Adwaremedic is it safe ? - Apple Community

Level 10

209,649 points

Jul 24, 2015 4:32 PM in response to Linc Davis

Apple doesn't endorse any third-party "anti-virus" or "anti-malware" product. Here and here are its general statements about malware protection, and here are its instructions for removing the most common types of ad-injection malware. None of those support pages mentions "anti-malware" products.

No software is going to save you from the consequences of unsafe online behavior. Caution is the only reliable defense against malware attack.

You should not, of course, rely only on my opinion.

Reply

thomas_r.

Level 7

32,001 points

Jul 24, 2015 8:13 AM in response to Linc Davis

Linc, you're taking my words out of context and trying to make them say what you want them to say. Those are all old quotes, applying to specific things, all pulled from posts long before Malwarebytes Anti-Malware for Mac even existed. If you were even-handed with your searches, you would also be able to find cases where I have recommended anti-virus software, based on the specific situation, the anti-virus software in question and the malware climate at the time.

Further, I know you're already perfectly aware of this. We have had disagreements before when, due to the malware climate and anti-virus software available at the time, I did recommend that people use anti-virus software. I find it difficult to believe that you don't recall those numerous events, which means you are knowingly misrepresenting my beliefs.

The question of whether or not to use of anti-virus software is a controversial topic, and one that cannot ever have a definitive answer. All answers MUST depend on what the current malware threats are and what the characteristics of currently available anti-virus software are. At times, I have certainly recommended against anti-virus software, and at times I have recommended the use of some specific anti-virus programs.

Since the current climate mostly only includes the threat of adware, I currently recommend the use of tools that are good at detecting and removing adware. And I don't believe it to be an exaggeration at all to say that my own software, formerly AdwareMedic and now Malwarebytes Anti-Malware for Mac, is the only truly effective tool that is available in that arena.

Reply

Jul 24, 2015 11:26 AM in response to jonsmith77

post.user_wrote.label:

I was Just online using google chrome, looking for a baby accessory, clicked on a link and now I cannot access the internet via google chrome browser.

Every time you refresh or use another tab, or type an address in the tool bar, a blue page loads up with a square sad face and this sentence:-

"Aw Snap ... something went wrong while displaying this webpage, To continue reload or go to another page. If your seeing this frequently try these suggestions"

This sounds as though you are having a problem with Flash. That's the message I get in Firefox when something has gone awry with Adobe Flash Player in Firefox.

Have you tried quitting Google Chrome and relaunching it?

Reply

Aug 15, 2015 3:48 PM in response to AggelakasK

Start time: 17:37:32 08/15/15

Model Identifier: MacBookPro9,2

System Version: OS X 10.10.2 (14C109)

Kernel Version: Darwin 14.1.0

Time since boot: 51 days 4:25

Log

Aug 14 20:48:26 Sound assertion in AppleHDAFunctionGroup at line 1058

Daemons

com.apple.installer.osmessagetracing

com.microsoft.office.licensing.helper

Agents

com.spotify.webhelper

com.google.keystone.user.agent

com.apple.AirPortBaseStationAgent

Bundles

/System/Library/Extensions/JMicronATA.kext

- com.jmicron.JMicronATA

/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin

- com.microsoft.sharepoint.browserplugin

/Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin

- com.microsoft.sharepoint.webkitplugin

Contents of Library/LaunchAgents/com.google.keystone.agent.plist (checksum 3591276108)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.google.keystone.user.agent</string>

<key>LimitLoadToSessionType</key>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bu ndle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftw areUpdateAgent</string>

<string>-runMode</string>

<string>ifneeded</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

<key>StandardErrorPath</key>

<key>StandardOutPath</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.spotify.webhelper.plist (checksum 1352708308)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.spotify.webhelper</string>

<key>KeepAlive</key>

<dict>

<key>NetworkState</key>

<true/>

</dict>

<key>RunAtLoad</key>

<true/>

<key>Program</key>

<string>/Users/USER/Library/Application Support/Spotify/SpotifyWebHelper</string>

<key>SpotifyPath</key>

<string>/Applications/Spotify.app</string></dict>

</plist>

Listeners

cupsd: ipp

User login items

iTunesHelper

- /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

Google Chrome

- /Applications/Google Chrome.app

Spotify

- /Applications/Spotify.app

Restricted files: 80

Lockfiles: 6

Elapsed time (s): 289

Reply

Aug 25, 2015 7:01 AM in response to AggelakasK

Start time: 06:52:51 08/25/15

Model Identifier: MacBookPro9,1

System Version: OS X 10.8.5 (12F45)

