mirandian

Q: Why another window or tab pops up when I click on one site?

Hi. When I click on any website for anything....I have another tab or window popping up which has nothing to do with the original website that I am on. Why is this so? This is beginning to be real irritating. Secondly I also get this annoying video streaming alongside on youtube. Any clue how to get rid of this? Thanks.

MacBook Air

Posted on Sep 7, 2014 6:15 AM

Close

Q: Why another window or tab pops up when I click on one site?

  • All replies
  • Helpful answers

Page 1 Next
  • by dominic23,

    dominic23 dominic23 Sep 7, 2014 7:02 AM in response to mirandian
    Level 8 (42,047 points)
    Mac OS X
    Sep 7, 2014 7:02 AM in response to mirandian

    mirandian wrote:

     

    Why is this so?

     

     

     

    Adware installed probably.

     

    Use Adware Removal Tool.

     

    Log in to an administrator account and download the tool from here.

     

         http://www.thesafemac.com/art/

     

    Click the “Download now” link.

     

     

    Open the Downloads folder in the Dock and open the “.TSM Adware Removal Tool”.

     

    Click the “TSM Adware Removal Tool” again.

     

    Follow the prompts.

  • by mirandian,

    mirandian mirandian Sep 7, 2014 7:41 AM in response to dominic23
    Level 1 (0 points)
    Sep 7, 2014 7:41 AM in response to dominic23

    Hi Dominic. The link leads to Buy MacKeeper. Does this mean there's no other way but to buy additional software in order to use my laptop smoothly??

  • by dominic23,

    dominic23 dominic23 Sep 7, 2014 8:28 AM in response to mirandian
    Level 8 (42,047 points)
    Mac OS X
    Sep 7, 2014 8:28 AM in response to mirandian

    No. Don't by MacKeeper.

     

    Force Quit .

     

    Press command + option + esc keys together at the same time. Wait.

     

    When Force Quit window appears, select the Safari if not already.

    Press Force Quit button at the bottom of the window.   Wait.

     

    Safari will quit.

     

    Relaunch Safari holding the shift key down.

  • by Linc Davis,

    Linc Davis Linc Davis Sep 7, 2014 10:16 AM in response to mirandian
    Level 10 (208,037 points)
    Applications
    Sep 7, 2014 10:16 AM in response to mirandian

    Please post a screenshot that shows what you mean. Be careful not to include any private information.

    Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

  • by PATRICKMELE,

    PATRICKMELE PATRICKMELE Sep 7, 2014 10:22 AM in response to mirandian
    Level 3 (909 points)
    Mac OS X
    Sep 7, 2014 10:22 AM in response to mirandian

    Secondly I also get this annoying video streaming alongside on youtube. Any clue how to get rid of this? Thanks. To answer your second part of your question...depending on your browser you can use Ad Guard extention or AdBlock offered in Safari, Firefox and Chrome extion tab in preferences

  • by mirandian,

    mirandian mirandian Sep 7, 2014 10:33 AM in response to Linc Davis
    Level 1 (0 points)
    Sep 7, 2014 10:33 AM in response to Linc Davis

    Hello Linc Davis. I opened my safari and opened Youtube. Immediately another tab opens up....which I posted below. I close the tab and on youtube I click on a video or try to search and when I enter....again another tab opens up. It's basically similar except that I noticed that each time the url is different. You can see below.

     

    Regarding the annoying video....it comes up after a while. I will try to take a screen shot of that too. Thanks.

     

    Screen Shot 2014-09-07 at 9.22.15 PM.png

    Screen Shot 2014-09-07 at 9.25.28 PM.png

    Screen Shot 2014-09-07 at 9.26.42 PM.png

  • by mirandian,

    mirandian mirandian Sep 7, 2014 10:37 AM in response to PATRICKMELE
    Level 1 (0 points)
    Sep 7, 2014 10:37 AM in response to PATRICKMELE

    Hello Patrickmele. Sorry I didn't quite get you. In preferences I have already checked the Pop up block thing. Let me take a screen shot of that annoying video which I can't shut if off ...only option to open the page again. This way you will understand better what I'm trying to say. Thanks for the help!

  • by Linc Davis,

    Linc Davis Linc Davis Sep 7, 2014 11:21 AM in response to mirandian
    Level 10 (208,037 points)
    Applications
    Sep 7, 2014 11:21 AM in response to mirandian

    I can't see your screenshots because the forum software is malfunctioning.

    1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

    Don't be put off merely by the seeming complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

    2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

    There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

    3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can read it yourself without disclosing the contents to me or anyone else.

    You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.

    In this case, however, there are a couple of ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone with the necessary skill can verify what it does.

    You may not be able to understand the script yourself. But variations of the script have been posted on this website thousands of times over a period of years. The site is hosted by Apple, which does not allow it to be used to distribute harmful software. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message.

    Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.

    4. Here's a summary of what you need to do, if you choose to proceed:

    ☞ Copy a line of text in this window to the Clipboard.

    ☞ Paste into the window of another application.

    ☞ Wait for the test to run. It usually takes a few minutes.

    ☞ Paste the results, which will have been copied automatically, back into a reply on this page.

    The sequence is: copy, paste, wait, paste again. You don't need to copy a second time. Details follow.

    5. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode, under the conditions in which the problem is reproduced. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

    6. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

    7. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.

    Triple-click anywhere in the line of text below on this page to select it:

    PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/libexec;clear;cd;p=(Software Hardware Memory Diagnostics Power FireWire Thunderbolt USB Fonts SerialATA 4 1000 25 5120 KiB/s 1024 85 \\b%% 20480 1 MB/s 25000 ports ' com.clark.\* \*dropbox \*GoogleDr\* \*k.AutoCAD\* \*k.Maya\* vidinst\* ' DYLD_INSERT_LIBRARIES\ DYLD_LIBRARY_PATH -86 "` route -n get default|awk '/e:/{print $2}' `" 25 N\\/A down up 102400 25600 recvfrom sendto CFBundleIdentifier 25 25 25 1000 MB com.apple.AirPortBaseStationAgent 464843899 51 5120 files );N5=${#p[@]};p[N5]=` networksetup -listnetworkserviceorder|awk ' NR>1 { sub(/^\([0-9]+\) /,"");n=$0;getline;} $NF=="'${p[26]}')" { sub(/.$/,"",$NF);print n;exit;} ' `;f=('\n%s: %s\n' '\n%s\n\n%s\n' '\nRAM details\n%s\n' %s\ %s '%s\n-\t%s\n' );S0() { echo ' { q=$NF+0;$NF="";u=$(NF-1);$(NF-1)="";gsub(/^ +| +$/,"");if(q>='${p[$1]}') printf("%s (UID %s) is using %s '${p[$2]}'",$0,u,q);} ';};s=(' /^ *$|CSConfigDot/d;s/^ */   /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/;/Shared/!s/\/Users\/[^/]+/~/g ' ' s/^ +//;/de: S|[nst]:/p;' ' {sub(/^ +/,"")};/er:/;/y:/&&$2<'${p[10]} ' 1s/://;3,6d;/[my].+:/d;s/^ {4}//;H;${ g;s/\n$//;/s: [^EO]|x([^08]|02[^F]|8[^0])/p;} ' ' 5h;6{ H;g;/P/!p;} ' ' ($1~/^Cy/&&$3>'${p[11]}')||($1~/^Cond/&&$2!~/^N/) ' ' /:$/{ N;/:.+:/d;s/ *://;b0'$'\n'' };/^ *(V.+ [0N]|Man).+ /{ s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ (\2)/;H;};$b0'$'\n'' d;:0'$'\n'' x;s/\n\n//;/Apple[ ,]|Genesy|Intel|SMSC/d;s/\n.*//;/\)$/p;' ' s/^.*C/C/;H;${ g;/No th|pms/!p;} ' '/= [^GO]/p' '{$1=""};1' ' /Of/!{ s/^.+is |\.//g;p;} ' ' $0&&!/ / { n++;print;} END { if(n<200) print "com.apple.";} ' ' $3~/[0-9]:[0-9]{2}$/ { gsub(/:[0-9:a-f]{14}/,"");} { print|"tail -n'${p[12]}'";} ' ' NR==2&&$4<='${p[13]}' { print $4;} ' ' END { $2/=256;if($2>='${p[15]}') print int($2) } ' ' NR!=13{next};{sub(/[+-]$/,"",$NF)};'"`S0 21 22`" 'NR!=2{next}'"`S0 37 17`" ' NR!=5||$8!~/[RW]/{next};{ $(NF-1)=$1;$NF=int($NF/10000000);for(i=1;i<=3;i++){$i="";$(NF-1-i)="";};};'"`S0 19 20`" 's:^:/:p' '/\.kext\/(Contents\/)?Info\.plist$/p' 's/^.