Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

I'm having a ton of ads on my new macbook and I don't know how to get rid of them?

A program called MacVx keeps showing ads all over any page I go to and sometimes when I click normal links an ad will form in a new tab. I don't know what website would have caused it and I have cleared my history and deleted some of my newer downloads.

MacBook Pro with Retina display, OS X Mavericks (10.9.4), Just bought 1 week ago exactly

Posted on Jul 21, 2014 1:58 PM

Reply
29 replies

Apr 13, 2017 12:36 PM in response to elenapan

Hi! I am having the same problem but this time I am on macOS Sierra. Thing is, whilst I was on OS X Maverick, i was able to resolve this problem using Linc Davis's advise. It was wonderful! As i updated my Macbook Pro to El Capitan and now to macOS Sierra, these pop ups came back and now are more terrible and absolutely annoying! Do we have a newer version of permanent cure of this malicious ads for macOS Sierra? I tried to go over the Library folder thinking that i can see same items as described by Linc below but they are not there anymore .....

Jul 21, 2014 3:16 PM in response to elenapan

You may have installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.

Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.

Back up all data.

Triple-click anywhere in the line below on this page to select it:

/Library/LaunchAgents/com.vsearch.agent.plist

Right-click or control-click the line and select

Services Reveal in Finder (or just Reveal)

from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.

Repeat with each of these lines:

/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist

Restart the computer and empty the Trash. Then delete the following items in the same way:

/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework

Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

From the Safari menu bar, select

Safari Preferences... Extensions

Uninstall any extensions you don't know you need, including any that have the word "Spigot" or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.

You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Jul 22, 2014 10:34 AM in response to elenapan

Here are revised instructions.


You installed the "VidX" trojan, perhaps under a different name. To remove it, first open the Applications folder by selecting


Go ▹ Applications


from the Finder menu bar, or by pressing the key combination shift-command-A. Look for an item named "VidX," "MacVx," or similar. If present, drag it to the Trash and empty.


From the Safari menu bar, select

Safari Preferences... Extensions

Uninstall any extension you don't know you need. If in doubt, remove all of them. You may well have more than one that's adware or spyware.

Jul 26, 2014 3:38 PM in response to Linc Davis

I got hit with the same thing but I appear to have got rid of them all. Thing is ever since I got this problem, certain websites would fail to load, I'd just get a "No Data Recieved" error. Sometimes it would load but sometimes it wouldn't. I'm getting this problem on Chrome (my main browser) and Safari but there's no trace of the virus. I've even reinstalled Mavericks (didn't wipe) but it hasn't solved the problem. All of your folder paths are non-existent. I installed Avast for Mac but it hasn't found anything.

Jul 26, 2014 4:29 PM in response to DoctorOctagonapus

You may have some other adware installed. In fact, you actually do: Avast. It includes an adware feature now. Uninstall it. But you may also have something else in addition.


See my Adware Removal Guide for help finding and removing whatever else you might have installed.


(Fair disclosure: The Safe Mac is my site, and contains a Donate button, so I may receive compensation for providing links to The Safe Mac. Donations are not required.)

I'm having a ton of ads on my new macbook and I don't know how to get rid of them?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.