Kernel Version: Darwin 12.5.0

Time since boot: 6 days 3:58

SATA

TOSHIBA MK5065GSXF

SMC

command not found

Diagnostic reports

2015-08-18 Creative Cloud crash

2015-08-20 Adobe Desktop Service crash

2015-08-25 plugin-container crash

Log

Aug 25 06:45:10 1440510310: firefox (map: 0xffffff8046d04d00) triggered DYLD shared region unnest for map: 0xffffff8046d04d00, region 0x7fff85c00000->0x7fff85e00000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Aug 25 06:45:24 1440510324: Disabled automatic stack shots because audio IO is active

Aug 25 06:45:55 1440510355: Enabled automatic stack shots because audio IO is inactive

Aug 25 06:45:55 1440510355: Disabled automatic stack shots because audio IO is active

Aug 25 06:46:11 1440510371: Enabled automatic stack shots because audio IO is inactive

Aug 25 06:46:11 1440510371: Disabled automatic stack shots because audio IO is active

Aug 25 06:46:12 1440510372: Enabled automatic stack shots because audio IO is inactive

Aug 25 06:47:37 1440510457: CGContextGetCTM: invalid context 0x0

Aug 25 06:47:37 1440510457: CGContextGetDefaultUserSpaceToDeviceSpaceTransform: invalid context 0x0

Aug 25 06:47:37 1440510457: CGContextGetCTM: invalid context 0x0

Aug 25 06:47:37 1440510457: CGContextGetDefaultUserSpaceToDeviceSpaceTransform: invalid context 0x0

Aug 25 06:49:21 1440510561: Disabled automatic stack shots because audio IO is active

Aug 25 06:49:32 1440510572: Enabled automatic stack shots because audio IO is inactive

Aug 25 06:50:26 1440510626: Launched to submit Diagnostics and Usage

Aug 25 06:50:30 1440510630: Submitted crash report: file://localhost/Users/USER/Library/Logs/DiagnosticReports/plugin-container_201 5-08-25-064246_PAULs-MacBook-Pro.crash

Aug 25 06:50:31 1440510631: SubmitDiagInfo successfully uploaded 172 diagnostic messages.

Aug 25 06:51:11 1440510671: Unable to talk to lsboxd

Aug 25 06:51:50 1440510710: [ERROR] [0.000s] com.apple. UBItemStatusNotification.c:805 _do_UBItemStatusNotificationRegisterURLs() can't find realpath for "/Users/USER/Library/Mobile Documents/com~apple~system~spotlight/mdlabels", was blocked at "/Users/USER/Library/Mobile Documents": 2 (No such file or directory)

Aug 25 06:51:50 1440510710: [ERROR] [0.001s] com.apple. UBItemStatusNotification.c:805 _do_UBItemStatusNotificationRegisterURLs() can't find realpath for "/Users/USER/Library/Mobile Documents/com~apple~system~spotlight/mdlabels", was blocked at "/Users/USER/Library/Mobile Documents": 2 (No such file or directory)

Aug 25 06:51:52 1440510712: CGXDisableUpdate: UI updates were forcibly disabled by application "Finder" for over 1.00 seconds. Server has re-enabled them.

Aug 25 06:51:52 1440510712: reenable_update_for_connection: UI updates were finally reenabled by application "Finder" after 1.09 seconds (server forcibly re-enabled them after 1.00 seconds)

Aug 25 06:51:56 1440510716: CGXDisableUpdate: UI updates were forcibly disabled by application "Finder" for over 1.00 seconds. Server has re-enabled them.

