Q: Safari - I can't stop pop-up windows, ads etc.
-
Aug 24, 2014 3:56 PMby Linc Davis,Please post a screenshot that shows what you mean. Be careful not to include any private information.
Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.
-
Aug 24, 2014 4:27 PMby Linc Davis,HelpfulYou may have installed the "VSearch" trojan, perhaps under a different name. Remove it as follows.
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data before proceeding.
Triple-click anywhere in the line below on this page to select it:
/Library/LaunchAgents/com.vsearch.agent.plist
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plistRestart the computer and empty the Trash. Then delete the following items in the same way:
/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.pluginSome of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
Reset the home page and default search engine in all the browsers, if it was changed.
This trojan is distributed on illegal websites that traffic in pirated content. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the DownLite developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
-
Sep 12, 2014 10:25 AMby abdoollahiabdool,System Version: OS X 10.9.4 (13E28)
Kernel Version: Darwin 13.3.0
Boot Mode: Normal
Model: MacBookPro7,1
RAM details
BANK 0/DIMM0:
Size: 2 GB
Speed: 1067 MHz
Status: OK
Manufacturer: 0x80AD
BANK 1/DIMM0:
Size: 4 GB
Speed: 1067 MHz
Status: OK
Manufacturer: 0x866B
System diagnostics
2014-09-09 Google Chrome spin
2014-09-10 Google Chrome spin
2014-09-10 Google Chrome spin
2014-09-10 Google Chrome spin
2014-09-12 CleanApp spin
2014-09-12 Google Chrome Helper spin
2014-09-12 Google Chrome spin
2014-09-12 Sophos Anti-Virus spin
2014-09-12 SophosAVAgent crash
2014-09-12 UserEventAgent crash
User diagnostics
2014-09-07 Mail crash
Kernel messages
Sep 10 14:00:47 IOAudioStream[0xffffff801a989400]::clipIfNecessary() - Error: attempting to clip to a position more than one buffer ahead of last clip position (cb,1540)->(ce,314).
Sep 10 14:22:13 WARNING: hibernate_page_list_setall skipped 2428721 xpmapped pages
Sep 10 14:23:33 WARNING: hibernate_page_list_setall skipped 2466628 xpmapped pages
Sep 10 14:40:17 IOAudioStream[0xffffff801a989400]::clipIfNecessary() - Error: attempting to clip to a position more than one buffer ahead of last clip position (d,15bc)->(f,28f4).
Sep 10 14:59:41 WARNING: hibernate_page_list_setall skipped 2466628 xpmapped pages
Sep 10 15:00:06 WARNING: hibernate_page_list_setall skipped 2517534 xpmapped pages
Sep 11 17:46:01 process AAM Updates Noti[333] caught causing excessive wakeups. Observed wakeups rate (per sec): 245; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45503
Sep 11 17:46:20 process rpcsvchost[94] thread 884 caught burning CPU! It used more than 50% CPU (Actual recent usage: 88%) over 180 seconds. thread lifetime cpu usage 118.020897 seconds, (92.186085 user, 25.834812 system) ledger info: balance: 90003589184 credit: 118008041293 debit: 28004452109 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 102099487714
Sep 11 17:46:25 process TeamViewer[226] caught causing excessive wakeups. Observed wakeups rate (per sec): 338; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45265
Sep 11 19:17:20 process storeagent[288] caught causing excessive wakeups. Observed wakeups rate (per sec): 1252; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45260
