adcash and other advertising always appear when clicking on links to new page or tab

1. Safari > Preferences > Extensions

Turn all extension off, relaunch Safari and test.

Turn those on one by one and test.

2. Safari > Preferences > Search > Search Engine :

Select your preferred search engine.

3. Force Quit .

Press command + option + esc keys together at the same time. Wait.

When Force Quit window appears, select Safari if not already.

Press Force Quit button at the bottom of the window. Wait.

Safari will quit.

Relaunch Safari holding the shift key down.

4. http://www.adwaremedic.com/kb/unsolved.php

http://www.thesafemac.com/arg-buca-apps/

http://www.thesafemac.com/eliminating-browser-redirects-and-advertisements/

From the menu bar, select

 ▹ System Preferences... ▹ Network ▹ Advanced... ▹ DNS

Under DNS Servers you should have one or more numerical addresses, such as “192.168.1.1” or “10.0.0.1”. What are those addresses?

5.104.175.152

8.8.8.8

Try using adwaremedic:

http://www.adwaremedic.com/

Panchal Boss wrote:

5.104.175.152

This is a Bulgarian IP address. Are you in Bulgaria? If not, it's likely that either your DNS settings have been modified on your computer or your network hardware has been hacked. See:

http://www.adwaremedic.com/kb/baddns.php

http://www.adwaremedic.com/kb/hackedrouter.php

If you actually are in Bulgaria, or get your internet service from a company in Bulgaria, then see the following for some other alternatives:

http://www.adwaremedic.com/kb/unsolved.php

(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com.)

I've had exactly the same problems with a friend's home network. It was a DLink modem connected to his Time Capsule that had the problem. Every device on his wifi had the popup windows, including telling us to update Flash on our ipads! The modem had somehow been hacked with these DNS addresses. We simply reset the modem back to factory and reinputted his broadband settings. And gave the modem a strong password! Seems to have fixed the problem as after resetting it the dodgy DNS addresses have disappeared.

Hope this helps.

As an update to my reply, the problem has reappeared on the DLink modem. Now I'm flummoxed.

If your modem has a vulnerability that allows it to be attacked remotely, resetting to factory settings may not be sufficient to solve the problem. It may solve it at the time, but it will just end up getting hacked again. You'll need to talk to the manufacturer of the modem about how to secure it.

Be aware that the strength of the password used to secure the wireless network is irrelevant for this purpose. That has nothing to do with how it's getting hacked.

Hi,

Thanks for that but it's a bit worrying that the modem is also protected by a strong password and they are getting past that. Has anybody else heard of a problem with DLink modems?

Billycann wrote:

Has anybody else heard of a problem with DLink modems?

Yup:

https://nakedsecurity.sophos.com/2015/02/04/d-link-routers-vulnerable-to-dns-hij acking/