is my site, and contains a Donate button, so I may receive compensation for providing links to The Safe Mac. Donations are not required.)

Jun 12, 2014 7:57 PM in response to simonc.93

I delected the extension for MacSave however the installer program stays in my Launchpad. I have tried removing it (option+mouse over) and dragging it to trash. Cannot get rid of it.


Deleting the extension removed the creation of popups and peripheral tabs but I still see it pop up in bullet ads on my web pages. I cannot find anything that tells me how to get rid of this piece of ****. Any help would be greatly appreciated.

How to I remove macsave adversiting support?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.