ANNOYING MACKEEPER TABS AND POPUP ADS

Jan 3, 2015 11:41 AM in response to Linc Davis

http://pastebin.com/HDpSScjX

Thanks

Reply

Jan 4, 2015 3:20 AM in response to chickashnaz

Here are the contents of my test:

Start time: 03:02:42 01/04/15

Model Identifier: MacBookAir3,2

System Version: OS X 10.10.1 (14B25)

Kernel Version: Darwin 14.0.0

Time since boot: 2:10

Diagnostic reports

2014-12-16 PluginProcess crash x8

2014-12-17 PluginProcess crash

2014-12-19 DMSLaunch crash x3

2014-12-25 com.apple.WebKit.Plugin.64 crash

2014-12-28 com.apple.WebKit.WebContent hang x2

2014-12-30 DMSLaunch crash

2015-01-02 DMSLaunch crash

2015-01-02 Safari hang x2

2015-01-02 com.apple.WebKit.WebContent hang

2015-01-03 DMSLaunch crash

2015-01-04 CoreMediaAuthoringSessionHelper crash

2015-01-04 DMSLaunch crash x2

2015-01-04 mdm_flash_player crash

Shutdowns

Dec 29 02:59:38 cause: -60

Dec 29 13:30:55 cause: -60

Dec 31 06:23:53 cause: -60

Dec 31 15:57:06 cause: -60

Log

Jan 3 21:34:17 process MPlayerX[1973] caught causing excessive wakeups. EXC_RESOURCE supressed due to audio playback

Jan 3 23:59:00 com.apple.iTunesHelper.17640: Service exited with abnormal code: 1

Jan 4 00:00:08 MacAuthEvent en0 Auth result for: ce:03:fa:de:cc:84 Auth request tx failed

Jan 4 00:09:27 com.apple.xpc.launchd.domain.pid.BKAgentService.551: Path not allowed in target domain: type = pid, path = /Library/Frameworks/iTunesLibrary.framework/Versions/A/XPCServices/com.apple.iT unesLibraryService.xpc error = 147: The specified service did not ship in the requestor's bundle, origin = /System/Library/PrivateFrameworks/BookKit.framework/Versions/A/XPCServices/com. apple.BKAgentService.xpc

Jan 4 00:28:38 disk logger: failed to open output file /Volumes/1TB/.fseventsd/000000000d92974e (No such file or directory). mount point /Volumes/1TB/.fseventsd

Jan 4 00:32:33 disk logger: failed to open output file /Volumes/Sean Cody/.fseventsd/000000000d929ea0 (No such file or directory). mount point /Volumes/Sean Cody/.fseventsd

Jan 4 00:34:52 process DesktopServicesH[784] thread 19645 caught burning CPU! It used more than 50% CPU (Actual recent usage: 70%) over 180 seconds. thread lifetime cpu usage 90.011863 seconds, (0.114264 user, 89.897599 system) ledger info: balance: 90003565752 credit: 90003565752 debit: 0 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 128547597912

Jan 4 00:39:23 process WindowServer[116] caught causing excessive wakeups. EXC_RESOURCE supressed due to audio playback

Jan 4 00:53:13 jnl: b(1, 2): replay_journal: from: 24398848 to: 6444544 (joffset 0x15502000)

Jan 4 00:53:13 jnl: b(1, 2): journal replay done.

Jan 4 00:54:07 com.apple.xpc.launchd.domain.pid.quicklookd.262: Path not allowed in target domain: type = pid, path = /Library/Frameworks/iTunesLibrary.framework/Versions/A/XPCServices/com.apple.iT unesLibraryService.xpc error = 147: The specified service did not ship in the requestor's bundle, origin = /System/Library/Frameworks/QuickLook.framework/Versions/A/Resources/quicklookd. app

Jan 4 00:56:03 com.apple.systemstatsd: Service exited with abnormal code: 1

Jan 4 00:58:04 process WindowServer[114] caught causing excessive wakeups. Observed wakeups rate (per sec): 155; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45096

Jan 4 01:04:15 process DesktopServicesH[471] thread 7379 caught burning CPU! It used more than 50% CPU (Actual recent usage: 76%) over 180 seconds. thread lifetime cpu usage 90.012981 seconds, (0.108491 user, 89.904490 system) ledger info: balance: 90000882795 credit: 90000882795 debit: 0 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 118289432510

