Adware was unable to be removed by Virus scanner

Saul Herrera wrote:

http://www.adwaremedic.com/index.php

worked like a charm, it basically saved me the time of hunting down those files myself.

It's sad that I have to use an anti-malware app on my mac clients now but I guess that's unavoidable

Just a quick note... be aware that AdwareMedic is not anti-malware! It serves only one purpose, and that is the removal of installed adware components. It won't protect you against or allow removal of actual malware, and it won't prevent you from installing adware again in the future. This may sound like a small distinction, but it's actually a very big one.

For more information on how to protect yourself online and a discussion of whether or not to use anti-virus software, see my Mac Malware Guide.

(Fair disclosure: I may receive compensation from links to my site and software, in the form of buttons allowing for donations. Donations are not required to use my site or software.)

thank you…..

you solved my problem. it took me a whole day to get to a helpful post that can solve my issue.

Always grateful to people like you for doing the legwork. Some people don't have the technical understanding to hunt down malware or malicious files themselves. Just being able to identify the paths is a very helpful thing regardless of removal.

THANK YOU!! You saved us lots of work. Lots of great karma your way.

thank you very much you saved me my mac and my time!!!!!

merry xmas to you and to created this app!!!

Thank you so much! It took me months to understand and try to solve the problem. Accidentally, I saw your post, and tried, and worked...The first time ever, it worked. Again, Thank you!

Thanks Saul.

Not at all technical, had this problem for the last couple of months. Just did this which took 5 mins and now no pop-ups and internet working alot quicker. 🙂

I had the same problem and used Malwarebytes. I downloaded this from https://www.malwarebytes.org/mac-download/

The first scan by this application revealed: (attempted to inset screen shot)

A second scan after rebooting the computer showed one nasty hanging in. A second scan removed it!

For some reason my screen shot would not insert (they were in TIFF format???

Same issue! Also to note I had deleted a few files manually that I got rid of MacUpdater. I reset both chrome and safari and re-installed OSX. Any other suggestions?

Posted this in a similar help topic..... I dont think I installed MacKeeper as I know it's a virus program. But I downloaded a different program and it put adware on my computer. Whenever I open up links it opens up tabs to Mackeeper and then i'm asked where on my mac do i want to download the program and I hit cancel. So I do not allow whatever program it is to install on the computer. I get shopping ads for example called HotShoppy. I just looked at the source and it says website view-source:http://www.imore.com/avoid-mackeeper. After inspecting it I think it is in javascript! I have used Malwarebytes and it didnt find anything. I reinstalled OSX once and that didnt fix it. I cant find any vsearch or jack files within applications, library or systems folders. What should I do? I think where ever the files are they are hidden in the system somewhere.

/update-advanced-comment.jspa?id=30253974

JayK9684 wrote:

I have used Malwarebytes and it didnt find anything.

Any time Malwarebytes Anti-Malware for Mac doesn't detect something like this, choose Contact Support from the Help menu within Malwarebytes Anti-Malware for Mac. This will put you in contact with Malwarebytes support techs, who will help you with the problem for free.

You may have installed ad-injection malware ("adware").

Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. You've already found that it doesn't work.

Back up all data first.

If you're not already running the latest version of OS X, updating or upgrading in the App Store may cause the adware to be removed automatically. If you are already running the latest version, please log out or restart the computer. Again, some kinds of malware will be removed—not all. There is no such thing as automatic removal of all possible malware, either by OS X or by third-party software. That's why you can't rely on software to protect you.

If the malware is removed in your case, you'll still need to make changes to the way you use the computer to protect yourself from further attacks. Ask if you need guidance.

If the malware is not removed automatically, see below.

This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.

Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. The malware will be disabled temporarily.

Step 1

Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

Leave the folder open for now.

Step 2

Do as in Step 1 with this line:

/Library/LaunchAgents

The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

Step 3

Repeat with this line:

/Library/LaunchDaemons

This time the folder will be named "LaunchDaemons."

Step 4

Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

Step 5

If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

I ended up installing Sophos Anti Virus and ran it a couple times. It worked, found and removed all traces of the adware including the Vsearch and Genieo. Thank you for replying back to me, really appreciate it!