-
All replies
-
Helpful answers
-
by Kappy,Jan 18, 2015 8:43 PM in response to nur elianafromwilayah persekutuan kuala lumpur
Kappy
Jan 18, 2015 8:43 PM
in response to nur elianafromwilayah persekutuan kuala lumpur
Level 10 (271,392 points)
DesktopsHow to uninstall MacKeeper - updated
Helpful Links Regarding Malware Problems
If you are having an immediate problem with ads popping up see The Safe Mac » Adware Removal Guide and AdwareMedic.
Open Safari, select Preferences from the Safari menu. Click on Extensions icon in the toolbar. Disable all Extensions. If this stops your problem, then re-enable them one by one until the problem returns. Now remove that extension as it is causing the problem.
The following comes from user stevejobsfan0123. I have made minor changes to adapt to this presentation.
Fix Some Browser Pop-ups That Take Over Safari.
Common pop-ups include a message saying the government has seized your computer and you must pay to have it released (often called "Moneypak"), or a phony message saying that your computer has been infected, and you need to call a tech support number (sometimes claiming to be Apple) to get it resolved. First, understand that these pop-ups are not caused by a virus and your computer has not been affected. This "hijack" is limited to your web browser. Also understand that these messages are scams, so do not pay any money, call the listed number, or provide any personal information. This article will outline the solution to dismiss the pop-up.
Quit Safari
Usually, these pop-ups will not go away by either clicking "OK" or "Cancel." Furthermore, several menus in the menu bar may become disabled and show in gray, including the option to quit Safari. You will likely have to force quit Safari. To do this, press Command + option + esc, select Safari, and press Force Quit.
Relaunch Safari
If you relaunch Safari, the page will reopen. To prevent this from happening, hold down the 'Shift' key while opening Safari. This will prevent windows from the last time Safari was running from reopening.
This will not work in all cases. The shift key must be held at the right time, and in some cases, even if done correctly, the window reappears. In these circumstances, after force quitting Safari, turn off Wi-Fi or disconnect Ethernet, depending on how you connect to the Internet. Then relaunch Safari normally. It will try to reload the malicious webpage, but without a connection, it won't be able to. Navigate away from that page by entering a different URL, i.e. www.apple.com, and trying to load it. Now you can reconnect to the Internet, and the page you entered will appear rather than the malicious one.
An excellent link to read is Tom Reed's Mac Malware Guide.
Also, visit The XLab FAQs and read Detecting and avoiding malware and spyware.
See these Apple articles:
Mac OS X Snow Leopard and malware detection
OS X Lion- Protect your Mac from malware
OS X Mountain Lion- Protect your Mac from malware
OS X Mavericks- Protect your Mac from malware
If you require anti-virus protection Thomas Reed recommends using ClamXAV. (Thank you to Thomas Reed for this recommendation.)
From user Joe Bailey comes this equally useful advice:
The facts are:
1. There is no anti-malware software that can detect 100% of the malware out there.
2. There is no anti-malware that can detect everything targeting the Mac.
3. The very best way to prevent the most attacks is for you as the user to be aware that
the most successful malware attacks rely on very sophisticated social engineering
techniques preying on human avarice, ****, and fear.
4. Internet popups saying the FBI, NSA, Microsoft, your ISP has detected malware on
your computer is intended to entice you to install their malware thinking it is a
protection against malware.
5. Some of the anti-malware products on the market are worse than the malware
from which they purport to protect you.
6. Be cautious where you go on the internet.
7. Only download anything from sites you know are safe.
8. Avoid links you receive in email, always be suspicious even if you get something
you think is from a friend, but you were not expecting.
9. If there is any question in your mind, then assume it is malware.
-
by Linc Davis,Jan 19, 2015 12:33 PM in response to nur elianafromwilayah persekutuan kuala lumpur
Linc Davis
Jan 19, 2015 12:33 PM
in response to nur elianafromwilayah persekutuan kuala lumpur
Level 10 (208,000 points)
ApplicationsThere is no need to download anything to solve this problem. You may have installed a variant of the "VSearch" ad-injection malware.
Malware is always changing to get around the defenses against it. These instructions are valid as of today, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.
The VSearch malware tries to hide itself by varying the names of the files it installs. To remove it, you must first identify the naming pattern.
Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:
/Library/LaunchDaemons
In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
A folder named "LaunchDaemons" may open. Look inside it for two files with names of the form
com.something.daemon.plist
and
com.something.helper.plist
Here something is a variable word, which can be different in each case. So far it has always been a string of letters without punctuation, such as "cloud," "dot," "highway," "submarine," or "trusteddownloads." Sometimes the word is "apple," and then you must be especially careful not to delete the wrong files, because many built-in OS X files have similar names.
If you find these files, leave the LaunchDaemons folder open, and open the following folder in the same way:
/Library/LaunchAgents
In this folder, there may be a file named
com.something.agent.plist
where the word something is the same as before.
If you feel confident that you've identified the above files, back up all data, then drag just those three files—nothing else—to the Trash. You may be prompted for your administrator login password. Close the Finder windows and restart the computer.
Don't delete the "LaunchAgents" or "LaunchDaemons" folder or anything else inside either one.
The malware is now permanently inactivated, as long as you never reinstall it. You can stop here if you like, or you can remove two remaining components for the sake of completeness.