Jan 4 01:13:49 com.jdibackup.ZipCloud.notify: Service exited with abnormal code: 1

Jan 4 01:33:48 com.jdibackup.ZipCloud.notify: Service exited with abnormal code: 1

Jan 4 01:53:48 com.jdibackup.ZipCloud.notify: Service exited with abnormal code: 1

Jan 4 01:59:19 process DesktopServicesH[900] thread 27302 caught burning CPU! It used more than 50% CPU (Actual recent usage: 89%) over 180 seconds. thread lifetime cpu usage 90.024583 seconds, (0.121557 user, 89.903026 system) ledger info: balance: 90001004208 credit: 90001004208 debit: 0 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 100428350839

Jan 4 02:13:48 com.jdibackup.ZipCloud.notify: Service exited with abnormal code: 1

Jan 4 02:33:48 com.jdibackup.ZipCloud.notify: Service exited with abnormal code: 1

Jan 4 02:49:53 com.apple.xpc.launchd.domain.pid.quicklookd.838: Path not allowed in target domain: type = pid, path = /Library/Frameworks/iTunesLibrary.framework/Versions/A/XPCServices/com.apple.iT unesLibraryService.xpc error = 147: The specified service did not ship in the requestor's bundle, origin = /System/Library/Frameworks/QuickLook.framework/Versions/A/Resources/quicklookd. app

Jan 4 02:53:48 com.jdibackup.ZipCloud.notify: Service exited with abnormal code: 1

I/O per process: mds_stores (UID 0) is using 7 MB/s

Daemons

com.v.helper

com.apple.installer.osmessagetracing

com.adobe.fpsaud

Agents

com.epson.esua.launcher

com.google.Chrome.framework.service_process/Users/USER/Library/Application_Supp ort/Google/Chrome

com.v.agent

com.epson.Epson_Low_Ink_Reminder.launcher

com.jdibackup.ZipCloud.autostart

com.jdibackup.ZipCloud.notify

com.google.keystone.user.agent

com.apple.AirPortBaseStationAgent

com.epson.eventmanager.agent

com.divx.dms.agent

Bundles

/System/Library/Extensions/JMicronATA.kext

- com.jmicron.JMicronATA

/Library/Audio/Plug-Ins/Components/Flip4Mac WMA Import.component

- net.telestream.wmv.import

/Library/Internet Plug-Ins/DivX Web Player.plugin

- com.divx.DivXWebPlayer

/Library/Internet Plug-Ins/Flash Player.plugin

- N/A

/Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin

- net.telestream.wmv.plugin

/Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin

- com.Google.GoogleEarthPlugin.plugin

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin

- com.apple.java.JavaAppletPlugin

/Library/Internet Plug-Ins/LogMeIn.plugin

- com.logmein.remctrlplugin

/Library/Internet Plug-Ins/LogMeIn.plugin/LogMeInPluginHost.app

- com.logmein.LogMeInPluginHost

/Library/Internet Plug-Ins/LogMeInSafari32.plugin

- com.logmein.remctrlplugin

/Library/Internet Plug-Ins/LogMeInSafari64.plugin

- com.logmein.remctrlplugin

/Library/Internet Plug-Ins/OVSHelper.plugin

- com.divx.OVSHelper

/Library/Internet Plug-Ins/Silverlight.plugin

- com.microsoft.SilverlightPlugin

/Library/PreferencePanes/Flash Player.prefPane

- com.adobe.flashplayerpreferences

/Library/PreferencePanes/Flip4Mac WMV.prefPane

- net.telestream.wmv.prefpane

/Library/QuickTime/DivX Decoder.component

- com.DivXInc.DivXDecoder

/Library/QuickTime/DivX Decoder.component/Contents/Resources

- com.DivXInc.DivXDecoder

/Library/QuickTime/DivX Encoder.component

- com.DivXInc.DivXCodec

/Library/QuickTime/Flip4Mac WMV Advanced.component

- net.telestream.wmv.advanced

/Library/QuickTime/Flip4Mac WMV Export.component

- net.telestream.wmv.export

/Library/QuickTime/Flip4Mac WMV Import.component

- net.telestream.wmv.import

Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin

- com.conduit.ConduitNPAPIPlugin

dylibs

/Applications/Microsoft Office 2008/Office/PowerPlant.framework/Versions/12/Resources/libSystem.B.dylib

/Applications/Microsoft Office 2008/Office/PowerPlantCore.framework/Versions/12/Resources/libSystem.B.dylib