{52}(.+) <.+/\1/p' ' /Launch[AD].+\.plist$/ { n++;print;} END { print "'${p[41]}'";if(n<200) print "/System/";} ' '/\.xpc\/(Contents\/)?Info\.plist$/p' ' NR>1&&!/0x|\.[0-9]+$|com\.apple\.launchctl\.(Aqua|Background|System)$|'${p[41]}'/ { print $3;} ' ' /\.(framew|lproj)|\):/d;/plist:|:.+(Mach|scrip)/s/:[^:]+//p ' '/^root$/p' ' !/\/Contents\/.+\/Contents|Applic|Autom|Frameworks/&&/Lib.+\/Info.plist$/ { n++;print;} END { if(n<1100) print "/System/";} ' '/^\/usr\/lib\/.+dylib$/p' ' /Temp|emac/{next};/(etc|Preferences|Launch[AD].+)\// { sub(".(/private)?","");n++;print;} END { print "'${p[41]}'.plist\t'${p[42]}'";if(n<500) print "Launch";} ' ' /\/(Contents\/.+\/Contents|Frameworks)\/|\.wdgt\/.+\.([bw]|plu)/d;p;' 's/\/(Contents\/)?Info.plist$//;p' ' { gsub("^| |\n","\\|\\|kMDItem'${p[35]}'=");sub("^...."," ") };1 ' p '{print $3"\t"$1}' 's/\'$'\t''.+//p' 's/1/On/p' '/Prox.+: [^0]/p' '$2>'${p[43]}'{$2=$2-1;print}' ' BEGIN { i="'${p[26]}'";M1='${p[16]}';M2='${p[18]}';M3='${p[31]}';M4='${p[32]}';} !/^A/{next};/%/ { getline;if($5<M1) a="user "$2"%, system "$4"%";} /disk0/&&$4>M2 { b=$3" ops/s, "$4" blocks/s";} $2==i { if(c) { d=$3+$4+$5+$6;next;};if($4>M3||$6>M4) c=int($4/1024)" in, "int($6/1024)" out";} END { if(a) print "CPU: "a;if(b) print "I/O: "b;if(c) print "Net: "c" (KiB/s)";if(d) print "Net errors: "d" packets/s";} ' ' /r\[0\] /&&$NF!~/^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./ { print $NF;exit;} ' ' !/^T/ { printf "(static)";exit;} ' '/apsd|BKAg|OpenD/!s/:.+//p' ' (/k:/&&$3!~/(255\.){3}0/ )||(/v6:/&&$2!~/A/ ) ' ' $1~"lR"&&$2<='${p[25]}';$1~"li"&&$3!~"wpa2";' ' BEGIN { FS=":";p="uniq -c|sed -E '"'s/ +\\([0-9]+\\)\\(.+\\)/\\\2 x\\\1/;s/x1$//'"'";} { n=split($3,a,".");sub(/_2[01].+/,"",$3);print $2" "$3" "a[n]$1|p;b=b$1;} END { close(p) if(b) print("\n\t* Code injection");} ' ' NR!=4{next} {$NF/=10240} '"`S0 27 14`" ' END { if($3~/[0-9]/)print$3;} ' ' BEGIN { L='${p[36]}';} !/^[[:space:]]*(#.*)?$/ { l++;if(l<=L) f=f"\n   "$0;} END { F=FILENAME;if(!F) exit;if(!f) f="\n   [N/A]";"file -b "F|getline T;if(T!~/^(AS.+ (En.+ )?text$|(Bo|PO).+ sh.+ text ex)/) F=F" ("T")";printf("\nContents of %s\n%s\n",F,f);if(l>L) printf("\n   ...and %s more line(s)\n",l-L);} ' ' /^ +[NP].+ =/h;/^( +D.+[{]|[}])/{ g;s/.+= //p;};' 's/0/Off/p' ' END{print NR} ' ' /id: N|te: Y/{i++} END{print i} ' ' / / { print "'"${p[28]}"'";exit;};1;' '/ en/!s/\.//p' ' NR!=13{next};{sub(/[+-M]$/,"",$NF)};'"`S0 39 40`" ' $10~/\(L/&&$9!~"localhost" { sub(/.+:/,"",$9);print $1": "$9;} ' '/^ +r/s/.+"(.+)".+/\1/p' 's/(.+\.wdgt)\/(Contents\/)?Info\.plist$/\1/p' 's/^.+\/(.+)\.wdgt$/\1/p' ' /l: /{ /DVD/d;s/.