Annoying adware

Question

Annoying adware

I read through a bunch of threads regarding the removal of different kinds of malware/adware, but none seemed applicable to my current situation (maybe they were too old?). In an attempt to be proactive, I ran a diagnostic test that other people were posting, hoping that someone could make sense of my results (see below) and tell me how to remove the adware that's terrorizing my Google Chrome at the moment. Anyone?

Boot Mode: Normal

Model: iMac12,2

RAM details

BANK 0/DIMM0:

Size: 2 GB

Speed: 1333 MHz

Status: OK

Manufacturer: 0x02FE

BANK 1/DIMM0:

Size: 2 GB

Speed: 1333 MHz

Status: OK

Manufacturer: 0x02FE

BANK 0/DIMM1:

Size: Empty

Speed: Empty

Status: Empty

Manufacturer: Empty

BANK 1/DIMM1:

Size: Empty

Speed: Empty

Status: Empty

Manufacturer: Empty

User diagnostics

2015-01-12 Finder crash *

2015-01-25 com.apple.qtkitserver crash

* Code injection

Kernel messages

Jan 20 23:14:47 PM notification timeout (pid 9455, Mail)

--- last message repeated 20 times ---

Loaded extrinsic kernel extensions

com.logmein.driver.LogMeInSoundDriver (1.0.0)

Extrinsic daemons

com.xrite.device.xrdd.plist

com.oracle.java.Helper-Tool

com.microsoft.office.licensing.helper

com.google.keystone.daemon

com.v.helper

com.adobe.SwitchBoard

com.adobe.fpsaud

Extrinsic agents

com.paragon.ntfs.auth

com.wacom.pentablet

com.seagate.SeagateStorageGauge.plist

com.oracle.java.Java-Updater

com.logmein.logmeingui

com.hp.messagecenter.launcher

com.hp.help.tocgenerator

com.hp.devicemonitor

com.google.keystone.system.agent

com.v.agent

com.adobe.CS5ServiceManager

com.spotify.webhelper

com.adobe.ARM.UUID

launchd items

/Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist

(com.adobe.AAM.Startup-1.0)

/Library/LaunchAgents/com.adobe.CS5ServiceManager.plist

(com.adobe.CS5ServiceManager)

/Library/LaunchAgents/com.arcos.agent.plist

(com.v.agent)

/Library/LaunchAgents/com.google.keystone.agent.plist

(com.google.keystone.system.agent)

/Library/LaunchAgents/com.hp.devicemonitor.plist

(com.hp.devicemonitor)

/Library/LaunchAgents/com.hp.help.tocgenerator.plist

(com.hp.help.tocgenerator)

/Library/LaunchAgents/com.hp.messagecenter.launcher.plist

(com.hp.messagecenter.launcher)

/Library/LaunchAgents/com.logmein.logmeingui.plist

(com.logmein.logmeingui)

/Library/LaunchAgents/com.logmein.logmeinguiagent.plist

(com.logmein.logmeinguiagent)

/Library/LaunchAgents/com.logmein.logmeinguiagentatlogin.plist

(com.logmein.logmeinguiagentatlogin)

/Library/LaunchAgents/com.oracle.java.Java-Updater.plist

(com.oracle.java.Java-Updater)

/Library/LaunchAgents/com.seagate.SeagateStorageGauge.plist

(com.seagate.SeagateStorageGauge.plist)

/Library/LaunchAgents/com.wacom.pentablet.plist

(com.wacom.pentablet)

/Library/LaunchDaemons/com.adobe.fpsaud.plist

(com.adobe.fpsaud)

/Library/LaunchDaemons/com.adobe.SwitchBoard.plist

(com.adobe.SwitchBoard)

/Library/LaunchDaemons/com.apple.remotepairtool.plist

(com.apple.RemotePairTool)

/Library/LaunchDaemons/com.arcos.daemon.plist

(com.v.daemon)

/Library/LaunchDaemons/com.arcos.helper.plist

(com.v.helper)

/Library/LaunchDaemons/com.google.keystone.daemon.plist

(com.google.keystone.daemon)

/Library/LaunchDaemons/com.logmein.logmeinserver.plist

(com.logmein.logmeinserver)

/Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

(com.microsoft.office.licensing.helper)

/Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist

(com.oracle.java.Helper-Tool)

/Library/LaunchDaemons/com.xrite.device.xrdd.plist

(com.xrite.device.xrdd.plist)

Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist

(com.adobe.AAM.Scheduler-1.0)

Library/LaunchAgents/com.adobe.ARM.UUID.plist

(com.adobe.ARM.UUID)

Library/LaunchAgents/com.adobe.ARM.UUID.plist

(com.adobe.ARM.UUID)

Library/LaunchAgents/com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID. plist

(com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID)

Library/LaunchAgents/com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID. plist

(com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID)

Library/LaunchAgents/com.spotify.webhelper.plist

(com.spotify.webhelper)

Extrinsic loadable bundles

/System/Library/Extensions/hp_Inkjet9_io_enabler.kext

(com.hp.print.hpio.Inkjet9.kext)

/System/Library/Extensions/LogMeInSoundDriver64.kext

(com.logmein.driver.LogMeInSoundDriver)

/System/Library/Extensions/Pen Tablet.kext

(com.wacom.kext.pentablet)