/Library/Application Support/DivX/DesktopService/libDivXDownloadManager.dylib

/Library/Application Support/DivX/Libraries/libDivXDesktopSupport.dylib

/Library/Application Support/DivX/QtPlugins/accessible/libqtaccessiblewidgets.dylib

/Library/Application Support/DivX/QtPlugins/codecs/libqcncodecs.dylib

/Library/Application Support/DivX/QtPlugins/codecs/libqjpcodecs.dylib

/Library/Application Support/DivX/QtPlugins/codecs/libqkrcodecs.dylib

/Library/Application Support/DivX/QtPlugins/codecs/libqtwcodecs.dylib

/Library/Application Support/DivX/QtPlugins/iconengines/libqsvgicon.dylib

/Library/Application Support/DivX/QtPlugins/imageformats/libqgif.dylib

/Library/Application Support/DivX/QtPlugins/imageformats/libqico.dylib

/Library/Application Support/DivX/QtPlugins/imageformats/libqjpeg.dylib

/Library/Application Support/DivX/QtPlugins/imageformats/libqmng.dylib

/Library/Application Support/DivX/QtPlugins/imageformats/libqsvg.dylib

/Library/Application Support/DivX/QtPlugins/imageformats/libqtiff.dylib

/Library/Application Support/DivX/QtPlugins/sqldrivers/libqsqlite.dylib

/System/Library/Frameworks/v.framework/Versions/A/Libraries/libLoader.dylib

/Users/USER/Library/Application Support/Google/Chrome/WidevineCDM/1.4.1.376/_platform_specific/mac_x86/libwidev inecdm.dylib

Frameworks

/Library/Application Support/DivX/Codecs/mc_bc_dec_avc.framework

- com.mainconcept.mc.bc.dec.avc

/Library/Application Support/DivX/Frameworks/DSE_Core.framework

- null

/Library/Application Support/DivX/Frameworks/DivXQtSupport.framework

- com.yourcompany.DivXQtSupport

/Library/Application Support/DivX/Frameworks/DivXToolkit.framework

- com.divx.divxtoolkit

/Library/Application Support/DivX/Frameworks/PlatformModule.framework

- com.divx.PlatformModule

/Library/Application Support/DivX/Frameworks/QtCore.framework

- null

/Library/Application Support/DivX/Frameworks/QtGui.framework

- null

/Library/Application Support/DivX/Frameworks/QtNetwork.framework

- null

/Library/Application Support/DivX/Frameworks/QtScript.framework

- null

/Library/Application Support/DivX/Frameworks/QtSql.framework

- null

/Library/Application Support/DivX/Frameworks/QtSvg.framework

- null

/Library/Application Support/DivX/Frameworks/QtWebKit.framework

- null

/Library/Application Support/DivX/Frameworks/QtXml.framework

- null

/Library/Application Support/DivX/Frameworks/QtXmlPatterns.framework

- null

/Library/Frameworks/DivX Toolkit.framework

- com.divx.divxtoolkit

/Library/Frameworks/DivXInstallerUtilities.framework

- com.yourcompany.DivXInstallerUtilities

/Library/Frameworks/EpsonInformationService.framework

- com.epson.EpsonInformationService

/Library/Frameworks/TSLicense.framework

- net.telestream.license

/Library/Frameworks/TSLicense.framework/Versions/A/Resources/EWSMac-GC.framewor k

