truthspeak

Q: need help removing adware from Safari Version 7.0.5 (9537.77.4) Maverick System OS X 10.9.4 (13E28)

This adware renders system useless during while using web. Cannot perform even the simplest work that requires interaction on a website. (Except Apple). I have excellent Web Service. Other iMac and 4 IOS devices are not affected, and work well. 

iMac, OS X Mavericks (10.9.4), Often involves interleaved movie ad

Posted on Aug 11, 2014 1:46 PM

Close

Q: need help removing adware from Safari Version 7.0.5 (9537.77.4) Maverick System OS X 10.9.4 (13E28)

  • All replies
  • Helpful answers

  • by Kappy,

    Kappy Kappy Aug 11, 2014 1:49 PM in response to truthspeak
    Level 10 (271,684 points)
    Desktops
    Aug 11, 2014 1:49 PM in response to truthspeak

    The Safe Mac » Adware Removal Guide

     

    Helpful Links Regarding Malware Protection

     

    An excellent link to read is Tom Reed's Mac Malware Guide.

    For adware removal see The Safe Mac » Adware Removal Guide and The Safe Mac » Adware Removal Tool.

    Also, visit The XLab FAQs and read Detecting and avoiding malware and spyware.

    See these Apple articles:

     

      Mac OS X Snow Leopard and malware detection

      OS X Lion- Protect your Mac from malware

      OS X Mountain Lion- Protect your Mac from malware

      OS X Mavericks- Protect your Mac from malware

      About file quarantine in OS X

     

    If you require anti-virus protection Thomas Reed recommends using ClamXAV. (Thank you to Thomas Reed for this recommendation.)

     

    From user Joe Bailey comes this equally useful advice:

     

    The facts are:

     

    1. There is no anti-malware software that can detect 100% of the malware out there.

    2. There is no anti-malware that can detect anything targeting the Mac because there

         is no Mac malware in the wild, and therefore, no "signatures" to detect.

    3. The very best way to prevent the most attacks is for you as the user to be aware that

         the most successful malware attacks rely on very sophisticated social engineering

         techniques preying on human avarice, ****, and fear.

    4. Internet popups saying the FBI, NSA, Microsoft, your ISP has detected malware on

        your computer is intended to entice you to install their malware thinking it is a

        protection against malware.

    5. Some of the anti-malware products on the market are worse than the malware

        from which they purport to protect you.

    6. Be cautious where you go on the internet.

    7. Only download anything from sites you know are safe.

    8. Avoid links you receive in email, always be suspicious even if you get something

        you think is from a friend, but you were not expecting.

    9. If there is any question in your mind, then assume it is malware.

  • by Linc Davis,

    Linc Davis Linc Davis Aug 11, 2014 2:51 PM in response to truthspeak
    Level 10 (208,017 points)
    Applications
    Aug 11, 2014 2:51 PM in response to truthspeak

    You may have installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.

    Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.

    Back up all data.

    Triple-click anywhere in the line below on this page to select it:

    /Library/LaunchAgents/com.vsearch.agent.plist

    Right-click or control-click the line and select

              Services Reveal in Finder (or just Reveal)

    from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.

    Repeat with each of these lines:

    /Library/LaunchDaemons/com.vsearch.daemon.plist
    /Library/LaunchDaemons/com.vsearch.helper.plist
    /Library/LaunchDaemons/Jack.plist

    Restart the computer and empty the Trash. Then delete the following items in the same way:

    /Library/Application Support/VSearch
    /Library/PrivilegedHelperTools/Jack
    /System/Library/Frameworks/VSearch.framework
    ~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin

    Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

    From the Safari menu bar, select

              Safari Preferences... Extensions

    Uninstall any extensions you don't know you need, including any that have the word "Spigot" or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

    This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.

    You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.

    *If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination  command-C. In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

  • by mama99,

    mama99 mama99 Jan 8, 2015 8:00 PM in response to truthspeak
    Level 1 (0 points)
    Jan 8, 2015 8:00 PM in response to truthspeak

    Hello Apple community

     

    PLEASE I need your help!

    I'm having an horrible experience with my Safari 7.1.2 ( iMac OS X 10.9.5)

    Bare with me, here are my symptoms, and what I did so far looking for solutions online. None of them helped

     

     

    This all started SUDDENLY, today. Although i DOWNLOADED a couple of apps last week  thinking i was upgrading my video app that wasn't working (I was prompted to do so but the video never ended up working!)

     

    My symptoms:

    - Ads are "glueing" themselves on my webpages... in different formats depending on the website i'm on (regular websites...)

    Virustiff.jpg

     

    - pages are opening ups by themselves (see picture) :

    *directing to "d2bzz.resolve.sweepstakesghost.biz/?sov....." with a window saying "PC TECH SUPPORT Chat initiated. Specialist: Matt Folson Date: January 7, 2015";

    To this i turned my Wifi off and then closed the page to avoid clicking on the OK button (yet now it's not asking anymore and just redirecting me without asking)

    virusimac2jpg.jpg



    *directing to other supposedly technical support...

    Virusredirecting.jpg

     

     

    *...

    - SELECTED WORDS become all caps, underlined, and in light blue with a link to an ad? (see picture above)

    Virus blue wordsjpg.jpg

    - ALL of this are displaying a certain "Ad by PJS-4.2"

     

    My Solutions:

     

    1)

    I searched online and DOWNLOADED

    -Clamsav: found items to remove and removed them and emptied my trash ---> Dindt work (see picture)

    - ADWARE Medic: found a couple of other items to delete and deleted them , emptied trash and restated computer ----> didn't work!

    Still same Symptoms!

     

    2)

    I checked my extensions for Safari and only found 3 that I do use (and been using for quite a while). Just uninstalled them

    Still same symptoms!

     

    3)

    I also looked for your files “Linc Davis” is referring to here in the forum but can't find any of them in my COMPUTER.

    Triple-click anywhere in the line below on this page to select it:

    /Library/LaunchAgents/com.vsearch.agent.plist

    Right-click or control-click the line and select

              Services Reveal in Finder (or just Reveal)

    from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator LOGIN password.

    Repeat with each of these lines:

    /Library/LaunchDaemons/com.vsearch.daemon.plist
    /Library/LaunchDaemons/com.vsearch.helper.plist
    /Library/LaunchDaemons/Jack.plist

    Restart the computer and empty the Trash. Then DELETE the following items in the same way:

    /Library/Application Support/VSearch
    /Library/PrivilegedHelperTools/Jack
    /System/Library/Frameworks/VSearch.framework
    ~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin

    4)

    I did an other search recommended by “Linc Davis”, about looking for     /Library/LaunchDaemons        in the Finder and I FOUND this:

    com.smithmicro.schedulerdaemon.plist

    com.MICROSOFT.office.licensing.helper.plist

    com.surteesstudios.hddfancontroldaemon.plist

    com.adobe.fpsaud.plist

    com.macpaw.CleanMyMac2.Agent.plist

    com.apple.aelwriter.plist

    com.adobe.SwitchBoard.plist

    com.apple.qmaster.qmasterd.plist

    com.adobe.versioncueCS3.plist

    com.bombich.ccc.plist

     

    PLEASE PLEASE HELP what can I do to GET RID OF those?!!