Q: In EtreCheck, got rid of these items but they still show up???

Helpful Links Regarding Malware Problems

If you are having an immediate problem with ads popping up see The Safe Mac » Adware Removal Guide, AdwareMedic, or Remove unwanted adware that displays pop-up ads and graphics on your Mac - Apple Support.

Open Safari, select Preferences from the Safari menu. Click on Extensions icon in the toolbar. Disable all Extensions. If this stops your problem, then re-enable them one by one until the problem returns. Now remove that extension as it is causing the problem.

The following comes from user stevejobsfan0123. I have made minor changes to adapt to this presentation.

Fix Some Browser Pop-ups That Take Over Safari.

 

Common pop-ups include a message saying the government has seized your computer and you must pay to have it released (often called "Moneypak"), or a phony message saying that your computer has been infected, and you need to call a tech support number (sometimes claiming to be Apple) to get it resolved. First, understand that these pop-ups are not caused by a virus and your computer has not been affected. This "hijack" is limited to your web browser. Also understand that these messages are scams, so do not pay any money, call the listed number, or provide any personal information. This article will outline the solution to dismiss the pop-up.

 

Quit Safari

 

Usually, these pop-ups will not go away by either clicking "OK" or "Cancel." Furthermore, several menus in the menu bar may become disabled and show in gray, including the option to quit Safari. You will likely have to force quit Safari. To do this, press Command + option + esc, select Safari, and press Force Quit.

 

Relaunch Safari

 

If you relaunch Safari, the page will reopen. To prevent this from happening, hold down the 'Shift' key while opening Safari. This will prevent windows from the last time Safari was running from reopening.

 

This will not work in all cases. The shift key must be held at the right time, and in some cases, even if done correctly, the window reappears. In these circumstances, after force quitting Safari, turn off Wi-Fi or disconnect Ethernet, depending on how you connect to the Internet. Then relaunch Safari normally. It will try to reload the malicious webpage, but without a connection, it won't be able to. Navigate away from that page by entering a different URL, i.e. www.apple.com, and trying to load it. Now you can reconnect to the Internet, and the page you entered will appear rather than the malicious one.

I have to assume that EtreChecks term '[Cached]' means exactly that - Safari will keep extensions in memory, so removing the extensions will not purge the memory. Have you quit Safari since removing the extensions?

A reboot should make doubly sure nothing is still cached, see if it updates in the report.

Apologies, just re-read & saw the note about your reboot Bostonfan49.

They look as though they are in cache files. Check the Cache folders in both the Home/Library and Library folders. They may also be in the /Home/Library/Containers/ or the /Library/Containers folder.

The "etrecheck" output is wrong. Ignore it.

EtreCheck will report that an extension removed in any way other than through Safari itself is still present, as it will look at Safari's cache and see the cached extension there. The extension is no longer installed, and the fact that the data is still in the cache is not an issue. If you wish to remove that data from the cache, just clear Safari's caches. In Safari 8, this is done by choosing Clear History and Website Data from the Safari menu.

Linc has declared that Etrecheck is wrong.

Kappy wrote:

 

Linc has declared that Etrecheck is wrong.

Is Linc not a fan of etrecheck?

Pete

Linc is not a fan of almost anything Linc hasn't come up with himself. But he is no fan of EtreSoft's owner.

Bostonfan49 wrote:

 

The computer runs fine so I assume that even though EtreCheck finds them...they are really gone or not relevant.....

Yup, they're definitely gone. The stuff in the cache isn't active.