Aug 25 06:51:57 1440510717: reenable_update_for_connection: UI updates were finally reenabled by application "Finder" after 2.56 seconds (server forcibly re-enabled them after 1.00 seconds)

Aug 25 06:52:04 1440510724: USER_PROCESS: 4215 ttys000

Aug 25 06:52:51 1440510771: PaulArgy TTY=ttys000 ; PWD=/Users/USER ; USER=root ; COMMAND=/usr/bin/true

Current downstream data: firefox (UID 501) is using 29.3865 KiB/s

kexts

com.paceap.kext.pacesupport.snowleopard (5.7.2b8)

Daemons

com.applian.JakstaConfigDaemon

com.apple.xprotectupdater

com.paceap.pacesupport

com.paceap.eden.licensed

com.oracle.java.JavaUpdateHelper

com.oracle.java.Helper-Tool

com.avid.AMCUninstaller

com.adobe.SwitchBoard

com.adobe.fpsaud

Agents

com.apple.AirPortBaseStationAgent

com.oracle.java.Java-Updater

com.adobe.AdobeCreativeCloud

com.redgiantsoftware.updater.plist

com.jdibackup.ZipCloud.autostart

com.google.keystone.user.agent

com.adobe.ARM.UUID

Startup items

/Library/StartupItems/PACESupport/PACESupport

/Library/StartupItems/PACESupport/Resources/PACESupport.plist

/Library/StartupItems/PACESupport/StartupParameters.plist

Bundles

/Library/Internet Plug-Ins/AdobeAAMDetect.plugin

- com.AdobeAAMDetectLib.AdobeAAMDetect

/Library/Internet Plug-Ins/AdobePDFViewer.plugin

- com.adobe.acrobat.pdfviewer

/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin

- com.adobe.acrobat.pdfviewerNPAPI

/Library/Internet Plug-Ins/Flash Player.plugin

- N/A

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin

- com.oracle.java.JavaAppletPlugin

/Library/Internet Plug-Ins/Silverlight.plugin

- com.microsoft.SilverlightPlugin

/Library/PreferencePanes/Flash Player.prefPane

- com.adobe.flashplayerpreferences

/Library/PreferencePanes/JavaControlPanel.prefPane

- com.oracle.java.JavaControlPanel

/Library/QuickTime/AvidAV1xCodec.component

- com.avid.qtcodecs.AvidAV1xCodec

/Library/QuickTime/AvidAVd1Codec.component

- com.avid.qtcodecs.AvidAVd1Codec

/Library/QuickTime/AvidAVDJCodec.component

- com.avid.qtcodecs.AvidAVDJCodec

/Library/QuickTime/AvidAVdnCodec.component

- com.avid.qtcodecs.AvidAVdnCodec

/Library/QuickTime/AvidAVdnCodec.component._intel_

- com.avid.qtcodecs.AvidAVdnCodec

/Library/QuickTime/AvidAVdnCodec.component._ppc_

- com.avid.qtcodecs.AvidAVdnCodec

/Library/QuickTime/AvidAVdvCodec.component

- com.avid.qtcodecs.AvidAVdvCodec

/Library/QuickTime/AvidAVinCodec.component

- com.avid.qtcodecs.AvidAVinCodec

/Library/QuickTime/AvidAVmpCodec.component

- com.avid.qtcodecs.AvidAVmpCodec

/Library/QuickTime/AvidAVpkCodec.component

- com.avid.qtcodecs.AvidAVpkCodec

/Library/QuickTime/AvidAVrpCodec.component

- com.avid.qtcodecs.AvidAVrpCodec

/Library/QuickTime/AvidAVUICodec.component

- com.avid.qtcodecs.AvidAVUICodec

/Library/QuickTime/XFMpeg2Dec.component

- com.canon.XFUtility.XFMpeg2DecComponent

/Library/ScriptingAdditions/Adobe Unit Types.osax

- N/A

Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin

- com.Google.GoogleEarthPlugin.plugin

dylibs

/usr/lib/libiomp5.dylib

/usr/lib/libwx_macud-2.8.0.5.0.dylib

Apps

/Applications/Dropbox.app

Contents of /etc/hosts (checksum 2413627585)

127.0.0.1 localhost

255.255.255.255 broadcasthost

::1 localhost

fe80::1%lo0 localhost

127.0.0.1 www.genarts.com

Contents of /Library/Preferences/SystemConfiguration/com.apple.Boot.plist (checksum 589953702)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Kernel Architecture</key>

</dict>

</plist>

Contents of /System/Library/LaunchDaemons/com.apple.xprotectupdater.plist (checksum 3600585559)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.apple.xprotectupdater</string>

<key>ProgramArguments</key>

<array>

<string>/usr/libexec/XProtectUpdater</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartCalendarInterval</key>

<dict>

<key>Minute</key>

</dict>

</plist>

Contents of /System/Library/LaunchDaemons/com.applian.JakstaConfigDaemon.plist (checksum 325758486)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.applian.JakstaConfigDaemon</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/Jaksta.app/Contents/resources/JakstaConfigDaemon</string>