- com.eSellerate.EWSMac67108872

/Library/Printers/Canon/BJPrinter/Frameworks/BJCommand2.framework

- jp.co.canon.bsd.bjcommand2

/Library/Printers/Canon/BJPrinter/Frameworks/BJEssential2.framework

- jp.co.canon.bsd.bjessential2

/Library/Printers/Canon/BJPrinter/Frameworks/BJExtDDI.framework

- jp.co.canon.bj.bjextddi

/Library/Printers/Canon/BJPrinter/Frameworks/BJPDELocalizedString2.framework

- jp.co.canon.bj.bjpdelocalizedstring2

/Library/Printers/Canon/BJPrinter/Frameworks/BJPrinterUtility2.framework

- jp.co.canon.bj.print.BJPrinterUtility2

/Library/Printers/Canon/BJPrinter/Frameworks/BJStatus2.framework

- jp.co.canon.bj.print.bjstatus2.a

/Library/Printers/Canon/BJPrinter/Frameworks/BJTune.framework

- jp.co.canon.bj.bjtune

/Library/Printers/Canon/IJScanner/Frameworks/Caddis_09.framework

- jp.co.canon.bsd.caddis.09

/Library/Printers/Canon/IJScanner/Frameworks/SGSM5_09.framework

- jp.co.canon.scangear.sgsm5.09.framework

/Library/Printers/EPSON/InkjetPrinter2/Libraries/EPRemoteIOService.framework

- com.epson.ijprinter.framework.EPRemoteIOService

/System/Library/Frameworks/v.framework

- null

App extensions

com.getdropbox.dropbox.garcon

Apps

/Applications/Dropbox.app

Contents of /Library/LaunchAgents/com.divx.dms.agent.plist (checksum 3097025559)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.divx.dms.agent</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/DivX/DMSLaunch.app/Contents/MacOS/DMSLaunch</string>

</array>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>

Contents of /Library/LaunchAgents/com.draw.agent.plist (checksum 2539719607)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.v.agent</string>

<key>OnDemand</key>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/draw/Agent/agent.app/Contents/MacOS/agent</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>KeepAlive</key>

<true/>

<key>LimitLoadToSessionType</key>

<key>ThrottleInterval</key>

</dict>

</plist>

Contents of /Library/LaunchAgents/com.epson.Epson_Low_Ink_Reminder.launcher.plist (checksum 891421492)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>ProgramArguments</key>

<array>

<string>/Applications/Epson Software/Epson Low Ink Reminder.app/Contents/EpsonLowInkReminderAgent.app/Contents/MacOS/EpsonLowInkRe minderAgent</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>Label</key>

<string>com.epson.Epson_Low_Ink_Reminder.launcher</string>

</dict>

</plist>

Contents of /Library/LaunchAgents/com.epson.esua.launcher.plist (checksum 1726226152)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>StartInterval</key>

<key>ProgramArguments</key>

<array>

<string>/Applications/Epson Software/EPSON Software Updater.app/Contents/EPSON Software Updater Agent.app/Contents/MacOS/EPSON Software Updater Agent</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>Label</key>

<string>com.epson.esua.launcher</string>

</dict>

</plist>

Contents of /Library/LaunchAgents/com.epson.eventmanager.agent.plist (checksum 1862971771)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>KeepAlive</key>

<dict>

<key>PathState</key>

<dict>

<key>/Applications/Epson Software/Event Manager.app/Contents/Resources/Assistants/Event Manager/EEventManager.app</key>

<true/>

</dict>

<key>Label</key>

<string>com.epson.eventmanager.agent</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/Epson Software/Event Manager.app/Contents/Resources/Assistants/Event Manager/EEventManager.app/Contents/MacOS/EEventManager</string>

</array>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.draw.daemon.plist (checksum 2050165188)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Disabled</key>

<true/>

<key>Label</key>

<string>com.v.daemon</string>

<key>OnDemand</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/draw/Agent/agent.app/Contents/MacOS/agent</string>

<string>-update</string>

</array>

<key>KeepAlive</key>

<true/>

<key>RunAtLoad</key>

<true/>

<key>ThrottleInterval</key>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.draw.helper.plist (checksum 1287476828)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.v.helper</string>

<key>OnDemand</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/draw/Agent/agent.app/Contents/MacOS/agent</string>

<string>-helper</string>

</array>

<key>KeepAlive</key>

<true/>

<key>RunAtLoad</key>

<true/>

<key>ThrottleInterval</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.google.keystone.agent.plist (checksum 1669129075)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.google.keystone.user.agent</string>

<key>LimitLoadToSessionType</key>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bu ndle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftw areUpdateAgent</string>

<string>-runMode</string>

<string>ifneeded</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

<key>StandardErrorPath</key>

<key>StandardOutPath</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.jdibackup.ZipCloud.autostart.plist (checksum 3490719140)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.jdibackup.ZipCloud.autostart</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/ZipCloud.app/Contents/Resources/Utility.app</string>

</array>

<key>StandardOutPath</key>

<string>/Users/USER/Library/Logs/ZipCloud/lagent_out.log</string>

<key>StandardErrorPath</key>

<string>/Users/USER/Library/Logs/ZipCloud/lagent_err.log</string>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>

Contents of Library/LaunchAgents/com.jdibackup.ZipCloud.notify.plist (checksum 1624753578)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.jdibackup.ZipCloud.notify</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/ZipCloud.app/Contents/Resources/Utility.app</string>

