Adware was unable to be removed by Virus scanner

First, get rid of your worthless "anti-virus" software. Then see below.

You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.

Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.

Back up all data.

Triple-click anywhere in the line below on this page to select it:

/Library/LaunchAgents/com.vsearch.agent.plist

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.

Repeat with each of these lines:

/Library/LaunchDaemons/com.vsearch.daemon.plist

/Library/LaunchDaemons/com.vsearch.helper.plist

/Library/LaunchDaemons/Jack.plist

Restart the computer and empty the Trash. Then delete the following items in the same way:

/Library/Application Support/VSearch

/Library/PrivilegedHelperTools/Jack

/System/Library/Frameworks/VSearch.framework

Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

From the Safari menu bar, select

Safari ▹ Preferences... ▹ Extensions

Uninstall any extensions you don't know you need, including any that have the word "Spigot" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.

You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Thank you for posting. My problems seem to have been solved! I somehow downloaded MacKeeper, but did not install (thank goodness), and I deleted it but did not realize that VSearch was also a problem and connected. Safari constantly had pop-ups and I was un-able to open or view links that I had in the past, pre-MacKeeper/VSearch.

I am not tech-savvy at all and really do not understand what this was, but everything seems to be working just fine now and I do not think there are any other traces of this trojan on my mac.

THANK YOU!

Solved my problem! Thanks!

Hey,

I have the exact same problem, just tried your instructions but when I clicked on Services-Revel in Finder I got this message: The operation can’t be completed because the item can’t be found.".

Any suggestions?

Thanks,

J

Worked for me thanks !!!!

@ Linc Davis.....great help.....your instructions worked.....only issues I had was I had an external backup drive connected and once I figured out to disconnect and follow your instructions it worked without fail.....thanks again!

Que grande eres Linc!!!! you are awesome, that adware was killing me. Thanks a lot for sharing this!

Finally. That took three days to figure out. The good thing about Sophos was that it identified what virus was the culprit. Then I was able to search for the name of the virus and it led me to you and the chalice.

Thanks so much.

@ Linc Davis: you rule! I use Bitdefender but that was only able to find it, not remove it. Thanks to your post I got rid of it.

Excelent!!! Thanx for All Linc, you're great!!!

Big thanks... worked like a charm

Thanks a lot! Worked like a charm 🙂

Thanks for this post! After much research and other failed ideas, yours got me on the way to cleaning up the mess from unwanted ads and pop ups. I also downloaded BitDefender from the App Store (free) which also help find a few more nasty files and things seem to be squeaky clean now. Thanks again!

I just removed this from one of my client's macs.

I found all the files above but I decided to give this program a try:

http://www.adwaremedic.com/index.php

worked like a charm, it basically saved me the time of hunting down those files myself.

It's sad that I have to use an anti-malware app on my mac clients now but I guess that's unavoidable

p.s. program is free and just asks for donations

hope this helps someone else

cheers

Saul

I'm glad to hear that AdwareMedic was able to help restore that computer. The author is a colleague of mine and deserves all the credit for this one. However, I do want to make certain that you understand this is not actually an anti-malware app in that it will not protect from re-installing whatever you found or one of the many other forms of adware currently in circulation. It will only remove what already exists on the computer.

To understand why this happened and how to avoid it in the future, I recommend you read John Galt's How to install adware.