Q: Macshop extension virus

The Safe Mac » Adware Removal Guide

Uninstalling Software: The Basics

Most OS X applications are completely self-contained "packages" that can be uninstalled by simply dragging the application to the Trash.  Applications may create preference files that are stored in the /Home/Library/Preferences/ folder.  Although they do nothing once you delete the associated application, they do take up some disk space.  If you want you can look for them in the above location and delete them, too.

Some applications may install an uninstaller program that can be used to remove the application.  In some cases the uninstaller may be part of the application's installer, and is invoked by clicking on a Customize button that will appear during the install process.

Some applications may install components in the /Home/Library/Applications Support/ folder.  You can also check there to see if the application has created a folder.  You can also delete the folder that's in the Applications Support folder.  Again, they don't do anything but take up disk space once the application is trashed.

Some applications may install a startupitem or a Log In item.  Startupitems are usually installed in the /Library/StartupItems/ folder and less often in the /Home/Library/StartupItems/ folder.  Log In Items are set in the Accounts preferences.  Open System Preferences, click on the Accounts icon, then click on the LogIn Items tab.  Locate the item in the list for the application you want to remove and click on the "-" button to delete it from the list.

Some software use startup daemons or agents that are a new feature of the OS.  Look for them in /Library/LaunchAgents/ and /Library/LaunchDaemons/ or in /Home/Library/LaunchAgents/.

If an application installs any other files the best way to track them down is to do a Finder search using the application name or the developer name as the search term.  Unfortunately Spotlight will not look in certain folders by default.  You can modify Spotlight's behavior or use a third-party search utility, EasyFind, instead.

Some applications install a receipt in the /Library/Receipts/ folder.  Usually with the same name as the program or the developer.  The item generally has a ".pkg" extension.  Be sure you also delete this item as some programs use it to determine if it's already installed.

There are many utilities that can uninstall applications.  Here is a selection:

    1. AppZapper

    2. AppDelete

    3. Automaton

    4. Hazel

    5. AppCleaner

    6. CleanApp

    7. iTrash

    8. Amnesia

    9. Uninstaller

  10. Spring Cleaning

For more information visit The XLab FAQs and read the FAQ on removing software.

It's malware but easy to remove....

Download and run the adware removal tool here >   The Safe Mac » Adware Removal Guide

Safe and only takes a minute or two.

Please post a screenshot of the Safari extensions list that shows no extensions installed.

Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

NiagaraTim wrote:

 

Safari > Preferences > Extensions Tab

thats where i found it and deleted the pesky adware

Since you didn't mention what kind of adware you found, I'll just say that in general there are several files installed in addition to the extension which can continue to run without being as obvious as it was at first. If you didn't follow all of the instructions for removal of that particular adware, TheSafeMac's Adware Removal Tool will quickly get rid of all currently known adware quickly and efficiently.

NiagaraTim wrote:

 

I got infested by an ad company who installed ads in my mac safari without my consent after installing a program called Weather Live which I bought on the app store and I tried to uninstall the Macshop ads after a suggestion to go to safari extensions and just remove it. many people claim that this worked but apparenty did not work on mine as the macshop extension is not listed in the extension lists also I'm baffled why Weather Live still re-installs even though I deleted in the AppCleaner..

I'm baffled too. Apple is very strict about it's apps and it's inconceivable to me that anything you obtained from the AppStore could possibly install a Safari extension by itself, let alone an adware extension. Apple does allow apps to contain ads, but again, there are strict rules that they can only appear in the app itself, be relatively unobtrusive and I think Apple may even provide them.

As far as uninstalling an AppStore app, there is only one recommended way and it doesn't involve AppCleaner or any other cleaner app. You can read about it at OS X Mavericks: Install, update, and uninstall apps, or just follow these simple instructions:

Uninstall apps

• To uninstall apps you purchased from the Mac App Store, hold down an app’s icon in Launchpad until all the icons begin to jiggle. Click an app’s delete button (x).

This seems to be something new, as I can only locate one other report, so it's important to gather as much detailed information as we can, to include a sample. If anybody else comes across this thread and knows more about the exact name of the software installed and more importantly the source of the installer, please share.

I got infested by an ad company who installed ads in my mac safari without my consent after installing a program called Weather Live which I bought on the app store

That should not be possible. Apps distributed through the App Store are very tightly sandboxed (ie, limited in capabilities), and are not allowed to install such things as browser extensions. I am quite positive that this must have been due to something you downloaded from a bad website. Do you recall what you might have been doing around the time just before you first noticed the ads? If I can locate the installer, that would go a long way towards ensuring that you don't still have some bits of this adware still installed and active.

Hi, I just found out that I have / had this too.

Running mavericks on 10.9.4

"Macshop by Kirran" is the name of the extension adware.

was the name on the extension.

I did the same. in safari i chose > preferences > then clicked the extensions tab and found the macshop extension.

My questions are.

1. (NiagagTim) hows your comp going a few days after doing these steps and deleting the extension?

2. (for anyone in discussion forum) Is this all i have to do? and is it gone for good? also do i have to worry or be careful to say purchase things online and my security?

thanks kind regards everyone!!!

also attached is the report from the "macshop" adware i would not have a clue if this helps but thought id put it in considering i took a screen shot of it

Is this all i have to do?

That's impossible to say at this point. I have yet to get my hands on a copy of an installer for this adware, so I don't know what it does. Some adware installs nothing more than a browser extension. Other adware installs a browser extension along with a bunch of other stuff. Without being able to see it in action, I cannot say which this is.

Do you happen to recall what you might have downloaded just before this problem started? If I can find an installer for MacShop, I can tell you what else you need to do.

im not exactly sure but i think it could of came from this site

www.myfreemp3.eu

or possibly it may of been when you click a song to download on this site and then takes you to another site to download

the site www.safeurl.eu they were some of the site clicking on that now i think about it started to make my computer slower and this comp is brand new haven't really been on any other sites outside of the norm Facebook gmail my website to edit

so id say more than likely if you go to the www.myfreemp3.eu site it may give you some clues

thanks very much

I didn't find anything promising there... just a couple different InstallMac installers, which also packaged some junk apps (TuneUpMyMac and MacBooster). InstallMac is adware (powered by Genieo) which can be removed with the tool MadMacs0 recommended.

Nowhere did I find anything that installed a MacShop extension.

Also, sites like that are illegal piracy and scam sites, and should be avoided. There is no legitimate way to download commercial music for free online, and trying to do so will invariably get you infected with a variety of nasty things. Downloading from criminals can't have a good outcome. Avoid such activities in the future.

Demian Renucci wrote:

 

im not exactly sure but i think it could of came from this site

 

www.myfreemp3.eu

You would not have been infected by simply visiting the site, so you would have had to download some sort of installer or media that claims to need a codec/plug-in in order to play.  It might help thomas_r. if you could look through your downloads and music for specific file / music titles.