+: //;b0'$'\n'' };/s: /{ /V/d;s/^ */- /;H;};$b0'$'\n'' d;:0'$'\n'' x;/APPLE [^:]+$/d;p;' ' /^find: /d;p;' "`S0 44 45`" );c1=(system_profiler pmset\ -g nvram fdesetup find syslog df vm_stat sar ps sudo\ crontab sudo\ iotop top pkgutil 'PlistBuddy 2>&1 -c "Print' whoami cksum kextstat launchctl sudo\ launchctl crontab 'sudo defaults read' stat lsbom mdfind ' for i in ${p[24]};do ${c1[18]} ${c2[27]} $i;done;' defaults\ read scutil sudo\ dtrace sudo\ profiles sed\ -En awk /S*/*/P*/*/*/C*/*/airport networksetup mdutil sudo\ lsof test );c2=(com.apple.loginwindow\ LoginHook '" /L*/P*/loginw*' '" L*/P*/*loginit*' 'L*/Ca*/com.ap*.Saf*/E*/* -d 1 -name In*t -exec '"${c1[14]}"' :CFBundleDisplayName" {} \;|sort|uniq' '~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \)' '.??* -path .Trash -prune -o -type d -name *.app -print -prune' :${p[35]}\" :Label\" '{/,}L*/{Con,Pref}* -type f ! -size 0 -name *.plist -exec plutil -s {} \;' "-f'%N: %l' Desktop L*/Keyc*" therm sysload boot-args status " -F '\$Time \$Message' -k Sender kernel -k Message Req 'bad |Beac|caug|dead[^bl]|FAIL|fail|GPU |hfs: Ru|inval|jnl:|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|tim(ed? ?|ing )o|WARN' -k Message Rne 'Goog|ksadm|SMC:| VALI|xpma' -o -k Sender fseventsd -k Message Req 'SL' " '-du -n DEV -n EDEV 1 10' 'acrx -o comm,ruid,%cpu' '-t1 10 1' '-f -pfc /var/db/r*/com.apple.*.{BS,Bas,Es,J,OSXU,Rem,up}*.bom' '{/,}L*/Lo*/Diag* -type f -regex .\*[cgh] ! -name *ag \( -exec grep -lq "^Thread c" {} \; -exec printf \* \; -o -true \) -execdir stat -f:%Sc:%N -t%F {} \;|sort -t: -k2 |tail -n'${p[38]} '-L {/{S*/,},}L*/Lau* -type f' '-L /{S*/,}L*/StartupItems -type f -exec file {} +' '-L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Ca*/*/Ex,Co{mpon,reM},Ex,Inter,iTu*/*P,Keyb,Mail/B,Pr*P,Qu*T,Scripti,Sec,Servi,Spo,Widg}* -path \\*s/Resources -prune -o -type f -name Info.plist' '/usr/lib -type f -name *.dylib' `awk "${s[31]}"<<<${p[23]}` "/e*/{auto,{cron,fs}tab,hosts,{[lp],sy}*.conf,pam.d/*,ssh{,d}_config,*.local} {,/usr/local}/etc/periodic/*/* /L*/P*{,/*}/com.a*.{Bo,sec*.ap}*t /S*/L*/Lau*/*t .launchd.conf" list getenv /Library/Preferences/com.apple.alf\ globalstate --proxy '-n get default' -I --dns -getdnsservers\ "${p[N5]}" -getinfo\ "${p[N5]}" -P -m\ / '' -n1 '-R -l1 -n1 -o prt -stats command,uid,prt' '--regexp --only-files --files com.apple.pkg.*|sort|uniq' -kl -l -s\ / '-R -l1 -n1 -o mem -stats command,uid,mem' '+c0 -i4TCP:0-1023' com.apple.dashboard\ layer-gadgets '-d /L*/Mana*/$USER&&echo On' '-app Safari WebKitDNSPrefetchingEnabled' "+c0 -l|awk '{print(\$1,\$3)}'|sort|uniq -c|sort -n|tail -1|awk '{print(\$2,\$3,\$1)}'" );N1=${#c2[@]};for j in {0..9};do c2[N1+j]=SP${p[j]}DataType;done;N2=${#c2[@]};for j in 0 1;do c2[N2+j]="-n ' syscall::'${p[33+j]}':return { @out[execname,uid]=sum(arg0) } tick-10sec { trunc(@out,1);exit(0);} '";done;l=(Restricted\ files Hidden\ apps 'Elapsed time (s)' POST Battery Safari\ extensions Bad\ plists 'High file counts' User Heat System\ load boot\ args FileVault Diagnostic\ reports Log 'Free space (MiB)' 'Swap (MiB)' Activity 'CPU per process' Login\ hook 'I/O per process' Mach\ ports kexts Daemons Agents launchd Startup\ items Admin\ access Root\ access Bundles dylibs Apps Font\ issues Inserted\ dylibs Firewall Proxies DNS TCP/IP Wi-Fi Profiles Root\ crontab User\ crontab 'Global login items' 'User login items' Spotlight Memory Listeners Widgets Parental\ Controls Prefetching SATA Descriptors );N3=${#l[@]};for i in 0 1 2;do l[N3+i]=${p[5+i]};done;N4=${#l[@]};for j in 0 1;do l[N4+j]="Current ${p[29+j]}stream data";done;A0() { id -G|grep -qw 80;v[1]=$?;((v[1]==0))&&sudo true;v[2]=$?;v[3]=`date +%s`;clear >&-;date '+Start time: %T %D%n';};for i in 0 1;do eval ' A'$((1+i))'() { v=` eval "${c1[$1]} ${c2[$2]}"|'${c1[30+i]}' "${s[$3]}" `;[[ "$v" ]];};A'$((3+i))'() { v=` while read i;do [[ "$i" ]]&&eval "${c1[$1]} ${c2[$2]}" \"$i\"|'${c1[30+i]}' "${s[$3]}";done<<<"${v[$4]}" `;[[ "$v" ]];};A'$((5+i))'() { v=` while read i;do '${c1[30+i]}' "${s[$1]}" "$i";done<<<"${v[$2]}" `;[[ "$v" ]];};';done;A7(){ v=$((`date +%s`-v[3]));};B2(){ v[$1]="$v";};for i in 0 1;do eval ' B'$i'() { v=;((v['$((i+1))']==0))||{ v=No;false;};};B'$((3+i))'() { v[$2]=`'${c1[30+i]}' "${s[$3]}"<<<"${v[$1]}"`;} ';done;B5(){ v[$1]="${v[$1]}"$'\n'"${v[$2]}";};B6() { v=` paste -d: <(printf "${v[$1]}") <(printf "${v[$2]}")|awk -F: ' {printf("'"${f[$3]}"'",$1,$2)} ' `;};B7(){ v=`grep -Fv "${v[$1]}"<<<"$v"`;};C0(){ [[ "$v" ]]&&echo "$v";};C1() { [[ "$v" ]]&&printf "${f[$1]}" "${l[$2]}" "$v";};C2() { v=`echo $v`;[[ "$v" != 0 ]]&&C1 0 $1;};C3() { v=`sed -E "$s"<<<"$v"`&&C1 1 $1;};for i in 1 2;do for j in 0 2 3;do eval D$i$j'(){ A'$i' $1 $2 $3; C'$j' $4;};';done;done;{ A0;D20 0 $((N1+1)) 2;D10 0 $N1 1;B0;C2 27;B0&&! B1&&C2 28;D12 15 37 25 8;A1 0 $((N1+2)) 3;C0;D13 0 $((N1+3)) 4 3;D23 0 $((N1+4)) 5 4;D13 0 $((N1+9)) 59 50;for i in 0 1 2;do D13 0 $((N1+5+i)) 6 $((N3+i));done;D13 1 10 7 9;D13 1 11 8 10;D22 2 12 9 11;D12 3 13 10 12;D23 4 19 44 13;D23 5 14 12 14;D22 6 36 13 15;D22 7 37 14 16;D23 8 15 38 17;D22 9 16 16 18;B1&&{ D22 35 49 61 51;D22 11 17 17 20;for i in 0 1;do D22 28 $((N2+i)) 45 $((N4+i));done;};D22 12 44 54 45;D22 12 39 15 21;A1 13 40 18;B2 4;B3 4 0 19;A3 14 6 32 0;B4 0 5 11;A1 17 41 20;B7 5;C3 22;B4 4 6 21;A3 14 7 32 6;B4 0 7 11;B3 4 0 22;A3 14 6 32 0;B4 0 8 11;B5 7 8;B1&&{ A2 19 26 23;B7 7;C3 23;};A2 18 26 23;B7 7;C3 24;A2 4 20 21;B7 6;B2 9;A4 14 7 52 9;B2 10;B6 9 10 4;C3 25;D13 4 21 24 26;B4 4 12 26;B3 4 13 27;A1 4 22 29;B7 12;B2 14;A4 14 6 52 14;B2 15;B6 14 15 4;B3 0 0 30;C3 29;A1 4 23 27;B7 13;C3 30;D13 24 24 32 31;D13 25 37 32 33;A2 23 18 28;B2 16;A2 16 25 33;B7 16;B3 0 0 34;B2 21;A6 47 21&&C0;B1&&{ D13 21 0 32 19;D13 10 42 32 40;D22 29 35 46 39;};D13 14 1 48 42;D12 34 43 53 44;D22 0 $((N1+8)) 51 32;D13 4 8 41 6;D12 26 28 35 34;D13 27 29 36 35;A2 27 32 39&&{ B2 19;A2 33 33 40;B2 20;B6 19 20 3;};C2 36;D23 33 34 42 37;B1&&D23 35 45 55 46;D23 32 31 43 38;D12 36 47 32 48;D13 20 42 32 41;D13 14 2 48 43;D13 4 5 32 1;D13 4 3 60 5;D12 26 48 49 49;B3 4 22 57;A1 26 46 56;B7 22;B3 0 0 58;C3 47;D22 4 4 50 0;D23 22 9 37 7;A7;C2 2;} 2>/dev/null|pbcopy;exit 2>&-

