Offers4u etc ads! At wits end! how do i stop it?!!

Click here and follow the instructions, or if there’s a type of adware not covered by them on the computer, these ones. If you're willing to use a tool to remove it(you don't need to, but may find it easier), you can instead run Adware Medic; this link is a direct download.

(126115)

I tried to get rid of the annoying "offers4u" pop-ups for days and followed all kinds of instructions, that I researched online. NOTHING worked (incl. AdwareMedic, Malwarebytes, ClamXav, Sophos, etc.). Neither on OS 10.9.x nor 10.6.8 (running both on different partitions). But it looks like, that I did find a SOLUTION, which I will describe with the following 6 steps:

1. Find out, on which websites the "offers4u" windows pop-up. In my case it was mostly on Amazon and on ebay, not immediately though, only after I was searching for some specific items. I tried to find out, to which domains or IPs the browser was connecting short before the "offers4u"-windows pop-up. As that happens so fast, it is nearly impossible to write down or memorize this info, so I recorded the screen with a screen recording program. I have uploaded the result here: http://vimeo.com/138000812 (PW = video). Going through the video you will see domains like cloudfront.net, mgicinsrc.org and mgicinsrc.info show up before the actual offers4u-windows pop up. So here are the next steps I did:

2. Using the selectivecookiedelete-Extension for Firefox, I deleted all cookies, that contained “cloudfront” and “mgicin”. If you don't have this extension, I suggest, you delete all cookies.

3. Most important: I copied the file “hosts” (located in ~/private/etc/hosts) to my desktop, opened with a regular text program and added the following lines:

127.0.0.1 i.mgicinjs.info

127.0.0.1 f.mgicinjs.info

127.0.0.1 i.mgicinjs.org

127.0.0.1 mgicinjs.net

127.0.0.1 mgicinjs.com

127.0.0.1 dew9ckzjyt2gn.cloudfront.net

===> If OTHER domains show up in your browser, of course you need to paste those into the hosts-file <===

4. I deleted the original hosts-file and moved/copied the one created on the desktop to the etc-folder.

5. I ran “Repair Disk Permissions” with Disk Utility.

6. I restarted my iMac, ran Firefox and (until now) the offers4u annoyance did not reappear.

Theoretically this should also make offers4u disappear on all other browsers you are using (don't forget to delete the cookies there too).

Please respond to the above, if it worked for you too (or not). Best wishes, A.

Thank you so much for posting this Duetto!

Just to augment this even further, here are the instructions for editing your Mac's hosts file to add the lines Duetto mentioned:

How to edit the Hosts file

1. Double-click Terminal.
2. type sudo nano /etc/hosts then hit return.
3. You'll be asked for your password. Enter your admin password.
4. At the end after editing file and adding the lines be sure to hit Ctrl-O (^O) and hit Enter to WriteOut/Save the file contents and replace hosts.

Thank you very much Duetto!

This was really helpful and resolved my issue as well.

As a note and as an alternative if you don't want to use the screen recorder, you can also observe the visited webpages if you install Firebug plugin on your browser and then navigate to "Net"->XHR tab.

Again thank you very much!

There may be an easier way to do this. Look at this thread:http://security.stackexchange.com/questions/97810/is-mgicinjs-info-a-virus-or-ma lware-site-how-to-get-rid-of-it

If you are using some kind of addon, in this case SaveFrom.net, then you can kill it in the settings. Just remove to get offers from Offers4U 🙂

If you use Firefox, you can install No Script, this kills everything. Yes, you have to know a bit about what's needed to get the website running. But it cuts the connection to the mgicinjs sites. I don't know if it has any non-harming use. I just started seeing this when installing SaveFrom addon in Firefox.