Sep 11 19:34:11 process WindowServer[96] caught causing excessive wakeups. Observed wakeups rate (per sec): 179; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 99588
Sep 11 19:48:58 process Google Chrome He[355] caught causing excessive wakeups. Observed wakeups rate (per sec): 218; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 86078
Sep 11 20:09:49 wl0: Roamed or switched channel, reason CSA
--- last message repeated 1 time ---
Sep 11 20:27:35 process CleanApp[739] caught causing excessive wakeups. Observed wakeups rate (per sec): 321; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45046
Sep 11 20:35:39 process PluginProcess[792] caught causing excessive wakeups. Observed wakeups rate (per sec): 277; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 48293
Sep 11 20:43:23 process PluginProcess[838] caught causing excessive wakeups. EXC_RESOURCE supressed due to audio playback
Sep 11 21:20:58 process Sophos Anti-Viru[1087] caught causing excessive wakeups. Observed wakeups rate (per sec): 1069; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 64492
Sep 11 21:26:22 WARNING: hibernate_page_list_setall skipped 20552 xpmapped pages
Sep 12 04:39:27 process AAM Updates Noti[1421] caught causing excessive wakeups. Observed wakeups rate (per sec): 1137; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45411
Sep 12 04:42:18 process PluginProcess[1152] caught causing excessive wakeups. Observed wakeups rate (per sec): 204; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 148417
Sep 12 06:04:54 process Google Chrome He[2138] caught causing excessive wakeups. EXC_RESOURCE supressed due to audio playback
Sep 12 07:13:46 WARNING: hibernate_page_list_setall skipped 20552 xpmapped pages
Sep 12 07:14:20 WARNING: hibernate_page_list_setall skipped 86032 xpmapped pages
Sep 12 07:34:23 process Google Chrome He[2383] caught causing excessive wakeups. Observed wakeups rate (per sec): 512; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45123
Total CPU usage: user 48%, system 11%
CPU usage by process "diskimages-helpe" with UID 0: 9.8%
Loaded extrinsic kernel extensions
com.rim.driver.BlackBerryUSBDriverInt (0.0.74)
org.virtualbox.kext.VBoxDrv (4.1.18)
org.virtualbox.kext.VBoxUSB (4.1.18)
com.logmein.driver.LogMeInSoundDriver (1.0.2)
com.sophos.nke.swi (9.0.53)
com.sophos.kext.sav (9.0.53)
Extrinsic daemons
com.vsearch.daemon
com.zeobit.MacKeeper.plugin.AntiTheft.daemon
com.trusteer.rooks.rooksd
com.syniumsoftware.CleanAppDaemon
com.rim.BBDaemon
com.logmein.raupdate
com.google.keystone.daemon
com.adobe.fpsaud
Extrinsic agents
com.evernote.EvernoteHelper
com.trusteer.rapport.rapportd
com.rim.BBLaunchAgent
com.rim.RimAlbumArtDaemon
com.logmein.LMILaunchAgentFixer
com.hp.help.tocgenerator
com.google.keystone.system.agent
com.adobe.CS5ServiceManager
com.zeobit.MacKeeper.Helper
com.divx.agent.postinstall
com.adobe.ARM.UUID
launchd items
/Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist
(com.adobe.AAM.Startup-1.0)
/Library/LaunchAgents/com.adobe.CS5ServiceManager.plist
(com.adobe.CS5ServiceManager)
/Library/LaunchAgents/com.google.keystone.agent.plist
(com.google.keystone.system.agent)
/Library/LaunchAgents/com.hp.help.tocgenerator.plist
(com.hp.help.tocgenerator)
/Library/LaunchAgents/com.logmein.LMILaunchAgentFixer.plist
(com.logmein.LMILaunchAgentFixer)
/Library/LaunchAgents/com.logmein.logmeingui.plist
(com.logmein.logmeingui)
/Library/LaunchAgents/com.logmein.logmeinguiagent.plist
(com.logmein.logmeinguiagent)
/Library/LaunchAgents/com.logmein.logmeinguiagentatlogin.plist