    Copy the selected text to the Clipboard by pressing the key combination command-C.

    8. Launch the built-in Terminal application in any of the following ways:

    ☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

    ☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

    ☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.

    Click anywhere in the Terminal window and paste by pressing command-V. The text you pasted should vanish immediately. If it doesn't, press the return key.

    9. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter

    exec bash

    and press return. Then paste the script again.

    10. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return  three times at the password prompt. Again, the script will still run.

    If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

    11. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line

    [Process completed]

    to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report what happened. No harm will be done.

    12. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

    At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.

    If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

    13. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "You are not authorized to post." That's a bug in the forum software. Please post the test results on Pastebin, then post a link here to the page you created.

    14. This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.

    ______________________________________________________________

    Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

  • by mirandian,

    mirandian mirandian Sep 7, 2014 11:35 AM in response to Linc Davis
    Level 1 (0 points)
    Sep 7, 2014 11:35 AM in response to Linc Davis

    Hello again Linc Davis. Thanks for the detailed reply. I will have to re-read again to fully comprehend. It's late where I am. Am off to bed now. I plan to back up my files first and then proceed with your instructions. Will get back to you. Really appreciate your help. Many thanks!

  • by mirandian,

    mirandian mirandian Sep 7, 2014 10:27 PM in response to Linc Davis
    Level 1 (0 points)
    Sep 7, 2014 10:27 PM in response to Linc Davis

    Start time: 09:17:09 09/08/14

     

     

    Model Identifier: MacBookAir6,2

    System Version: OS X 10.9.3 (13D65)

    Kernel Version: Darwin 13.2.0

    Time since boot: 1:35

     

     

    USB

     

     

      SAMSUNG_Android (Samsung Electronics Co., Ltd.)

     

     

    FileVault: On

     

     

    Log

     

     

      Sep  4 08:24:19 0        2 AppleUSBCDCACMData: start - Find CDC driver for ACM data interface failed

      Sep  4 08:24:19 0        2 AppleUSBCDCECMData: start - Find CDC driver for ECM data interface failed

      Sep  4 08:44:54 wl0: Beacon Loss Event

      Sep  4 08:45:53 ARPT: 1296.921276: MacAuthEvent en0  Auth result for: d8 Auth request tx failed

      Sep  4 08:46:03 wl0: Roamed or switched channel, reason #4, bssid d8

      Sep  4 13:52:29 process PluginProcess[697] caught causing excessive wakeups. Observed wakeups rate (per sec): 213; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 1170934

      Sep  4 14:25:08 process PluginProcess[697] caught causing excessive wakeups. Observed wakeups rate (per sec): 210; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 1581245

      Sep  4 16:41:57 process PluginProcess[697] caught causing excessive wakeups. Observed wakeups rate (per sec): 152; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 2935967

      Sep  4 17:38:41 process PluginProcess[697] caught causing excessive wakeups. Observed wakeups rate (per sec): 153; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 3539409

      Sep  4 18:08:06 wl0: Beacon Loss Event

      Sep  4 18:09:05 wl0: Roamed or switched channel, reason #4, bssid d8

      Sep  5 19:48:49 process iSkysoft Video C[2734] thread 383221 caught burning CPU!; EXC_RESOURCE supressed due to audio playback

      Sep  6 08:00:56 SATA WARNING: IDENTIFY DEVICE checksum not implemented.

      Sep  6 08:26:40 process com.apple.WebKit[301] caught causing excessive wakeups. Observed wakeups rate (per sec): 169; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 88447

      Sep  7 08:38:04 SATA WARNING: IDENTIFY DEVICE checksum not implemented.

      Sep  7 08:59:33 wl0: Beacon Loss Event

      Sep  7 09:00:52 wl0: Roamed or switched channel, reason #4, bssid d8

      Sep  7 11:34:11 SATA WARNING: IDENTIFY DEVICE checksum not implemented.

      Sep  7 15:22:45 SATA WARNING: IDENTIFY DEVICE checksum not implemented.

      Sep  7 18:19:23 wl0: Beacon Loss Event

      Sep  7 18:20:12 wl0: Roamed or switched channel, reason #4, bssid d8

      Sep  7 18:36:56 wl0: Roamed or switched channel, reason #8, bssid d8

      Sep  7 21:09:13 process PluginProcess[1076] caught causing excessive wakeups. Observed wakeups rate (per sec): 200; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 761516

      Sep  7 21:23:29 process com.apple.WebKit[1174] thread 92151 caught burning CPU! It used more than 50% CPU (Actual recent usage: 61%) over 180 seconds. thread lifetime cpu usage 90.081310 seconds, (88.777382 user, 1.303928 system) ledger info: balance: 90004826395 credit: 90004826395 debit: 0 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 145324759954

      Sep  8 07:42:12 SATA WARNING: IDENTIFY DEVICE checksum not implemented.