Open this folder:
/Library/Application Support
If it has a subfolder named just
something
where something is the same word you saw before, drag that subfolder to the Trash and close the window.
Don't delete the "Application Support" folder or anything else inside it.
Finally, in this folder:
/System/Library/Frameworks
there may an item named exactly
v.framework
It's actually a folder, though it has a different icon than usual. This item always has the above name. Drag it to the Trash and close the window.
Don't delete the "Frameworks" folder or anything else inside it.
If you didn't find the files or you're not sure about the identification, post what you found.
If in doubt, or if you have no backups, change nothing at all.
The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Then, still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates (OS X 10.10 or later)
or
Download updates automatically (OS X 10.9 or earlier)
if it's not already checked.
-
by OGELTHORPE,Jan 19, 2015 1:32 PM in response to nur elianafromwilayah persekutuan kuala lumpur
OGELTHORPE
Jan 19, 2015 1:32 PM
in response to nur elianafromwilayah persekutuan kuala lumpur
Level 9 (52,531 points)
Mac OS XI would suggest that you DO download AdwareMedic. It is a very quick download and when opened will run very quickly. Suggesting that a download is more complicated or will take longer than following the multistep procedure advocated by Linc Davis should be viewed as an erroneous inference.
Unlike Linc Davis' narrowly focused suggestion, AdwareMedic is designed to identify numerous possible problem makers. Therefore it will not be only easier to use but the chances for a successful resolution are much improved. In addition, the complicated procedures advocated by Linc Davis, by comparison, invites the possibility of unnecessary errors and mistakes.
So keep it fast and simple, use AdwareMedic. If there is no success, then by all means try the cumbersome procedure posted by Linc Davis. But the chances are that you will not need to.
This post is not under copyright and can be used in part or whole without attribution.
Ciao.
-
Jan 19, 2015 1:33 PM in response to Linc Davisby Linc Davis,If you take the advice of anonymous strangers on a website to run an unknown application with unknown effects, I don't know what will happen—and neither do they, unless they've personally tested their advice on their own computer, as the terms of use of this site require them to do. What I do know is that the habit of trusting strangers that way puts the safety of your data at risk, and no software is going to mitigate that risk. Skepticism is the only defense against malware attack in the long run.
In order to make an informed decision to run an application that you know nothing about, you would at least have to search the site for discussions in which that same advice was followed by others. Evaluate the reported results and draw your own conclusions. You—not an anonymous stranger on ASC—must make that decision. The fact that someone here tells you it's safe should carry no weight at all.
You do not need any program to remove adware. I question whether using such a program, even if it works perfectly, saves any time when the need to research it first is taken into account. If you don't do that research, you'll be repeating the same mistake that caused the problem in the first place, and if you continue to repeat it, it will cause more problems, and worse ones.
Furthermore, you'll be getting very much the wrong idea if you think you can always rely on the program to work in the future. The only real safety lies in changing the way you use the computer.
I, too, am a stranger on a website, and you have no more reason to trust me than anyone else. The point is, you don't have to. I'm not asking you to take an action the effects of which you have no way of knowing. I'm suggesting that you back up and then delete a few files. You will know exactly what those files are, and if you don't like the effects, you can reverse them easily and with complete certainty by restoring the files you deleted from the backup. The whole operation will take no more time than downloading and running an app, and less time than it would take to investigate it first.
-
by OGELTHORPE,Jan 19, 2015 1:40 PM in response to nur elianafromwilayah persekutuan kuala lumpur
OGELTHORPE
Jan 19, 2015 1:40 PM
in response to nur elianafromwilayah persekutuan kuala lumpur
Level 9 (52,531 points)
Mac OS XIf his argument were brought to its logical conclusion, all responses, including his, would have to be challenged by an OP. Naturally a scenario such as that would make these forums totally unworkable. We do not and never will live in a perfect world, but In essence this is an argument looking for a problem that does not exist.
One is entitled to express ones thoughts on these subjects, but opinions do not by definition always equate to facts.
Based on my personal experience with AdwareMedic, Linc Davis' comment "The whole operation will take no more time than downloading and running an app" is not accurate.
Ciao.
-
by thomas_r.,Jan 20, 2015 5:02 AM in response to nur elianafromwilayah persekutuan kuala lumpur
thomas_r.
Jan 20, 2015 5:02 AM
in response to nur elianafromwilayah persekutuan kuala lumpur
Level 7 (30,924 points)
Mac OS XPlease forgive the bickering. From the sounds of it, you have some kind of adware installed, and as you can tell, there are some significant differences of opinion as to how an adware infection should be handled. I believe strongly that you deserve to be given choices.
You have a couple options. One is to follow directions to find and remove the adware manually. You can use either Apple's documentation on removing adware or my own Adware Removal Guide. This will require you to find and remove a number of files tucked into the corners of your system, and can be more time-consuming, but puts you firmly in control of the process.
The other option is to use AdwareMedic, which will find and remove the adware automatically. This is faster, easier, and for many people (in my experience), more reliable, but it takes away control of this process and puts it in the hands of an app. This does not mean you shouldn't trust that app, but it does mean you have to think about that and make the choice that works best for you.
In all cases, you should have a good backup before proceeding, so that if the procedure causes undesirable changes, you can revert to a previous state.
(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com, in the form of buttons allowing for donations. Donations are not required to use my site or software.)