<string>/Applications/Jaksta.app/Contents/resources/jakstaRootCA.pem</string>

</array>

<key>StandardOutPath</key>

<string>/var/log/JakstaConfigDaemon.log</string>

<key>StandardErrorPath</key>

<string>/var/log/JakstaConfigDaemon.log</string>

<key>Sockets</key>

<dict>

<key>Listener</key>

<dict>

<key>SockFamily</key>

<key>SockPathMode</key>

<key>SockPathName</key>

<string>/var/run/JakstaConfigDaemon</string>

...and 8 more line(s)

Contents of /Library/LaunchAgents/com.oracle.java.Java-Updater.plist (checksum 2695884773)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.oracle.java.Java-Updater</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater</string>

<string>-bgcheck</string>

</array>

<key>StandardErrorPath</key>

<key>StandardOutPath</key>

<key>StartCalendarInterval</key>

<dict>

<key>Minute</key>

<key>Weekday</key>

</dict>

...and 1 more line(s)

Contents of /Library/LaunchDaemons/PACESupport.plist (checksum 1658798800)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN"

"http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.paceap.pacesupport</string>

<key>ProgramArguments</key>

<array>

<string>/System/Library/Extensions/PACESupportFamily.kext/Contents/Resources/pa ceload</string>

</array>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.avid.AMCUninstaller.plist (checksum 1252904978)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Disabled</key>

<true/>

<key>Label</key>

<string>com.avid.AMCUninstaller</string>

<key>OnDemand</key>

<true/>

<key>ProgramArguments</key>

<array>

<string>/Library/PrivilegedHelperTools/com.avid.AMCUninstaller</string>

</array>

<key>ServiceIPC</key>

<true/>

<key>Sockets</key>

<dict>

<key>MasterSocket</key>

<dict>

<key>SockFamily</key>

<key>SockPathMode</key>

<key>SockPathName</key>

...and 7 more line(s)

Contents of /Library/LaunchDaemons/com.paceap.eden.licensed.plist (checksum 3699316858)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.paceap.eden.licensed</string>

<key>KeepAlive</key>

<true/>

<key>RunAtLoad</key>

<true/>

<key>Program</key>

<string>/Library/PrivilegedHelperTools/licenseDaemon.app/Contents/MacOS/license Daemon</string>

<key>ProgramArguments</key>

<array>

</array>

<key>SoftResourceLimits</key>

<dict>

<key>NumberOfFiles</key>

</dict>

<key>HardResourceLimits</key>

<dict>

<key>NumberOfFiles</key>

...and 15 more line(s)

Contents of Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist (checksum 4071182229)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.adobe.AAM.Scheduler-1.0</string>

<key>Program</key>

<string>/Library/Application Support/Adobe/OOBE/PDApp/UWA/UpdaterStartupUtility</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/Adobe/OOBE/PDApp/UWA/UpdaterStartupUtility</string>

<string>-mode=scheduled</string>

</array>

<key>StartCalendarInterval</key>

<dict>

<key>Minute</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.adobe.ARM.UUID.plist (checksum 394026997)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.adobe.ARM.UUID</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/Adobe Reader.app/Contents/MacOS/Updater/Adobe Reader Updater Helper.app/Contents/MacOS/Adobe Reader Updater Helper</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.google.keystone.agent.plist (checksum 3785913352)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.google.keystone.user.agent</string>

<key>LimitLoadToSessionType</key>

<key>ProgramArguments</key>

<array>

<string>/Users/USER/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bu ndle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftw areUpdateAgent</string>

<string>-runMode</string>

<string>ifneeded</string>

</array>

<key>RunAtLoad</key>

<true/>

<key>StartInterval</key>

<key>StandardErrorPath</key>

<key>StandardOutPath</key>

</dict>

</plist>

Contents of Library/LaunchAgents/com.jdibackup.ZipCloud.autostart.plist (checksum 3797692756)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.jdibackup.ZipCloud.autostart</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/ZipCloud.app</string>

</array>

<key>StandardOutPath</key>

<string>/Applications/ZipCloud.app/Contents/Resources/lib/python2.7/logs/launch agent_out.log</string>

<key>StandardErrorPath</key>

<string>/Applications/ZipCloud.app/Contents/Resources/lib/python2.7/logs/launch agent_err.log</string>

