Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

0 points

Remove spyware (PCUpgradeNow.com) from Safari - Snow Leopard

Hi,

I am new to these forums and this is my first post, thankfully as a result of my mac never giving me any problems until now. I have a Macbook Pro 13" (Mid-2010) running Snow Leopard V10.6.8 with Safari V5.1.10

I am hoping someone in the Mac community may assist me with the following problem:

I seem to have picked up some sort of malware/spyware called PCUpgradeNow.com. It appears as a pop up when I restart Safari or sometimes when I press the Home button it redirects and loads this pop up message. Every time it happens I force quit Safari as there is no other option for exiting. I performed a simple google search for it and it appears to be a well know PC problem with many sites giving details as to how to remove it from a Windows PC. However I did not find any solutions for the mac. Therefore I decided to try out a couple of antivirus solutions. The first one I tried was Sophos Anti-Virus Home Edition, however it did not pick up any threats. The second AV I tried was a trial of ESET Cyber Security, however it also did not pick up any problems.

I have also tried emptying the cache, deleting all website data and resetting safari a few times consecutively. However this pop up still appears. Please find screen grab below.

Please may someone assist me with finding a mac solution to removing this virus/spyware/malware as I no longer feel save using internet banking and so forth knowing that someone or something maybe spying on me. Your assistance would be greatly appreciated.

MacBook Pro (13-inch Mid 2010), Mac OS X (10.6.8), 8GB Ram, 750GB HDD

Posted on Aug 5, 2014 1:24 PM

21 replies

Linc Davis

Level 10

209,559 points

Aug 9, 2014 10:53 AM in response to Sud30

No malware that has ever been found on any Mac could behave in the way you describe. If the facts are all as you've stated, then the problem is in the network, not in your computer. However, if you think otherwise, see below.

Back up all data to at least two different storage devices, if you haven't already done so. One backup is not enough to be safe. The backups can be made with Time Machine or with Disk Utility. Preferably both.

Erase and install OS X. [You will boot from your Snow Leopard installation disc, not from Recovery.] This operation will destroy all data on the startup volume, so you had be better be sure of the backups. If you upgraded from an older version of OS X, you'll need the Apple ID and password that you used, so make a note of those before you begin.

When you restart, you'll be prompted to go through the initial setup process in Setup Assistant. That’s when you transfer the data from a backup.

Select only users and Computer & Network Settings in the Setup Assistant dialog—not Applications or Other files and folders. Don't transfer the Guest account, if it was enabled.

After that, run Software Update.

If the problem is resolved after the clean installation, reinstall third-party software selectively. I can only suggest general guidelines. Self-contained applications that install into the Applications folder by drag-and-drop or download from the App Store are usually safe. Anything that comes packaged as an installer or that prompts for an administrator password is suspect, and you must test thoroughly after reinstalling each such item to make sure you haven't restored the problem.

Before installing any software, ask yourself the question: "Am I sure I know how to uninstall this without having to wipe the volume again?" If the answer is "no," stop.

Never install any third-party software unless you know how to uninstall it.

notcloudy

Level 4

1,252 points

Aug 9, 2014 10:59 AM in response to Sud30

I have Snow Leopard -- In Safari preferences where is your home page going to?

I have Safari set to open windows with a blank page rather than the home page.

My home page is internet carrier and I only go there after I check there web mail site for items in question.

IF you are not running WIndows on Mac - pc virus would not hurt you - but it is something depending on where it comes from you can sent off to your friends.

Sud30 Author

Level 1

0 points

Aug 9, 2014 11:11 AM in response to notcloudy

My homepage is set to my ISPs website and safari is set to open to this site.

Maybe I will try setting it to blank and checking if it would eliminate the problem.

notcloudy

Level 4

1,252 points

Aug 9, 2014 4:35 PM in response to Sud30

Forgot to add - I also do not allow Safari any plugins and I do not allow Java, Plug-In's, and extensions.

My firewall blocks everything, and I am not on a network so I do not share anything.

Did notice that the Safari updates in Snow Leopard had a tendency to change some of the settings so would go through preferences and change them back to what I wanted after update.

Also noticed when looking at a printer driver setup from 2 years ago - it defaulted to share - although my other setups have no share so took it off.

To keep myself wildly secure - I also use INTEGO internet security software & their Washing Machine product. (to Linc Davis - I am describing what I use and how it runs for me.)

Sud30 Author

Level 1

0 points

Aug 15, 2014 2:03 AM in response to Linc Davis

Hi,

I was unable to do a clean install as I have misplaced the Snow Leopard discs. However what I did do instead was to install the original hard drive which came with the computer which still runs snow leopard and was last updated in December 2013. Then I was just going to copy any documents that I had created since then to the old drive.

However I decided to test using the old configuration before adding any files, and the pop up still occurred. So I am just wondering is it possible for malware to affect the motherboard or some other component as it still retained this popup, although it is a completely new drive? Does this confirm that the issue is definitely a network issue? Can malware affect the modem/routers?

I also did do the following as you stated that you believe it is a network issue:

1. I am no longer connecting to the airport extreme.

2. I reset my ISP modem to the factory settings and am connecting directly to that instead.

After doing the above to the router, it did take longer to occur, however the pop up still appeared today. How would I go about removing it from the router if it is a router issue. My problem is that my ISP insists that I use their modem if I want to obtain the benefit of free wifi out of my house. It works on the fon router principle.

Thank you for your assistance.

Linc Davis

Level 10

209,559 points

Aug 15, 2014 7:01 AM in response to Sud30

I am just wondering is it possible for malware to affect the motherboard or some other component as it still retained this popup, although it is a completely new drive?

No. This is a network issue. Perhaps your ISP is hijacking DNS queries to its own name server. Whatever it is, the cause is not to be found in your computer.

Remove spyware (PCUpgradeNow.com) from Safari - Snow Leopard