HT201940: About the "Are you sure you want to open it?" alert (File Quarantine / Known Malware Detection) in OS X
Learn about About the "Are you sure you want to open it?" alert (File Quarantine / Known Malware Detection) in OS X
-
All replies
-
Helpful answers
-
Dec 25, 2014 10:51 AM in response to mariefromoxnardby dominic23,If you have another browser installed, use it.
If not, launch App store and get another browser for temporary use.
Remove it afterwards.
Use free AdwareMedic by clicking “Download ” from here
http://www.adwaremedic.com/index.php
Install , open, and run it by clicking “Scan for Adware” button to remove adware.
Once done, quit AdwareMedic by clicking AdwareMedic in the menu bar and selecting
“Quit AdwareMedic”.
or
Remove the adware manually by following the “HowTo” from Apple.
http://support.apple.com/en-us/HT203987
Safari > Preferences > Extensions
Turn those off and relaunch Safari to test .
Turn those on one by one and test.
Safari > Preferences > Search > Search Engine :
Select your preferred search engine.
-
Dec 25, 2014 11:02 AM in response to mariefromoxnardby ~Bee,marie --
Can you copy and then paste the report here for us to see?
-
by Linc Davis,Dec 25, 2014 2:44 PM in response to mariefromoxnard
Linc Davis
Dec 25, 2014 2:44 PM
in response to mariefromoxnard
Level 10 (207,926 points)
ApplicationsThere is no need to download anything to solve this problem.
You may have installed the "Genieo" or "InstallMac" ad-injection malware. Follow the instructions on this Apple Support page to remove it.
Back up all data before making any changes.
Besides the files listed in the linked support article, you may also need to remove this file in the same way:
~/Library/LaunchAgents/com.genieo.completer.ltvbit.plist
If there are other items with a name that includes "Genieo" or "genieo" alongside any of those you find, remove them as well.
One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those. If Safari crashes on launch, skip that step and come back to it after you've done everything else.
If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, then you may have one of the other kinds of adware covered by the support article. Follow the rest of the instructions in the article.
Make sure you don't repeat the mistake that led you to install the malware. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Still in System Preferences, open the App Store or Software Update pane and check the box markedInstall system data files and security updates
if it's not already checked.