<key>RunAtLoad</key>

<true/>

</dict>

</plist>

Contents of Library/LaunchAgents/com.redgiantsoftware.updater.plist (checksum 1639359569)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.redgiantsoftware.updater.plist</string>

<key>Program</key>

<key>ProgramArguments</key>

<array>

<string>/Applications/Red Giant Link.app</string>

<string>--silent</string>

</array>

<key>StartCalendarInterval</key>

<dict>

<key>Minute</key>

<key>Weekday</key>

</dict>

...and 1 more line(s)

Font issues: 14

Bad plists

Library/Preferences/com.BundGmbH.Offspring.plist

Library/Preferences/com.inconepartners.achlorhydria.plist

Library/Preferences/com.teridius.supratechnology.plist

Library/Preferences/com.trophtransport.listing.plist

Listeners

kdc: kerberos

launchd: afpovertcp

User login items

iTunesHelper

- /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

TuneupMyMac

- missing value

AdobeResourceSynchronizer

- /Applications/Adobe Reader.app/Contents/Support/AdobeResourceSynchronizer.app

VMware Fusion Helper

- /Applications/VMware Fusion.app/Contents/Library/VMware Fusion Helper.app

Dropbox

- /Applications/Dropbox.app

Android File Transfer Agent

- /Users/USER/Library/Application Support/Google/Android File Transfer/Android File Transfer Agent.app

MacGameStore Helper

- /Users/USER/Library/Application Support/MacGameStore.com/Helper/MacGameStore Helper.app

Restricted files: 232

Lockfiles: 13

Elapsed time (s): 283

Reply

Aug 25, 2015 7:03 AM in response to greekguy9999

This may sound like a VERY stupid question, but… how do you LEARN what all this stuff means? Is there a major in college? Is there a trade school? It really is in all senses an entirely foreign language. It's amazing people can decipher what all that stuff I just pasted means. I don't even know if I did it right or not.

Reply

Aug 25, 2015 7:06 AM in response to greekguy9999

By the way, I followed the instructions to the letter and am still getting the pop ups. So, what is the next step to getting rid of the Firefox pop ups?

Reply

Linc Davis

Level 10

209,649 points

Aug 25, 2015 8:49 AM in response to greekguy9999

A

"ZipCloud," sometimes named "JustCloud," is a cloud-storage service with a doubtful reputation. The OS X client is sometimes distributed along with malware. Although ZipCloud may not be malicious itself, it should be suspected by virtue of the company it keeps.

To remove ZipCloud, start by backing up all data (not with ZipCloud itself, of course.)

Quit the "ZipCloud" or "JustCloud" application, if it's running, and drag it from the Applications folder to the Trash. Don't try to empty yet.

Triple-click anywhere in the line below on this page to select it:

~/Library/LaunchAgents

Right-click or control-click the highlighted line and select

Services ▹ Open

from the contextual menu.* A folder named "LaunchAgents" should open.

In the folder, there may be one or more files with a name beginning as follows:

com.jdibackup.

Move all such files to the Trash.

Log out or restart the computer and empty the Trash.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

B

If Safari is not affected, you may have installed a malicious Firefox extension.

First follow the instructions on this page. If there's a Firefox extension you can't remove in the Extensions manager, see below.

Back up all data before proceeding.

Triple-click anywhere in the line below on this page to select it:

~/Library/Application Support/Mozilla

Copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

A folder should open with an item named "Mozilla" selected. Quit Firefox if it's running. Move the selected item to the Trash. Relaunch the browser and test.

If the extension is still present, repeat with this line:

/Library/Application Support/Mozilla

If this folder exists, you may be prompted for your administrator login password when making changes to it.

Some kinds of malware may insert code into the Firefox application itself. If the above steps don't solve the problem, quit Firefox, delete it from the Applications folder, and download a fresh copy directly from mozilla.org.

Reply

DocsArt

Level 1

0 points

Aug 25, 2015 8:56 AM in response to AggelakasK

Start time: 11:38:02 08/25/15

Model Identifier: iMac14,2

System Version: OS X 10.9.5 (13F1112)

Kernel Version: Darwin 13.4.0

Time since boot: 30 minutes

Root access: No

USB

BUP Slim Mac SL (Seagate LLC)

Hub (Belkin Corporation)

USB Optical Mouse (Logitech Inc.)