</array>

<key>StandardOutPath</key>

<string>/Users/USER/Library/Logs/ZipCloud/lagent_out.log</string>

<key>StandardErrorPath</key>

<string>/Users/USER/Library/Logs/ZipCloud/lagent_err.log</string>

<key>StartInterval</key>

<key>RunAtLoad</key>

</dict>

</plist>

Bad plists

/Library/Preferences/com.epson.Epson Connect Printer Setup.UnInstallList.plist

/Library/Preferences/com.epson.Epson Event Manager.UnInstallList.plist

/Library/Preferences/com.epson.Epson Low Ink Reminder.UnInstallList.plist

/Library/Preferences/com.epson.EPSON Scan.UnInstallList.plist

/Library/Preferences/com.epson.Epson Scanner ICA Driver.UnInstallList.plist

/Library/Preferences/com.epson.EPSON Software Updater.UnInstallList.plist

/Library/Preferences/com.epson.EpsonNet Config v4.UnInstallList.plist

/Library/Preferences/com.epson.Inkjet Printer Driver.UnInstallList.plist

/Library/Preferences/com.epson.PC-FAX Driver.UnInstallList.plist

Library/Preferences/com.apple.WebFoundation.plist

DNS: 75.75.75.75 (static)

Listeners

cupsd: ipp

kdc: kerberos

User login items

iTunesHelper

- /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

Dropbox

- /Applications/Dropbox.app

Restricted files: 155

Lockfiles: 64

High file counts

Desktop: 54

Elapsed time (s): 461

Reply

Jan 4, 2015 4:07 AM in response to thomas_r.

Thank you for the blog and the Adware Medic!

This worked for us:

http://www.adwaremedic.com/index.php

No more popups! Yay! Donated, keep up the good work. 🙂

Runs off to follow @TheSafeMac on Twitter...

Reply

Jan 5, 2015 6:49 AM in response to Linc Davis

Thanks a lot, your solution works very well!!!!!!

Reply

Jan 5, 2015 11:08 AM in response to Linc Davis

The problem for me is that even those files I cannot find.

ex. /Library/LaunchDaemons/com.vsearch.daemon.plist

One reason is because I don't even have that many files in my Library folder in the first place, and secondly Even when i search for "com.search.daemon.plist" in

"All Files" It still does not show up.

ALSO:

I've already deleted all website data, cookies, I have no extensions, and blocking pop-ups is already ticked.

I did speak to someone over the phone and they were mentioning things about my mac having DNS errors and windows server infections. (but I'm not sure what those are and what to do about them.)

So I'm not sure what i'm supposed to do now to rid my mac book air from these malicious adwares. Please help.

Reply

Jan 5, 2015 11:15 AM in response to heroshfromirvine

As already suggested in this thread, download AdwareMedic: http://adwaremedic.com/index.php.

Reply

Jan 5, 2015 1:39 PM in response to Linc Davis

Hi Linc,

This is the test result from my mac. Thanks in advance for your time and availability to help me.

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.jdibackup.ZipCloud.notify</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/ZipCloud.app/Contents/Resources/Utility.app</string>

</array>

<key>StandardOutPath</key>

<string>/Users/USER/Library/Logs/ZipCloud/lagent_out.log</string>

<key>StandardErrorPath</key>

<string>/Users/USER/Library/Logs/ZipCloud/lagent_err.log</string>

<key>StartInterval</key>

<key>RunAtLoad</key>

</dict>

</plist>

Firewall: On

Listeners

kdc: kerberos

launchd: afpovertcp

launchd: microsoft-ds

User login items

iTunesHelper

- /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

Restricted files: 1814

Lockfiles: 2

Elapsed time (s): 168

Reply

DrpabloC

Level 1

4 points

Jan 5, 2015 3:55 PM in response to Linc Davis

Linc you are Legend! Linc you are Legend!! LINC YOU ARE LEGEND!!!

You and your benevolent post saved my MacBookPro from the evil MacKeeper trojan/popup/viral embedded stuff.

Cleared it very rapidly all with your kind help, thanks so much!

Previously I had searched far and wide to find solutions but none were forthcoming til your post.

You are a true Mac genius. LEGEND!

Will buy you a few pints next time you're in UK, promise!

Reply

Jan 7, 2015 9:19 PM in response to thomas_r.