     

     

    Daemons

     

     

      com.zeobit.MacKeeper.plugin.AntiTheft.daemon

      com.vsearch.helper

      com.torch.update.agent

      com.oracle.java.Helper-Tool

      com.microsoft.office.licensing.helper

      com.adobe.fpsaud

     

     

    Agents

     

     

      com.vsearch.agent

      com.oracle.java.Java-Updater

      com.zeobit.MacKeeper.Helper

      com.citrixonline.GoToMeeting.G2MUpdate

      com.BlueStacks.AppPlayer.UpdaterAgent

      com.BlueStacks.AppPlayer.UninstallAgent

      com.BlueStacks.AppPlayer.Service

      com.BlueStacks.AppPlayer.LogRotator

     

     

    launchd

     

     

      /Library/LaunchAgents/com.oracle.java.Java-Updater.plist

      - com.oracle.java.Java-Updater

      /Library/LaunchAgents/com.vsearch.agent.plist

      - com.vsearch.agent

      /Library/LaunchDaemons/com.adobe.fpsaud.plist

      - com.adobe.fpsaud

      /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

      - com.microsoft.office.licensing.helper

      /Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist

      - com.oracle.java.Helper-Tool

      /Library/LaunchDaemons/com.torch.update.agent.plist

      - com.torch.update.agent

      /Library/LaunchDaemons/com.vsearch.daemon.plist

      - com.vsearch.daemon

      /Library/LaunchDaemons/com.vsearch.helper.plist

      - com.vsearch.helper

      /Library/LaunchDaemons/com.zeobit.MacKeeper.plugin.AntiTheft.daemon.plist

      - com.zeobit.MacKeeper.plugin.AntiTheft.daemon

      Library/LaunchAgents/com.BlueStacks.AppPlayer.LogRotator.plist

      - com.BlueStacks.AppPlayer.LogRotator

      Library/LaunchAgents/com.BlueStacks.AppPlayer.Service.plist

      - com.BlueStacks.AppPlayer.Service

      Library/LaunchAgents/com.BlueStacks.AppPlayer.UninstallAgent.plist

      - com.BlueStacks.AppPlayer.UninstallAgent

      Library/LaunchAgents/com.BlueStacks.AppPlayer.UpdaterAgent.plist

      - com.BlueStacks.AppPlayer.UpdaterAgent

      Library/LaunchAgents/com.citrixonline.GoToMeeting.G2MUpdate.plist

      - com.citrixonline.GoToMeeting.G2MUpdate

      Library/LaunchAgents/com.zeobit.MacKeeper.Helper.plist

      - com.zeobit.MacKeeper.Helper

     

     

    Startup items

     

     

      /Library/StartupItems/HWNetMgr/HWNetCfg

      /Library/StartupItems/HWNetMgr/HWNetMgr

      /Library/StartupItems/HWNetMgr/StartupParameters.plist

      /Library/StartupItems/HWPortDetect/HWPortCfg

      /Library/StartupItems/HWPortDetect/HWPortDetect

      /Library/StartupItems/HWPortDetect/StartupParameters.plist

     

     

    Bundles

     

     

      /Library/Audio/Plug-Ins/Components/Flip4Mac WMA Import.component

      - net.telestream.wmv.import

      /Library/Internet Plug-Ins/EPPEX Plugin.plugin

      - N/A

      /Library/Internet Plug-Ins/Flash Player.plugin

      - N/A

      /Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin

      - net.telestream.wmv.plugin

      /Library/Internet Plug-Ins/JavaAppletPlugin.plugin

      - com.oracle.java.JavaAppletPlugin

      /Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin

      - com.microsoft.sharepoint.browserplugin

      /Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin

      - com.microsoft.sharepoint.webkitplugin

      /Library/PreferencePanes/Flash Player.prefPane

      - com.adobe.flashplayerpreferences

      /Library/PreferencePanes/Flip4Mac WMV.prefPane

      - net.telestream.wmv.prefpane

      /Library/PreferencePanes/JavaControlPanel.prefPane

      - com.oracle.java.JavaControlPanel

      /Library/QuickTime/Flip4Mac WMV Advanced.component

      - net.telestream.wmv.advanced

      /Library/QuickTime/Flip4Mac WMV Export.component

      - net.telestream.wmv.export

      /Library/QuickTime/Flip4Mac WMV Import.component

      - net.telestream.wmv.import

      Library/Address Book Plug-Ins/SkypeABDialer.bundle

      - com.skype.skypeabdialer

      Library/Address Book Plug-Ins/SkypeABSMS.bundle

      - com.skype.skypeabsms

      Library/Internet Plug-Ins/CitrixOnlineWebDeploymentPlugin.plugin

      - com.citrixonline.mac.WebDeploymentPlugin

      Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin

      - com.conduit.ConduitNPAPIPlugin

      Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin

      - com.Google.GoogleEarthPlugin.plugin

     

     

    Apps

     

     

      /Applications/Dropbox.app

     

     

    Font issues: 37

     

     

    Firewall: On

     

     

    Restricted files: 207

     

     

    Elapsed time (s): 160

  • by Linc Davis,Helpful

    Linc Davis Linc Davis Sep 7, 2014 10:35 PM in response to mirandian
    Level 10 (208,037 points)
    Applications
    Sep 7, 2014 10:35 PM in response to mirandian

    A.