(com.logmein.logmeinguiagentatlogin)
/Library/LaunchAgents/com.rim.BBAlbumArtCacher.plist
(com.rim.RimAlbumArtDaemon)
/Library/LaunchAgents/com.rim.BBLaunchAgent.plist
(com.rim.BBLaunchAgent)
/Library/LaunchAgents/com.teamviewer.teamviewer.plist
(com.teamviewer.teamviewer)
/Library/LaunchAgents/com.teamviewer.teamviewer_desktop.plist
(com.teamviewer.desktop)
/Library/LaunchAgents/com.trusteer.rapport.rapportd.plist
(com.trusteer.rapport.rapportd)
/Library/LaunchAgents/com.vsearch.agent.plist
(com.vsearch.agent)
/Library/LaunchDaemons/com.adobe.fpsaud.plist
(com.adobe.fpsaud)
/Library/LaunchDaemons/com.google.keystone.daemon.plist
(com.google.keystone.daemon)
/Library/LaunchDaemons/com.logmein.logmeinblanker.plist
(com.logmein.logmeinblanker)
/Library/LaunchDaemons/com.logmein.logmeinserver.plist
(com.logmein.logmeinserver)
/Library/LaunchDaemons/com.logmein.raupdate.plist
(com.logmein.raupdate)
/Library/LaunchDaemons/com.rim.BBDaemon.plist
(com.rim.BBDaemon)
/Library/LaunchDaemons/com.syniumsoftware.CleanAppDaemon.plist
(com.syniumsoftware.CleanAppDaemon)
/Library/LaunchDaemons/com.teamviewer.teamviewer_service.plist
(com.teamviewer.service)
/Library/LaunchDaemons/com.trusteer.rooks.rooksd.plist
(com.trusteer.rooks.rooksd)
/Library/LaunchDaemons/com.vsearch.daemon.plist
(com.vsearch.daemon)
/Library/LaunchDaemons/com.vsearch.helper.plist
(com.vsearch.helper)
/Library/LaunchDaemons/com.zeobit.MacKeeper.plugin.AntiTheft.daemon.plist
(com.zeobit.MacKeeper.plugin.AntiTheft.daemon)
Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist
(com.adobe.AAM.Scheduler-1.0)
Library/LaunchAgents/com.adobe.ARM.UUID.plist
(com.adobe.ARM.UUID)
Library/LaunchAgents/com.apple.FolderActions.enabled.plist
(com.apple.FolderActions.enabled)
Library/LaunchAgents/com.apple.FolderActions.folders.plist
(com.apple.FolderActions.folders)
Library/LaunchAgents/com.divx.agent.postinstall.plist
(com.divx.agent.postinstall)
Library/LaunchAgents/com.zeobit.MacKeeper.Helper.plist
(com.zeobit.MacKeeper.Helper)
Library/LaunchAgents/org.virtualbox.vboxwebsrv.plist
(org.virtualbox.vboxwebsvc)
Startup items
/Library/StartupItems/HWNetMgr/HWNetCfg
/Library/StartupItems/HWNetMgr/HWNetMgr
/Library/StartupItems/HWPortDetect/HWPortCfg
/Library/StartupItems/HWPortDetect/HWPortDetect
/Library/StartupItems/HWPortDetect/StartupParameters.plist
/Library/StartupItems/VirtualBox/Resources/English.lproj/Localizable.strings
/Library/StartupItems/VirtualBox/VirtualBox
Extrinsic loadable bundles
/System/Library/CoreServices/SecurityAgentPlugins/HomeDirMechanism.bundle
(com.apple.SecurityAgentPlugin.HomeDirMechanism)
/System/Library/CoreServices/SecurityAgentPlugins/KerberosAgent.bundle
(com.apple.KerberosAgent)
/System/Library/CoreServices/SecurityAgentPlugins/loginwindow.bundle
(com.apple.securityAgentPlugins.loginwindowUI)
/System/Library/CoreServices/SecurityAgentPlugins/MCXMechanism.bundle
(com.apple.securityAgentPlugin.MCXMechanism)
/System/Library/CoreServices/SecurityAgentPlugins/PKINITMechanism.bundle
(com.apple.PKINITMechanism)
/System/Library/CoreServices/SecurityAgentPlugins/RestartAuthorization.bundle
(com.apple.securityAgentPlugin.RestartAuthorization)
/System/Library/Extensions/AMDRadeonVADriver.bundle
(com.apple. AMDRadeonVADriver)
/System/Library/Extensions/AMDRadeonX3000.kext
(com.apple.AMDRadeonX3000)
/System/Library/Extensions/AMDRadeonX3000GLDriver.bundle
(com.apple.AMDRadeonX3000GLDriver)
/System/Library/Extensions/AMDRadeonX4000.kext