I actually created an account just so i could write you a thankful note. i was going nuts trying to get rid of that horrible mackeeper stuff and the advice posted earlier in this thread did not work for me. So i tried your advice and download and it found like 5 or 6 evil adwares. it deleted them, and now i can browse the internet hassle-free again. i am grateful for you and your program! thank you so much!

Reply

Jan 8, 2015 7:14 PM in response to Linc Davis

Hello Linc,

Any help you could provide would be appreciated. I have already searched for all of the original folders you supplied as well as the Genio and other malware threats listed on other Apple support articles. No folders were found and any Malware searches via apps done to date haven't identified anything.

Thanks!

Start time: 22:03:03 01/08/15

Model Identifier: MacBookPro10,1

System Version: OS X 10.10.1 (14B25)

Kernel Version: Darwin 14.0.0

Time since boot: 20 days 3:52

System load

combined level = Bad

- battery level = Bad

FileVault: On

Diagnostic reports

2014-12-17 callservicesd crash

Log

Jan 2 16:59:26 process com.apple.WebKit[1725] caught causing excessive wakeups. Observed wakeups rate (per sec): 759; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 14641829

Jan 2 17:06:44 process com.apple.WebKit[1725] caught causing excessive wakeups. Observed wakeups rate (per sec): 744; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 14971303

Jan 2 17:23:53 process com.apple.WebKit[1725] caught causing excessive wakeups. Observed wakeups rate (per sec): 735; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 15756033

Jan 3 12:37:35 process com.apple.WebKit[1725] caught causing excessive wakeups. Observed wakeups rate (per sec): 356; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 17082386

Jan 3 12:52:59 process com.apple.WebKit[1725] caught causing excessive wakeups. Observed wakeups rate (per sec): 733; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 17769832

Jan 3 13:04:24 process com.apple.WebKit[1725] caught causing excessive wakeups. Observed wakeups rate (per sec): 734; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 18281487

Jan 4 06:46:07 process com.apple.WebKit[1725] caught causing excessive wakeups. Observed wakeups rate (per sec): 750; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 18797751

Jan 5 23:58:28 process com.apple.WebKit[1725] caught causing excessive wakeups. Observed wakeups rate (per sec): 717; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 19299385

Jan 6 00:12:55 process com.apple.WebKit[1725] caught causing excessive wakeups. Observed wakeups rate (per sec): 728; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 19948960

Jan 6 00:16:53 process com.apple.WebKit[1725] caught causing excessive wakeups. Observed wakeups rate (per sec): 700; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 20080452

Jan 7 00:01:28 process com.apple.WebKit[1725] caught causing excessive wakeups. Observed wakeups rate (per sec): 179; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 20586701

Jan 7 19:23:56 process com.apple.WebKit[1725] caught causing excessive wakeups. Observed wakeups rate (per sec): 714; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 21358581

Jan 7 19:30:44 com.apple.xpc.launchd.domain.pid.Install Adobe Flash Player.3107: Could not resolve origin of domain. XPC services in this domain's bundle will not be bootstrapped: error = 109: Invalid property list, taint = (null)

Jan 7 19:39:12 utun_start: ifnet_disable_output returned error 12

Jan 8 17:42:12 msdosfs_fat_uninit_vol: error 6 from msdosfs_fat_cache_flush

Jan 8 20:25:16 process com.apple.WebKit[3646] caught causing excessive wakeups. Observed wakeups rate (per sec): 264; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 108556

Jan 8 20:54:22 process BitdefenderVirus[3716] thread 612623 caught burning CPU!; EXC_RESOURCE supressed due to audio playback

Jan 8 21:49:23 com.apple.xpc.launchd.domain.pid.quicklookd.3782: Path not allowed in target domain: type = pid, path = /Library/Frameworks/iTunesLibrary.framework/Versions/A/XPCServices/com.apple.iT unesLibraryService.xpc error = 147: The specified service did not ship in the requestor's bundle, origin = /System/Library/Frameworks/QuickLook.framework/Versions/A/Resources/quicklookd. app

Jan 8 21:49:50 SaSndabndox:b ox: QuQiuickcLkooLokSokatelli(3783) deny Sfiatleel-rlie(ad-d37ata83 ) /pdernivya tfeile/e-rtcead-/hodsattsa

Jan 8 21:50:16 lia( /3783) deny fpriSaivnale-rtdead-dabta /e/epritcSavatendb/etcox/hosts

