Safari not blocking pop up windows

Please post a screenshot that shows what you mean. Be careful not to include any private information.

Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.

Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.

Back up all data.

Triple-click anywhere in the line below on this page to select it:

/Library/LaunchAgents/com.vsearch.agent.plist

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.

Repeat with each of these lines:

/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist

Restart the computer and empty the Trash. Then delete the following items in the same way:

/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework

Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

From the Safari menu bar, select

Safari ▹ Preferences... ▹ Extensions

Uninstall any extensions you don't know you need, including any that have the word "Spigot" or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.

You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

That certainly did not appear when I clicked on Link's "link." The hyperlink directs one to an Apple article explaining how to create a screenshot.

Barry

You also installed the notorious MacKeeper:

Follow these instructions to uninstall MacKeeper. They have been tested with the most recent version of MacKeeper. Earlier versions than the one released in 2012 require more extensive work to uninstall all its components. Never install such junk on a Mac.

If you actually used MacKeeper to alter your system, e.g. "remove excess binaries" or such, you will need to reinstall OS X as well as all your additional software. Uninstalling MacKeeper is insufficient to reverse the corruption it is capable of - once again, that is if you used it.

If you merely installed MacKeeper but did not use it to perform any particular action, the following instructions will suffice.

• If you used MacKeeper to encrypt any files or folders, use MacKeeper to un-encrypt them first.
• Quit the MacKeeper app if it is running.
• Open your Applications folder: Using the Finder's Go menu, select Applications.
• Drag the MacKeeper icon from your Applications folder (not the Dock) to the Trash.

You will be asked to authenticate (twice):

You do not need to provide a reason for uninstalling it:

Just click the Uninstall MacKeeper button. You will be asked to authenticate again.

After it uninstalls you may empty the Trash and restart your Mac. All that will remain is an inert log file that does nothing but occupy space on your hard disk.

May I suggest that you review the following setting in System Preferences?

Although you may easily override that setting, it will serve to protect you from inadvertently installing garbage.

.