(com.apple.AMDRadeonX4000)
/System/Library/Extensions/AMDRadeonX4000GLDriver.bundle
(com.apple.AMDRadeonX4000GLDriver)
/System/Library/Extensions/AppleFSCompressionTypeLZVN.kext
(com.apple.AppleFSCompression.AppleFSCompressionTypeLZVN)
/System/Library/Extensions/AppleIntelHD3000Graphics.kext
(com.apple.driver.AppleIntelHD3000Graphics)
/System/Library/Extensions/AppleIntelHD3000GraphicsGA.plugin
(com.apple.driver.AppleIntelHD3000GraphicsGA)
/System/Library/Extensions/AppleIntelHD3000GraphicsGLDriver.bundle
(com.apple.driver.AppleIntelHD3000GraphicsGLDriver)
/System/Library/Extensions/AppleIntelHD3000GraphicsVADriver.bundle
(com.apple.AppleIntelHD3000GraphicsVADriver)
/System/Library/Extensions/AppleIntelHD4000Graphics.kext
(com.apple.driver.AppleIntelHD4000Graphics)
/System/Library/Extensions/AppleIntelHD4000GraphicsGLDriver.bundle
(com.apple.driver.AppleIntelHD4000GraphicsGLDriver)
/System/Library/Extensions/AppleIntelHD4000GraphicsVADriver.bundle
(com.apple.AppleIntelHD4000GraphicsVADriver)
/System/Library/Extensions/AppleIntelHD5000Graphics.kext
(com.apple.driver.AppleIntelHD5000Graphics)
/System/Library/Extensions/AppleIntelHD5000GraphicsGLDriver.bundle
(com.apple.driver.AppleIntelHD5000GraphicsGLDriver)
/System/Library/Extensions/AppleIntelHD5000GraphicsVADriver.bundle
(com.apple.AppleIntelHD5000GraphicsVADriver)
/System/Library/Extensions/AppleIntelHDGraphicsGLDriver.bundle
(com.apple.driver.AppleIntelHDGraphicsGLDriver)
/System/Library/Extensions/AppleIntelHSWVA.bundle
(com.apple.AppleIntelHSWFBVA)
/System/Library/Extensions/AppleIntelIVBVA.bundle
(com.apple.AppleIntelIVBFBVA)
/System/Library/Extensions/AppleIntelMCEReporter.kext
(com.apple.driver.AppleIntelMCEReporter)
/System/Library/Extensions/ATIRadeonX2000.kext
(com.apple.ATIRadeonX2000)
/System/Library/Extensions/ATIRadeonX2000GA.plugin
(com.apple.ATIRadeonX2000GA)
/System/Library/Extensions/ATIRadeonX2000GLDriver.bundle
(com.apple.ATIRadeonX2000GLDriver)
/System/Library/Extensions/ATIRadeonX2000VADriver.bundle
(com.apple.ATIRadeonX2000VADriver)
/System/Library/Extensions/EPSONUSBPrintClass.kext
(com.epson.print.kext.USBPrintClass)
/System/Library/Extensions/GeForce.kext
(com.apple.GeForce)
/System/Library/Extensions/GeForceGA.plugin
(com.apple.GeForceGA)
/System/Library/Extensions/GeForceGLDriver.bundle
(com.apple.GeForceGLDriver)
/System/Library/Extensions/GeForceTesla.kext
(com.apple.GeForceTesla)
/System/Library/Extensions/GeForceTeslaGLDriver.bundle
(com.apple.GeForceTeslaGLDriver)
/System/Library/Extensions/GeForceTeslaVADriver.bundle
(com.apple.GeForceTeslaVADriver)
/System/Library/Extensions/GeForceVADriver.bundle
(com.apple.GeForceVADriver)
/System/Library/Extensions/hp_designjet_series.kext
(com.hp.print.hpio.Designjet.kext)
/System/Library/Extensions/hp_Deskjet_io_enabler.kext
(com.hp.print.hpio.Deskjet.kext)
/System/Library/Extensions/hp_fax_io.kext
(com.hp.kext.hp-fax-io)
/System/Library/Extensions/hp_Inkjet1_io_enabler.kext
(com.hp.print.hpio.Inkjet1.kext)
/System/Library/Extensions/hp_Inkjet2_io_enabler.kext
(com.hp.print.hpio.Inkjet2.kext)
/System/Library/Extensions/hp_Inkjet3_io_enabler.kext
(com.hp.print.hpio.Inkjet3.kext)
/System/Library/Extensions/hp_Inkjet4_io_enabler.kext
(com.hp.print.hpio.Inkjet4.kext)
/System/Library/Extensions/hp_Inkjet5_io_enabler.kext
(com.hp.print.hpio.Inkjet5.kext)
/System/Library/Extensions/hp_Inkjet7_io_enabler.kext
(com.hp.print.hpio.inkjet7.kext)
/System/Library/Extensions/hp_Inkjet8_io_enabler.kext
