Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

In EtreCheck, got rid of these items but they still show up???

So my EtreCheck shows everything as fine. Nothing outdated or flagged in Red except these supposedly Malware items. I went into Safari extensions...(Go/Library/ Safari extensions, found each of the items and deleted them. However, even after a reboot and running EtreCheck, they still show up....??? How do I get rid of them? Thanks, Bill



Safari Extensions: ℹ️

Ebay Shopping Assistant [Cached] Adware! [Remove]

Searchme [Cached] Adware! [Remove]

SlickSavings [Cached]

YoutubeWide [Cached]

Amazon Shopping Assistant [Cached] Adware! [Remove]

1-ClickWeather [Cached]

Posted on Dec 20, 2014 10:50 AM

Reply
11 replies

Dec 20, 2014 10:52 AM in response to Bostonfan49

Helpful Links Regarding Malware Problems


If you are having an immediate problem with ads popping up see The Safe Mac » Adware Removal Guide, AdwareMedic, or Remove unwanted adware that displays pop-up ads and graphics on your Mac - Apple Support.


Open Safari, select Preferences from the Safari menu. Click on Extensions icon in the toolbar. Disable all Extensions. If this stops your problem, then re-enable them one by one until the problem returns. Now remove that extension as it is causing the problem.


The following comes from user stevejobsfan0123. I have made minor changes to adapt to this presentation.


Fix Some Browser Pop-ups That Take Over Safari.


Common pop-ups include a message saying the government has seized your computer and you must pay to have it released (often called "Moneypak"), or a phony message saying that your computer has been infected, and you need to call a tech support number (sometimes claiming to be Apple) to get it resolved. First, understand that these pop-ups are not caused by a virus and your computer has not been affected. This "hijack" is limited to your web browser. Also understand that these messages are scams, so do not pay any money, call the listed number, or provide any personal information. This article will outline the solution to dismiss the pop-up.


Quit Safari


Usually, these pop-ups will not go away by either clicking "OK" or "Cancel." Furthermore, several menus in the menu bar may become disabled and show in gray, including the option to quit Safari. You will likely have to force quit Safari. To do this, press Command + option + esc, select Safari, and press Force Quit.


Relaunch Safari


If you relaunch Safari, the page will reopen. To prevent this from happening, hold down the 'Shift' key while opening Safari. This will prevent windows from the last time Safari was running from reopening.


This will not work in all cases. The shift key must be held at the right time, and in some cases, even if done correctly, the window reappears. In these circumstances, after force quitting Safari, turn off Wi-Fi or disconnect Ethernet, depending on how you connect to the Internet. Then relaunch Safari normally. It will try to reload the malicious webpage, but without a connection, it won't be able to. Navigate away from that page by entering a different URL, i.e. www.apple.com, and trying to load it. Now you can reconnect to the Internet, and the page you entered will appear rather than the malicious one.

Dec 20, 2014 11:02 AM in response to Bostonfan49

I have to assume that EtreChecks term '[Cached]' means exactly that - Safari will keep extensions in memory, so removing the extensions will not purge the memory. Have you quit Safari since removing the extensions?


A reboot should make doubly sure nothing is still cached, see if it updates in the report.


Apologies, just re-read & saw the note about your reboot Bostonfan49.

Dec 20, 2014 11:35 AM in response to Drew Reece

So I downloaded "Adware Medic", it found nothing so I removed the program completely. I went into my Safari extensions and there is currently nothing listed and I again went to "Go/Library/Safari/Extensions......and there is nothing there! But...if I run EtreCheck, the same items in Red still show up, so I am confused as to why they still show up or have they really been removed???? Still confused but I do appreciate the help so far!!! Bill

Dec 20, 2014 1:15 PM in response to Bostonfan49

EtreCheck will report that an extension removed in any way other than through Safari itself is still present, as it will look at Safari's cache and see the cached extension there. The extension is no longer installed, and the fact that the data is still in the cache is not an issue. If you wish to remove that data from the cache, just clear Safari's caches. In Safari 8, this is done by choosing Clear History and Website Data from the Safari menu.

Dec 20, 2014 1:50 PM in response to thomas_r.

Thanks thomas_r I guess the bottom line is that the adware is removed but it still shows up in EtreCheck even after I tried the additional removal instructions/Safari caches/Safari 8. So far I have also tried every way of clearing the Safari caches/containers in both the Library and system caches and these buggers still show up???? The computer runs fine so I assume that even though EtreCheck finds them...they are really gone or not relevant.........thanks, Bill

In EtreCheck, got rid of these items but they still show up???

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.