how do I get rid of malware?

Helpful Links Regarding Malware Protection

If you are having an immediate problem with ads popping up see The Safe Mac » Adware Removal Guide and The Safe Mac » Adware Removal Tool.

An excellent link to read is Tom Reed's Mac Malware Guide.

Also, visit The XLab FAQs and read Detecting and avoiding malware and spyware.

See these Apple articles:

Mac OS X Snow Leopard and malware detection

OS X Lion- Protect your Mac from malware

OS X Mountain Lion- Protect your Mac from malware

OS X Mavericks- Protect your Mac from malware

About file quarantine in OS X

If you require anti-virus protection Thomas Reed recommends using ClamXAV. (Thank you to Thomas Reed for this recommendation.)

From user Joe Bailey comes this equally useful advice:

The facts are:

1. There is no anti-malware software that can detect 100% of the malware out there.

2. There is no anti-malware that can detect anything targeting the Mac because there

is no Mac malware in the wild, and therefore, no "signatures" to detect.

3. The very best way to prevent the most attacks is for you as the user to be aware that

the most successful malware attacks rely on very sophisticated social engineering

techniques preying on human avarice, ****, and fear.

4. Internet popups saying the FBI, NSA, Microsoft, your ISP has detected malware on

your computer is intended to entice you to install their malware thinking it is a

protection against malware.

5. Some of the anti-malware products on the market are worse than the malware

from which they purport to protect you.

6. Be cautious where you go on the internet.

7. Only download anything from sites you know are safe.

8. Avoid links you receive in email, always be suspicious even if you get something

you think is from a friend, but you were not expecting.

9. If there is any question in your mind, then assume it is malware.

You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.

Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.

Back up all data.

Triple-click anywhere in the line below on this page to select it:

/Library/LaunchAgents/com.vsearch.agent.plist

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.

Repeat with each of these lines:

/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist

Restart the computer and empty the Trash. Then delete the following items in the same way:

/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin

Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

From the Safari menu bar, select

Safari ▹ Preferences... ▹ Extensions

Uninstall any extensions you don't know you need, including any that have the word "Spigot" or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.

You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

May I ask if I could use the instructions you have given to remove Mal/BredoZp-B? This was quarantined by my free version of Sophos and despite following their instructions I don't seem able to remove it. Perhaps having the free version doesn't work. As it has been quarantined do I, in fact, need to remove it? I believe it was downloaded onto my iMac when I watched a YouTube video of a Juicer I was interested in buying (for heaven's sake!). Apologies if I should have used a new post and thanks in advance for any help you can give me.

Gill

Paragraph 2 of Joe Bailey's advise is totally false.

As of October 3rd this solution works perfectly for the above stated problem. Thank you Linc Davis

Genius. This completely fixed my malware problem which i got by installing a 'flash' player. All's back to normal, thank you!

Thank you Linc! Totally works for me.

Thanks, Linc! That worked for me as well. So simple.

thank you, thank you, thank you!!! this totally worked for my issue. brilliant!

THANKS LINC, works for me!

I tried everything from the discussion groups, but mackeeper kept popping up. Finally I called Apple Support.

Download Bitdefender from Apple App store. It's free and it WORKS like a charm. So easy and the best.

Thank you, it worked just fine! I've been stressed for two days figuring out how to remove it, even Bitdefender from Apple didn't work. I am so glad I found your post. More power!

sheilasandiego wrote:

Thank you, it worked just fine!

Actually, I believe those instructions are slightly out-of-date. It's always wise to find the most recent posting on things like this as things change rapidly in the adware area.

even Bitdefender from Apple didn't work.

Just so you know, BitDefender is not an Apple product. It's just a third party app available from the App Store. It's approved by Apple, but not necessarily recommended. The official guidance on these issues from Apple is Remove unwanted adware that displays pop-up ads and graphics on your Mac, but even that is incomplete.

The same issue happened to me earlier today as I was trying to (or so I thought) download a link to watch NBA games live. I think I ended up with adware (vs. malware), but I'm not 100% sure. I stumbled upon your reply from last year and my adware was a slightly different version than the one you mentioned, but I followed the steps you outlined above and it seemed to take care of the problem. The only thing is that when I opened Safari and deleted all of my extensions, I still saw a little pop-up ad on my homepage, which was originally set to Google. When I went into Preferences --> General, I noticed that my homepage's web address no longer said "www.Google.com", but had some version of it with what looked like some strange extension added to it. I changed my homepage's web address back to Google.com and it seems fine now. Is there anything else I need to be doing to make sure I've gotten rid of this thing? Your advice was so incredibly helpful, but I just wanted to doble check in case I'm missing something else. THANK YOU!!

yuzulemon wrote:

Is there anything else I need to be doing to make sure I've gotten rid of this thing?

Linc rarely responds to "me too" requests and may not even be monitoring this conversation any more.

It is normal for adware to change both the home page and search engine, so you should also check the latter in Safari Preferences.