(com.hp.print.hpio.inkjet8.kext)
/System/Library/Extensions/hp_Inkjet_io_enabler.kext
(com.hp.print.hpio.Inkjet.kext)
/System/Library/Extensions/hp_io_printerclassdriver_enabler.kext
(com.hp.hpio.hp-io-printerclassdriver-enabler)
/System/Library/Extensions/hp_Laserjet_io_enabler.kext
(com.hp.print.hpio.Laserjet.kext)
/System/Library/Extensions/hp_Officejet_io_enabler.kext
(com.hp.print.hpio.Officejet.kext)
/System/Library/Extensions/hp_Photosmart_io_enabler.kext
(com.hp.print.hpio.Photosmart.kext)
/System/Library/Extensions/hp_PhotosmartPro_io_enabler.kext
(com.hp.print.hpio.PhotosmartPro.kext)
/System/Library/Extensions/hp_qc_io_enabler.kext
(com.hp.hpio.hp_psa530_630_io_enabler)
/System/Library/Extensions/HuaweiDataCardDriver.kext
(com.huawei.driver.HuaweiDataCardDriver)
/System/Library/Extensions/LexmarkUSBMerge.kext
(com.lexmark.print.usbmerge)
/System/Library/Extensions/LogMeInSoundDriver.kext
(com.logmein.driver.LogMeInSoundDriver)
/System/Library/Extensions/MobileConnect power.app
(com.yourcompany.MobileConnect)
/System/Library/Extensions/RIMBBUSB.kext
(com.rim.driver.BlackBerryUSBDriverInt)
/System/Library/Extensions/RIMBBVSP.kext
(com.rim.driver.BlackBerryUSBDriverVSP)
/System/Library/Extensions/USBExpressCardCantWake.kext
(com.apple.dts.driver.USBExpressCardCantWake)
/System/Library/Extensions/USBExpressCardCantWake_Huawei.kext
(com.apple.dts.driver.USBExpressCardCantWake)
/Library/Audio/MIDI Drivers/EmagicUSBMIDIDriver.plugin
(info.emagic.driver.unitor)
/Library/Audio/Plug-Ins/HAL/AirPlay.driver
(com.apple.audio.AirTunesHALPlugin)
/Library/Audio/Plug-Ins/HAL/AppleAVBAudio.driver
(com.apple.audio.AppleAVBAudio)
/Library/Audio/Plug-Ins/HAL/BluetoothAudioPlugIn.driver
(com.apple.audio.BluetoothAudioPlugIn)
/Library/Audio/Plug-Ins/HAL/iSightAudio.driver
(com.apple.iSightAudio)
/Library/Extensions/VBoxDrv.kext
(org.virtualbox.kext.VBoxDrv)
/Library/Extensions/VBoxNetAdp.kext
(org.virtualbox.kext.VBoxNetAdp)
/Library/Extensions/VBoxNetFlt.kext
(org.virtualbox.kext.VBoxNetFlt)
/Library/Extensions/VBoxUSB.kext
(org.virtualbox.kext.VBoxUSB)
/Library/Internet Plug-Ins/AdobePDFViewer.plugin
(com.adobe.acrobat.pdfviewer)
/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin
(com.adobe.acrobat.pdfviewerNPAPI)
/Library/Internet Plug-Ins/Default Browser.plugin
(com.apple.DefaultBrowser.PlugIn)
/Library/Internet Plug-Ins/DirectorShockwave.plugin
(com.adobe.shockwave.pluginshim)
/Library/Internet Plug-Ins/DivXBrowserPlugin.plugin
(com.divx.DivXBrowserPlugin)
/Library/Internet Plug-Ins/FirefoxAPI.bundle
(com.researchinmotion.npappworld)
/Library/Internet Plug-Ins/Flash Player.plugin
(com.macromedia.Flash Player.plugin)
/Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin
(net.telestream.wmv.plugin)
/Library/Internet Plug-Ins/Flip4Mac WMV Plugin.webplugin
(net.telestream.wmv.webplugin)
/Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin
(com.Google.GoogleEarthPlugin.plugin)
/Library/Internet Plug-Ins/googletalkbrowserplugin.plugin
(com.google.googletalkbrowserplugin)
/Library/Internet Plug-Ins/iPhotoPhotocast.plugin
(com.apple.plugin.iPhotoPhotocast)
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin
(com.apple.java.JavaAppletPlugin)
/Library/Internet Plug-Ins/LogMeIn.plugin
(com.logmein.remctrlplugin)
/Library/Internet Plug-Ins/LogMeIn.plugin/LogMeInPluginHost.app
(com.logmein.logmeinpluginhost)
/Library/Internet Plug-Ins/LogMeInSafari32.plugin
(com.logmein.remctrlplugin)
/Library/Internet Plug-Ins/LogMeInSafari64.plugin