Swap (MiB): 8709

Memory: kernel_task (UID 0) is using 1375 MB

Daemons

com.apple.installer.osmessagetracing

com.microsoft.office.licensing.helper

com.oracle.java.Helper-Tool

com.oracle.java.Java-Updater

com.adobe.fpsaud

Agents

com.apple.photostream-agent

com.google.keystone.user.agent

com.apple.AirPortBaseStationAgent

Bundles

/System/Library/Extensions/JMicronATA.kext

- com.jmicron.JMicronATA

/Library/Internet Plug-Ins/Flash Player.plugin

- N/A

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin

- com.oracle.java.JavaAppletPlugin

/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin

- com.microsoft.sharepoint.browserplugin

/Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin

- com.microsoft.sharepoint.webkitplugin

/Library/Internet Plug-Ins/Silverlight.plugin

- com.microsoft.SilverlightPlugin

/Library/PreferencePanes/Flash Player.prefPane

- com.adobe.flashplayerpreferences

/Library/PreferencePanes/JavaControlPanel.prefPane

- com.oracle.java.JavaControlPanel

Library/Address Book Plug-Ins/SkypeABDialer.bundle

- com.skype.skypeabdialer

Library/Address Book Plug-Ins/SkypeABSMS.bundle

- com.skype.skypeabsms

Library/Caches/com.apple.Safari/Extensions/Adblock Plus-2.safariextension

- org.adblockplus.adblockplussafari

Library/Caches/com.apple.Safari/Extensions/AdBlock-2.safariextension

- com.betafish.adblockforsafari

Contents of /Library/LaunchAgents/com.oracle.java.Java-Updater.plist (checksum 1153540209)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.oracle.java.Java-Updater</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater</string>

<string>-bgcheck</string>

</array>

<key>StandardErrorPath</key>

<key>StandardOutPath</key>

<key>StartCalendarInterval</key>

<dict>

<key>Minute</key>

<key>Weekday</key>

</dict>

...and 1 more line(s)

Contents of Library/LaunchAgents/com.google.keystone.agent.plist (checksum 2870443697)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.google.keystone.user.agent</string>

<key>LimitLoadToSessionType</key>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bu ndle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftw areUpdateAgent</string>

<string>-runMode</string>

<string>ifneeded</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

<key>StandardErrorPath</key>

<key>StandardOutPath</key>

</dict>

</plist>

Listeners

cupsd: ipp

User login items

iTunesHelper

- /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

Safari extensions

AdBlock

Adblock Plus

Restricted files: 95

Lockfiles: 2

Elapsed time (s): 179

Reply

Jan 9, 2015 10:24 AM in response to Linc Davis

hey can you help me out. i see that you are the only one that seems to know how to fix this annoying mackeeper ad/ pop ups. it would be greatly appreciated if you can walk me throught the steps. ive tried to use your previous steps for other users but it seems not to be working for me.

thanks

Reply

Jan 9, 2015 10:26 AM in response to nongeyebong

There is no need for you to remove the adware manually. Please read through this entire thread; you'll see that AdwareMedic, http://adwaremedic.com/index.php, can remove it for you.

Reply

victorxm

Level 1

0 points

Jan 9, 2015 11:58 AM in response to stevejobsfan0123

AdMedic DID NOT work for me. Tried several times..., nothing found.

Reply

thomas_r.

Level 7

32,001 points

Jan 9, 2015 12:08 PM in response to victorxm

victorxm wrote:

AdMedic DID NOT work for me. Tried several times..., nothing found.

In that case, your problem is likely not due to adware. Did you look at the FAQ in the AdwareMedic help? If not, see the following page that it would refer you to:

http://www.adwaremedic.com/kb/unsolved.php

(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com, in the form of buttons allowing for donations. Donations are not required to use my site or software.)

Reply

Linc Davis

Level 10

209,649 points

Jan 9, 2015 5:58 PM in response to nongeyebong

There is no need to download anything to solve this problem. You may have installed a variant of the "VSearch" ad-injection malware.

Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

/Library/LaunchDaemons

In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

A folder named "LaunchDaemons" may open. Look inside it for a file with a name of the form

com.something.daemon.plist

Here something is a variable word, which can be different in each case. It could be "cloud," "dot," "highway," "submarine," "trusteddownloads," or pretty much anything else.

There may also be a file named

com.something.helper.plist

in the same folder.

If you find files with names that fit the above description, post what you have for "something."

Reply