You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

how to get rid of pop ups flash mall

how to get rid of pop ups flash mall pop up

MacBook Air, OS X Yosemite (10.10.1)

Posted on Jan 13, 2015 12:57 PM

Reply
Question marked as Top-ranking reply

Posted on Jan 13, 2015 10:01 PM

There is no need to download anything to solve this problem.

You may have installed the "Crossrider" trojan. Take the steps below to disable it.

Back up all data before continuing.

1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

Go Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. A folder named "LaunchAgents" will open.

2. Inside the folder you just opened, there may be files with any of the following names:

com.crossrider.wss*.agent.plist

flashmall_updater.plist

flashmall_updater.sh

com.webhelper.plist

com.webtools.update.agent.plist

WebSocketServerApp

Here * stands for a variable six-digit number. Some of these files may be absent. Move any that you have to the Trash and close the Finder window. Log out or restart the computer. The trojan will now be inactive, but there are a few more components of it that should be cleaned up.

3. Do as in Step 1 with this line:

~/Library/Application Support

A folder named "Application Support" will open. Inside it there may be a subfolder with this name:

webHelperApp

If so, move that subfolder—not the "Application Support" folder—to the Trash.

4. Finally, open this folder in the same way as above:

~/Library

Look for a subfolder with this name:

WebTools

and move it to the Trash, if present. Finally, empty the Trash.

137 replies

Feb 5, 2015 6:01 PM in response to wine4u

Solution: AdBlock. I did all of the library file searches and deletes - multiple times - and even got hours of help from AppleCare. Including escalation to a supervisor. Hooooours of frustration as we had momentary wins and then they'd pop up again. What a nightmare. Those little green circles hiding and then popping up again and multiplying and multiplying. The final solution was to install AdBlock. It worked!!! Neither hide nor hair of any adware. Anywhere. Jheesh. Finally. AdBlock. It does what it says.Thank you.

Feb 11, 2015 6:39 AM in response to RedMolly250

RedMolly250 wrote:


This does look extremely daunting.

This is confusing: "1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days."


SNIP


So to simplify, consolidated questions:

If I go through all the steps provided:

1) IF I back up first won't it also back up the virus?

2) If I go through all these steps will it actually rid my computer of the virus? or is this an exercise in diagnostics only.


RedMolly


Linc Davis is one of the most respected and capable members here. Read your emphasized quote carefully for your answers. MalWare is a complicated deal sometimes and requires as much data as possible to address. You can do it the expert way or you own way. You could try to DIY or run AdwareMedic but others here HAVE AdwareMedic installed have run the test and posted the results indicating that AdwareMedic does not clean this.

Further indication that AdwareMedic does not do the job is that the App's author has a HowTo page on FlashMall (aka many other names) > http://www.thesafemac.com/arg-buca-apps/

ÇÇÇ

Feb 11, 2015 9:18 AM in response to ChitlinsCC

ChitlinsCC wrote:

You could try to DIY or run AdwareMedic but others here HAVE AdwareMedic installed have run the test and posted the results indicating that AdwareMedic does not clean this.


That is not correct. It should remove Flashmall - certainly, I'm not aware of a variant of Flashmall that it doesn't remove - and if it doesn't, I can certainly help to identify what hasn't been removed.


Further indication that AdwareMedic does not do the job is that the App's author has a HowTo page on FlashMall (aka many other names) > http://www.thesafemac.com/arg-buca-apps/


That does not mean that AdwareMedic doesn't handle it. I maintain the manual removal instructions in parallel with AdwareMedic, to give people a choice. Those who want to do it manually may do so using that page. Those who want to run an app to remove it can use AdwareMedic.

Feb 11, 2015 9:37 AM in response to thomas_r.

My mistake thomas... I misinterpreted the etrecheck results on one respondent (AdWareMedic present - ASSUMED it had been run 😊 and therefore since issue persisted... well you see my folly) in addition to my ignorance of your perfect plan of giving folks a choice. I will refrain from drawing conclusions in future. My humblest of apologies. - ÇÇÇ

Feb 11, 2015 1:50 PM in response to knight2king

You have a variant or an incomplete installation of "Crossrider." Instructions for removing are already in this thread.

You also have "ZipCloud," which is some sort of cloud-storage service with a doubtful reputation. The OS X client is sometimes distributed along with malware. Although ZipCloud may not be malicious itself, it should be deemed suspect by virtue of the company it keeps.

To remove ZipCloud, start by backing up all data (not with ZipCloud itself, of course.)

Quit the application, if it's running, and drag it from the Applications folder to the Trash.

Triple-click anywhere in the line below on this page to select it:

~/Library/LaunchAgents/com.jdibackup.ZipCloud.autostart.plist

Right-click or control-click the highlighted line and select

Services Reveal in Finder (or just Reveal)

from the contextual menu.* A folder should open with a file selected. Move the selected file to the Trash.

In the same folder, there may also be a file named

com.jdibackup.ZipCloud.notify.plist

Move that to the Trash as well.

Log out or restart the computer and empty the Trash.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Feb 11, 2015 2:16 PM in response to wine4u

I tried manually removing the malware. It seemed successful at first but then it reoccured. I downloaded BitDefender's free malware tool and it removed one. Then I downloaded and activated their full product, Bitdefender Antivirus for Mac . When I ran a scan with that it detected and removed another! It is somewhat expensive ($60 for three licenses) and has to be renewed annually but it removed all the malware. Since I never did figure out how I got infected in the first place, it seemed prudent to get something that in addition to detecting and removing malware would also safeguard me from a new instance of malware. The day I got hit, I responded to two "customer surveys" that appeared to be from websites I frequent and trust. They offered "free gifts" but required a small handling/shipping charge. I declined because it didn't seem worth the trouble. In hindsight, I suspect that I almost fell victim to a sophisticated phishing attempt. If I had paid for the shipping/handling with my credit card, it would more than likely have been compromised.

Feb 24, 2015 8:15 AM in response to Linc Davis

Hi,

I so appreciate your help but this did not get rid of the problem. I followed all the steps and got rid of all offending agents, etc. Emptied trash, rebooted. It was still there. I uninstalled chrome but found it lurking in Firefox. Seems not to be in Safari, so far. In Firefox, I seem to have isolated it and disabled it in the add-ons. It reads as disabled: flashmall1.1 0.95.8. I can't seem to figure out how to get the thing manually removed from the add ons and so far the browser seems to be virus free. But I fear it is lurking in other places on the computer. I have not yet re-installed chrome.


Any more suggestions?


Thanks,


WConquest

how to get rid of pop ups flash mall

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.