(com.logmein.remctrlplugin)
/Library/Internet Plug-Ins/o1dbrowserplugin.plugin
(com.google.o1dbrowserplugin)
/Library/Internet Plug-Ins/OfficeLiveBrowserPlugin.plugin
(com.microsoft.officelive.browserplugin)
/Library/Internet Plug-Ins/OVSHelper.plugin
(com.divx.OVSHelper)
/Library/Internet Plug-Ins/Quartz Composer.webplugin
(com.apple.QuartzComposer.webplugin)
/Library/Internet Plug-Ins/QuickTime Plugin.plugin
(com.apple.QuickTime Plugin.plugin)
/Library/Internet Plug-Ins/RealPlayer Plugin.plugin
(com.RealNetworks.RealPlayerPlugin)
/Library/Internet Plug-Ins/Silverlight.plugin
(com.microsoft.SilverlightPlugin)
/Library/Internet Plug-Ins/Unity Web Player.plugin
(com.unity.UnityWebPlayer)
/Library/iTunes/iTunes Plug-ins/Quartz Composer Visualizer.bundle
(com.apple.QuartzComposer.iTunesPlugIn)
/Library/PreferencePanes/DivX.prefPane
(com.divx.divxprefs)
/Library/PreferencePanes/Flash Player.prefPane
(com.adobe.flashplayerpreferences)
/Library/PreferencePanes/Flip4Mac WMV.prefPane
(net.telestream.wmv.prefpane)
/Library/PreferencePanes/Growl.prefPane
(com.growl.prefpanel)
/Library/PreferencePanes/RapportPreferences.prefPane
(com.trusteer.RapportPreferences)
/Library/QuickTime/AppleMPEG2Codec.component
(com.apple.AppleMPEG2Codec)
/Library/Spotlight/GBSpotlightImporter.mdimporter
(com.apple.garageband.spotlightimporter)
/Library/Spotlight/iBooksAuthor.mdimporter
(com.apple.MDImporter.iBooksAuthor)
/Library/Spotlight/iWork.mdimporter
(com.apple.MDImporter.iWork)
/Library/Spotlight/Microsoft Office.mdimporter
(com.microsoft.MDImporter.Office)
Library/Address Book Plug-Ins/SkypeABDialer.bundle
(com.skype.skypeabdialer)
Library/Address Book Plug-Ins/SkypeABSMS.bundle
(com.skype.skypeabsms)
Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin
(com.Google.GoogleEarthPlugin.plugin)
Library/Internet Plug-Ins/NPRoblox.plugin
(com.Roblox.RobloxLauncherPlugin)
Library/PreferencePanes/CleanApp Logging Service.prefPane
(com.syniumsoftware.CleanAppDaemon.PreferencePane)
Extrinsic shared libraries
/usr/lib/dtrace/libdtrace_dyld.dylib
/usr/lib/libgmalloc.B.dylib
/usr/lib/libruby.2.0.0.dylib
/usr/lib/libXplugin.1.dylib
DNS (from DHCP): 4.2.2.1
Netmask: 255.255.240.0
hosts
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 adobe.activate.com
127.0.0.1 hl2rcv.adobe.com
127.0.0.1 209.34.83.73:443
127.0.0.1 209.34.83.73:43
127.0.0.1 209.34.83.73
127.0.0.1 209.34.83.67:443
127.0.0.1 209.34.83.67:43
127.0.0.1 209.34.83.67
127.0.0.1 ood.opsource.net
127.0.0.1 CRL.VERISIGN.NET
127.0.0.1 199.7.52.190:80
[82 more line(s)]
Safari extensions
Twitter for Safari
Gmail Menu
DivXHTML5
Evernote Web Clipper
extension
Restricted user files: 420
Font problems: 45
Keychains file count: 8
Elapsed time (s): 485
-
Oct 24, 2014 7:09 AMby crickowens,I had this problem also and used Virus Barrier Express app downloaded from App Store for free. Ran a Full Scan which takes a while and stops when computer sleeps. So you need to increase sleep time in in your "Preferences" on "Energy" icon to max. Update VBE before scanning and let it run until finished. Icon on VBE will turn red if infected files are picked up. You get a list at the end of the scan and I highlighted one at a time and right clicked to bring up "Show in Finder" button then "Moved to Trash" from "Finder". Had no luck with blue "Repair" button on VBE. This solved my problem of Safari preferences going back to "Never" on Blocking 3rd party Cookies. Don't forget to go back and change sleep time.
