Pop-up links everywhere in Safari, please help!

Question

Level 1

0 points

Pop-up links everywhere in Safari, please help!

I will try to give as many details as possible, but unfortunately I am not the BEST at knowing when it comes to computers (I'm trying to learn every day though) -- so I'm sorry in advance if any of this is confusing.

I had been having issues with my computer being very slow recently, so I did a Disk Utility update as recommended by a very awesome article I found online. My computer speed has gotten back to normal and I thought everything was great! Until I realized that my Safari has not been fixed. I've tried EVERYTHING.

When my computer was being slow, I updated to the most recent OS X available. I have a Macbook that I purchased for college in 2011 - so the physical computer is not too new, so I thought that giving my computer an update in software would help.

For some reason, though, my Safari has been having so many ads. Like I said, I've tried almost everything I could find. My Safari will pop up with a new ad window almost anywhere I click. I get ads for hotels.com, Mackeeper, Dynamic Pricer... you name it. It's so inconvenient and annoying and I am genuinely hoping there's a way I can fix it. I've been so satisfied with my Mac these past three years but this is just a problem that's reminding me of what I used to run into all the time in the old PC days.

To give you an idea of what I've tried: I've tried AdBlock, removing third party add ons or plug ins, changing my settings in Security and Privacy (the cookie settings, etc), I've tried searching my mac to see if Mackeeper or any of those annoying ads are in my activity monitor.

Please tell me there's a way to get rid of these ads! I don't mind some ads, but just about anywhere I click on my Safari window, I get an ad that pops up into a new tab, so it's leading me to believe something is clearly wrong.

If anyone has any further suggestions for improvement, I will be forever grateful! Usually I can do some research and figure little issues out, but this is persistent and nothing I search has been successful.

Thank you!

MacBook, OS X Mavericks (10.9.4)

Posted on Sep 2, 2014 5:33 PM

Reply

Answer 1

Sep 2, 2014 5:47 PM in response to crt014

The pop ups are due to malware but easy to remove ...

Download and run the adware removal tool here > The Safe Mac » Adware Removal Guide

Safe and only takes a minute or two.

Reply

Answer 2

Linc Davis

Level 10

209,541 points

Sep 2, 2014 8:30 PM in response to crt014

You may have installed the "VSearch" trojan, perhaps under a different name. Remove it as follows.

Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.

Back up all data before proceeding.

Triple-click anywhere in the line below on this page to select it:

/Library/LaunchAgents/com.vsearch.agent.plist

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.

Repeat with each of these lines:

/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist

Restart the computer and empty the Trash. Then delete the following items in the same way:

/Library/Application Support/VSearch
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin

Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

From the Safari menu bar, select

Safari ▹ Preferences... ▹ Extensions

Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

Reset the home page and default search engine in all the browsers, if it was changed.

This trojan is distributed on illegal websites that traffic in pirated content. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.

You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that this Internet criminal has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Reply