Log

Aug 25 11:25:45 Google Chrome He (map: 0xffffff802ee78780) triggered DYLD shared region unnest for map: 0xffffff802ee78780, region 0x7fff92000000->0x7fff92200000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Aug 25 11:25:48 Google Chrome He (map: 0xffffff80344901e0) triggered DYLD shared region unnest for map: 0xffffff80344901e0, region 0x7fff92000000->0x7fff92200000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Aug 25 11:25:49 Google Chrome He (map: 0xffffff80344900f0) triggered DYLD shared region unnest for map: 0xffffff80344900f0, region 0x7fff92000000->0x7fff92200000. While not abnormal for debuggers, this increases system memory footprint until the target exits.

Aug 25 11:27:15 disable_update_timeout: UI updates were forcibly disabled by application "Disk Inventory X" for over 1.00 seconds. Server has re-enabled them.

Aug 25 11:27:16 common_reenable_update: UI updates were finally reenabled by application "Disk Inventory X" after 2.51 seconds (server forcibly re-enabled them after 1.00 seconds)

Aug 25 11:27:45 Killing auth hosts

Aug 25 11:27:45 Session 100025 destroyed

Aug 25 11:28:26 *** WARNING: Method selectRow:byExtendingSelection: in class FilesOutlineView is deprecated. It will be removed in a future release and should no longer be used.

Aug 25 11:28:46 Will copy (1.94 GB) from Macintosh HD

Aug 25 11:28:46 Found 13269 files (1.98 GB) needing backup

Aug 25 11:28:47 3.07 GB required (including padding), 213.12 GB available

Aug 25 11:29:42 The function `CGContextClear' is obsolete and will be removed in an upcoming update. Unfortunately, this application, or a library it uses, is using this obsolete function, and is thereby contributing to an overall degradation of system performance.

Aug 25 11:29:47 CVMCompiler(521) deny mach-lookup com.apple.distributed_notifications@Uv3

Aug 25 11:31:40 mdworker(535) deny file-read-data /Applications/Utilities/Adobe Utilities-CS5.localized/.localized (pre-plugin fstype:hfs fsflag:480D000 flags:200000056 diag:0 isXCode:0 uti:public.folder plugin:internalPlainTextImporter - find suspect file using: sudo mdutil -t 928509)

Aug 25 11:32:03 An instance 0x460c20 of class MainWindowController was deallocated while key value observers were still registered with it. Observation info was leaked, and may even become mistakenly attached to some other object. Set a breakpoint on NSKVODeallocateBreak to stop here in the debugger. Here's the current observation info:

<NSKeyValueObservationInfo 0x4b7ab2e0> (

<NSKeyValueObservance 0x4b77fff0: Observer: 0x4b77dc80, Key path: document.kindStatistics, Options: <New: YES, Old: NO, Prior: NO> Context: 0x1c0a4, Property: 0x4b788970>

<NSKeyValueObservance 0x4b7ab300: Observer: 0x4b77ef90, Key path: document.kindStatistics, Options: <New: YES, Old: NO, Prior: NO> Context: 0x1c0a4, Property: 0x4b788970>

)

Aug 25 11:34:35 ReceiptInstaller(561) deny file-read-data /private/var/root/Library/Preferences/ByHost/.GlobalPreferences.UUID.plist

Aug 25 11:36:33 USER_PROCESS: 570 ttys000

Aug 25 11:38:02 doc : 3 incorrect password attempts ; TTY=ttys000 ; PWD=/Users/USER ; USER=root ; COMMAND=/usr/bin/true

Activity

Net: 3645 in, 48 out (KiB/s)

CPU per process: storeagent (UID 501) is using 30.5 %

Agents

com.apple.AirPortBaseStationAgent

com.google.keystone.system.agent

com.adobe.CS5ServiceManager

Bundles

/Library/Internet Plug-Ins/googletalkbrowserplugin.plugin

- com.google.googletalkbrowserplugin

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin

- com.apple.java.JavaAppletPlugin

/Library/Internet Plug-Ins/o1dbrowserplugin.plugin

- com.google.o1dbrowserplugin

/Library/PreferencePanes/Growl.prefPane

- com.growl.prefpanel

/Library/ScriptingAdditions/Adobe Unit Types.osax

- N/A

Library/Caches/com.apple.Safari/Extensions/Omnibar.safariextension

- com.genieo.safari

Apps

/Applications/Dropbox.app

/Applications/Google Drive.app

Contents of /etc/mach_init_per_user.d/com.adobe.SwitchBoard.monitor.plist (checksum 3469280363)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Command</key>

