eezdownloads virus found. None of the suggested fixes in other threads has fixed it.

Question

Level 1

0 points

eezdownloads virus found. None of the suggested fixes in other threads has fixed it.

I got the eezdownloads virus by accidentally typing a .com instead of .net at the end of a URL. I have tried all the fixes in the other threads about this virus, but nothing works.

Started by running ClamX AV. It found an .emix file. I trashed it and emptied the trash. Per the other threads, I then quit Safari (and I've Force Quit too, even though I didn't need to) and restarted holding the Shift key. The pop-up page comes right back. I've rebooted the computer many times to no avail. I have also run AdwareMedic as suggested in one thread. It found two files and I trashed them and emptied the trash. The problem persists, even after multiple reboots.

I can't delete and reinstall Safari because the computer won't allow it. Everything in Safari is greyed out, so I can't get into Preferences to reset Safari or do anything else. Any advice?

MacBook Pro (15-inch Late 2008), OS X Mavericks (10.9.5)

Posted on Mar 1, 2015 7:06 PM

Reply

Answer 1

Linc Davis

Level 10

209,547 points

Mar 1, 2015 7:24 PM in response to ToddMcCann

It's not a virus. It's a JavaScript scam that only affects your web browser, and only temporarily. There are several ways to recover.

1. Some of those scam pages can be dismissed very easily. Press the key combination command-W to close the tab or window. A huge box will pop up. Press the return key and both the box and the page will close. If that doesn't happen, continue.

2. Press and hold command-W. You may hear repeating alert sounds. While holding the keys, click the OK button in the popup. A different popup may appear, which you can cancel out of as usual.

3. From the Safari menu bar, select

Safari ▹ Preferences... ▹ Security

and uncheck the box marked Enable JavaScript. Leave the preferences dialog open.

Close the malicious window or tab.

Re-enable JavaScript and close the preferences dialog.

4. If the Preferences menu item is grayed out, quit Safari. Force quit if necessary. Relaunch it by holding down the shift key and clicking its icon in the Dock. None of the windows and tabs will reopen.

After closing the malicious page, from the menu bar, select

Safari ▹ Preferences... ▹ Privacy ▹ Remove All Website Data

to get rid of any cookies or other data left by the server. Open your Downloads folder and delete anything you don't recognize.

Reply

Answer 2

ToddMcCann Author

Level 1

0 points

Mar 1, 2015 7:40 PM in response to Linc Davis

I saw this fix on another thread, but like I said in my question, this solution DOES NOT work for me.

I Force Quit and hold down Shift when relaunching, but the tab opens back up anyway. I have even tried doing this with my Mac booted in Safe Mode. The problem persists as described. Safari menu items are largely greyed out, so I cannot Reset Safari or turn off the Preference for Safari to reopen tabs on launch.

So as you can see, nothing you suggest works. I cannot access any Preferences. Even Command-W won't close the window. If you have any other suggestions, I'd love to hear them. I really don't want to restore from a backup, but I will if I have to.

By the way, I'm in the Apple Support Community using Chrome.

Reply

Answer 3

Linc Davis

Level 10

209,547 points

Mar 1, 2015 8:00 PM in response to ToddMcCann

Disconnect from the network by turning off Wi-Fi or unplugging the Ethernet cable, whichever is applicable. Force-quit Safari and relaunch it while holding down the shift key. Change your home page.

Reply

Answer 4

ToddMcCann Author

Level 1

0 points

Mar 2, 2015 12:56 PM in response to Linc Davis

I did as you instructed. I disconnected from the Internet, Force Quit (even though Safari would have closed without it) and relaunched while holding the shift key while relaunching. Even with the Internet off, Safari opened with the pop-up visible and the eezdownloads URL in the bar. And as usual, most of the menus are greyed out so I cannot access Preferences to change my home page. So as you can see, my previous statement holds. The fix that worked for so many other people doesn't work for me.

I wonder if you saw where I said that the problem persists even when I boot my Mac into Safe Mode? I even booted into Safe Mode while NOT connected to the Internet. The problem remains the same.

I am appreciative of your help and I am willing to try anything to resolve this problem... as long as it isn't something you've already suggested. Again, I have tried everything you prescribed with no improvement.

Reply

Answer 5

Linc Davis

Level 10

209,547 points

Mar 2, 2015 1:00 PM in response to ToddMcCann

Do you have another web browser on the machine, or can you receive email notifications on it of responses to this thread?

Reply

Answer 6

ToddMcCann Author

Level 1

0 points

Mar 2, 2015 1:06 PM in response to Linc Davis

Yes to both. I am receiving email notifications in Apple Mail and I am in the Apple Discussions using Chrome on this MacBook Pro (the one with the eezdownloads issue). Chrome is working fine, it's just Safari that is borked.

Reply

Answer 7

ToddMcCann Author

Level 1

0 points

Mar 2, 2015 1:29 PM in response to ToddMcCann

I figured it out with the help of this website. I needed to delete the plist file in Safari manually. The first fix worked for me. Safari is back up and running like new!

https://sites.google.com/site/appleclubfhs/support/advice-and-articles/browser-p opup-hijack-safari

Here is what the site says:

None of this Worked!

If pressing Command + W does not work, and force quitting Safari and restarting the application with the Shift key held down does not get rid of the pop-up you will have to reset Safari. Normally, this can be done by launching Safari, then in the menu bar, going to Safari > Reset Safari. However, most pop-ups of this variety will block access to many of the drop-down menus in the menu bar. You will need to locate a file on the computer and move it to the trash. Make sure you quit Safari first (force quit if necessary).

To start, open Finder. The press Command + Shift + G, or in the menu bar, select Go > Go to Folder. Type the following file path:

~/Library/Preferences

Look for a file named com.apple.Safari.plist, and drag it to the trash. Then restart your Mac. After it reboots, try launching Safari. A new preferences file should have been automatically created, so no more action is required on your part, and the pop-up should now be gone.

Another file you can try removing if you still don't see a change, is com.apple.safari.savedState, which can be found in:

~/Library/Saved Application State

Reply