/System/Library/Extensions/Seagate Storage Driver.kext

(com.seagate.driver.PowSecDriverCore)

/System/Library/Extensions/TabletDriverCFPlugin.bundle

(No bundle ID)

/Library/Audio/MIDI Drivers/EmagicUSBMIDIDriver.plugin

(info.emagic.driver.unitor)

/Library/Internet Plug-Ins/AdobePDFViewer.plugin

(com.adobe.acrobat.pdfviewer)

/Library/Internet Plug-Ins/Flash Player.plugin

(com.macromedia.Flash Player.plugin)

/Library/Internet Plug-Ins/googletalkbrowserplugin.plugin

(com.google.googletalkbrowserplugin)

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin

(com.oracle.java.JavaAppletPlugin)

/Library/Internet Plug-Ins/LogMeIn.plugin

(com.logmein.remctrlplugin)

/Library/Internet Plug-Ins/LogMeIn.plugin/LogMeInPluginHost.app

(com.logmein.LogMeInPluginHost)

/Library/Internet Plug-Ins/LogMeInSafari32.plugin

(com.logmein.remctrlplugin)

/Library/Internet Plug-Ins/LogMeInSafari64.plugin

(com.logmein.remctrlplugin)

/Library/Internet Plug-Ins/npContributeMac.bundle

(com.adobe.npContributeMacBundle)

/Library/Internet Plug-Ins/o1dbrowserplugin.plugin

(com.google.o1dbrowserplugin)

/Library/Internet Plug-Ins/OfficeLiveBrowserPlugin.plugin

(com.microsoft.officelive.browserplugin)

/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin

(com.microsoft.sharepoint.browserplugin)

/Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin

(com.microsoft.sharepoint.webkitplugin)

/Library/Internet Plug-Ins/WacomNetscape.plugin

(com.wacom.tabletplugin)

/Library/Internet Plug-Ins/WacomTabletPlugin.plugin

(com.WacomTabletPluginLib.WacomTabletPlugin)

/Library/PreferencePanes/Flash Player.prefPane

(com.adobe.flashplayerpreferences)

/Library/PreferencePanes/Growl.prefPane

(com.growl.prefpanel)

/Library/PreferencePanes/JavaControlPanel.prefPane

(com.oracle.java.JavaControlPanel)

/Library/PreferencePanes/NTFSforMacOSX.prefPane

(com.paragon-software.filesystems.ntfs.prefpanel)

/Library/PreferencePanes/PenTablet.prefPane

(com.wacom.PenTabletSettingsPrefPane)

/Library/PreferencePanes/Tuxera NTFS.prefPane

(com.tuxera.ntfs.mac.prefpane)

/Library/QuickTime/SoundboothScoreCodec.component

(com.adobe.SoundboothScoreAudioCodec)

/Library/ScriptingAdditions/Adobe Unit Types.osax

(No bundle ID)

/Library/Spotlight/GBSpotlightImporter.mdimporter

(com.apple.garageband.spotlightimporter)

Library/Address Book Plug-Ins/SkypeABDialer.bundle

(com.skype.skypeabdialer)

Library/Address Book Plug-Ins/SkypeABSMS.bundle

(com.skype.skypeabsms)

Library/Internet Plug-Ins/CitrixOnlineWebDeploymentPlugin.plugin

(com.citrixonline.mac.WebDeploymentPlugin)

Library/PreferencePanes/Growl.prefPane

(com.growl.prefpanel)

Extrinsic shared libraries

/usr/lib/libgutenprint.2.0.3.dylib

/usr/lib/libgutenprint.2.dylib

/usr/lib/libUFSDNTFS.dylib

DNS (from DHCP): 75.75.75.75

Restricted user files: 157

Font problems: 108

Bad plists

Library/Preferences/com.apple.Safari.plist.plist

Library/Preferences/com.apple.WebFoundation.plist

Library/Preferences/com.solidstatenetworks.host.plist

Desktop file count: 23

Elapsed time (s): 297

iMac, Mac OS X (10.7.5)

Posted on Jan 26, 2015 7:52 PM

Reply

Answer 1

Linc Davis

Level 10

209,739 points

Jan 27, 2015 11:17 AM in response to Appley Ever After

You installed a variant of the "VSearch" trojan. Remove it as follows.

This malware has many variants. Anyone else finding this comment should not expect it to be applicable.

Back up all data before proceeding.

Triple-click anywhere in the line below on this page to select it:

/Library/LaunchAgents/com.arcos.agent.plist

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.* A folder should open with an item selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.

Repeat with each of these lines:

/Library/LaunchDaemons/com.arcos.daemon.plist
/Library/LaunchDaemons/com.arcos.helper.plist

Restart the computer and empty the Trash. Then delete the following items in the same way:

/Library/Application Support/arcos
/System/Library/Frameworks/v.framework

The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.

This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Then, still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Reply

Answer 2

Kappy

Level 10

362,007 points

Jan 26, 2015 7:55 PM in response to Appley Ever After

Remove Adware and Pop-ups

The Safe Mac » Adware Removal Guide

AdwareMedic

Remove unwanted adware that displays pop-up ads and graphics on your Mac - Apple Support

Reply

Answer 3

Jan 28, 2015 6:55 PM in response to Linc Davis

This worked. Thank you so much!

Reply