<string>/Library/Application\ Support/Adobe/SwitchBoard/SwitchBoard.app/Contents/MacOS/switchboard.sh</string >

<key>OnDemand</key>

<key>ServiceName</key>

<string>com.adobe.SwitchBoard.monitor</string>

</dict>

</plist>

Contents of /Library/LaunchDaemons/com.crashplan.engine.plist (checksum 3993230412)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.crashplan.engine</string>

<key>UserName</key>

<key>GroupName</key>

<string>wheel</string>

<key>KeepAlive</key>

<true/>

<key>OnDemand</key>

<key>RunAtLoad</key>

<true/>

<key>AbandonProcessGroup</key>

<true/>

<key>WorkingDirectory</key>

<string>/Applications/CrashPlan.app/Contents/Resources/Java</string>

<key>ProgramArguments</key>

<array>

<string>/Applications/CrashPlan.app/Contents/MacOS/CrashPlanService</string>

...and 25 more line(s)

Contents of /Library/LaunchDaemons/com.fitbit.galileod.plist (checksum 333804614)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Program</key>

<string>/usr/local/bin/galileod</string>

<key>ProgramArguments</key>

<array>

<string>/usr/local/bin/galileod</string>

</array>

<key>Label</key>

<string>com.fitbit.galileod</string>

<key>UserName</key>

<key>GroupName</key>

<string>daemon</string>

<key>InitGroups</key>

<true/>

<key>OnDemand</key>

<key>ServiceIPC</key>

<true/>

<key>Sockets</key>

<dict>

<key>UserClients</key>

...and 27 more line(s)

Contents of Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist (checksum 4071182229)

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Label</key>

<string>com.adobe.AAM.Scheduler-1.0</string>

<key>Program</key>

<string>/Library/Application Support/Adobe/OOBE/PDApp/UWA/UpdaterStartupUtility</string>

<key>ProgramArguments</key>

<array>

<string>/Library/Application Support/Adobe/OOBE/PDApp/UWA/UpdaterStartupUtility</string>

<string>-mode=scheduled</string>

</array>

<key>StartCalendarInterval</key>

<dict>

<key>Minute</key>

</dict>

</plist>

Font issues: 14

Wi-Fi

link auth: none

User login items

iTunesHelper

- /Applications/iTunes.app/Contents/MacOS/iTunesHelper.app

Google Drive

- /Applications/Google Drive.app

Dropbox

- /Applications/Dropbox.app

Google Chrome

- missing value

CrashPlan menu bar

- /Applications/CrashPlan.app/Contents/Helpers/CrashPlan menu bar.app

Fitbit Connect Menubar Helper

- /Applications/Fitbit Connect.app/Contents/MacOS/Fitbit Connect Menubar Helper.app

Safari extensions

Omnibar

Restricted files: 75

Lockfiles: 2

Elapsed time (s): 580

Reply

Linc Davis

Level 10

209,649 points

Aug 25, 2015 12:12 PM in response to DocsArt

Remove the malicious "Omnibar" Safari extension.

Reply

Aug 25, 2015 12:16 PM in response to Linc Davis

I am SO sorry but I did not see I was posting this in Safari. My problem lies in Firefox. Do you have any suggestions for that browser?

Reply

Linc Davis

Level 10

209,649 points

Aug 25, 2015 7:14 PM in response to greekguy9999

This thread is very long and noisy, with some posts that serve no purpose but to make it longer and noisier. I don't know whether you did as I suggested in my last comment addressed to you.

Reply

Csound1

Level 9

60,033 points

Aug 25, 2015 7:14 PM in response to Linc Davis

Has it just got longer?

Reply

Aug 25, 2015 8:25 PM in response to Linc Davis

In Safari Preferences, I have no Omnibar extension. Is there a Safari Omnibar extension in Firefox? My issue is with Firefox even though I erroneously posted in Safari.

Reply

Linc Davis

Level 10

209,649 points

Aug 25, 2015 8:56 PM in response to greekguy9999

The comment about "Omnibar" was not addressed to you. You have "ZipCloud" and possibly a malicious Firefox extension. See the first comment on this page.

Reply