    You installed the "VSearch" trojan, perhaps under a different name. Remove it as follows.

    Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.

    Back up all data before proceeding.

    Triple-click anywhere in the line below on this page to select it:

    /Library/LaunchAgents/com.vsearch.agent.plist

    Right-click or control-click the line and select

              Services Reveal in Finder (or just Reveal)

    from the contextual menu.* A folder should open with an item named "com.vsearch.agent.plist" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.

    Repeat with each of these lines:

    /Library/LaunchDaemons/com.vsearch.daemon.plist
    /Library/LaunchDaemons/com.vsearch.helper.plist
    /Library/LaunchDaemons/Jack.plist

    Restart the computer and empty the Trash. Then delete the following items in the same way:

    /Library/Application Support/VSearch
    /Library/PrivilegedHelperTools/Jack
    /System/Library/Frameworks/VSearch.framework
    ~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin

    Some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

    From the Safari menu bar, select

              Safari Preferences... Extensions

    Uninstall any extensions you don't know you need, including any that have the word "Spigot," "Trovi," or "Conduit" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

    Reset the home page and default search engine in all the browsers, if it was changed.

    This trojan is distributed on illegal websites that traffic in pirated content. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.

    You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that this Internet criminal has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.

    *If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination  command-C. In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

    B.

    Remove "MacKeeper" as follows. First, back up all data.

    "MacKeeper" is a scam with only one useful feature: it deletes itself.

    Note: These instructions apply to the version of the product that I downloaded and tested in early 2012. I can't be sure that they apply to other versions.

    If you have incompletely removed MacKeeper—for example, by dragging the application to the Trash and emptying—then you'll have to reinstall it and start over.

    IMPORTANT: "MacKeeper" has what the developer calls an “encryption” feature. In my tests, I didn't try to verify what this feature really does. If you used it to “encrypt” any of your files, “decrypt” them before you uninstall, or (preferably) restore the files from backups made before they were “encrypted.” As the developer is not trustworthy, you should assume that the "decrypted" files are corrupt unless proven otherwise.

    In the Finder, select

              Go Applications

    from the menu bar, or press the key combination shift-command-A. The "MacKeeper" application is in the folder that opens. Quit it if it's running, then drag it to the Trash. You'll be prompted for your login password. Click the Uninstall MacKeeper button in the dialog that appears. All the functional components of the software will be deleted. Restart the computer.

    Quit MacKeeper before dragging it to the Trash.

    Don't empty the Trash. Let MacKeeper delete itself.

    Don't try to drag the MacKeeper Dock icon to the Trash.

  • by mirandian,

    mirandian mirandian Sep 7, 2014 11:19 PM in response to Linc Davis
    Level 1 (0 points)
    Sep 7, 2014 11:19 PM in response to Linc Davis

    Hello Linc Davis. Thank you so much for your help. Your instructions are so clear...appreciate that as I'm not at all tech savvy! I have deleted all as per your mail. Re-started my laptop. However I see that the MacKeeper is still sitting in my trash! What should I do? You wrote that MacKeeper deletes itself. How long should I wait before I start worrying if it continues sitting in my trash?

     

    Will report back to you by end of the day if I'm still facing these issues which I stated in the beginning.

     

    Thank you once again, Linc Davis for taking your time out for me. I really appreciate your help!

  • by Linc Davis,

    Linc Davis Linc Davis Sep 7, 2014 11:28 PM in response to mirandian
    Level 10 (208,037 points)
    Applications
    Sep 7, 2014 11:28 PM in response to mirandian

    Were you prompted to delete the other components of MacKeeper, and did you confirm? If so, you can empty the Trash.

  • by mirandian,

    mirandian mirandian Sep 7, 2014 11:45 PM in response to mirandian
    Level 1 (0 points)
    Sep 7, 2014 11:45 PM in response to mirandian

    No, I don't think so. I just clicked on the uninstall MacKeeper. It went to the trash. I looked again to see if it had disappeared/deleted from there. It didn't. I re-started my laptop. MacKeeper was still in the trash...it still is as I write this. That's why I asked for how long before I start worrying about it. Do you think I can just delete it now? I await your advice. Thanks!

Page 1 Next