Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

My sister's computer has a virus

My sister has a 2012 Macbook Air (refurbished) running OS X Mountain Lion. She is out of town right now and I am using it. I don't know what she did, but every time I click on a link, it pulls up some bogus website. I deleted anything that looked suspicious from the Finder, deleted all suspicious looking applications, and emptied the trash. I cleared cookies, caches, and all website data, turned on popup blocker, and turned cookies off. I have restarted the computer twice, but all to no avail. Somebody help me find out what is wrong with this computer.

Posted on Jun 3, 2015 8:34 AM

Reply
4 replies

Jun 3, 2015 8:35 AM in response to jwiththek

Please review the options below to determine which method is best to remove the Adware installed on your computer.


The Easy, safe, effective method:

http://www.adwaremedic.com/index.php


If you are comfortable doing manual file removals, use the Apple support document below.

http://support.apple.com/en-us/HT203987


Also read the articles below to be more prepared for the next time there is an issue on your computer.

https://discussions.apple.com/docs/DOC-7471

https://discussions.apple.com/docs/DOC-8071

http://www.thesafemac.com/tech-support-scam-pop-ups/

Jun 3, 2015 8:36 AM in response to jwiththek

It's not a virus. It looks more like adware. You need to use Adwaremedic. It is a tiny tool, which will remove the adware within several seconds. You can download Adwaremedic from this website: http://www.adwaremedic.com/index.php

You can also remove the adware manually using the steps provided by Apple: https://support.apple.com/en-us/HT203987

Also, I believe it would be a good idea to install AdBlock.

Jun 3, 2015 1:07 PM in response to jwiththek

There is no need to download anything to solve this problem.

You may have installed one or more of the common types of ad-injection malware. Follow the instructions on this Apple Support page to remove it. It's been reported that some variants of the "VSearch" malware block access to the page. If that happens, start in safe mode by holding down the shift key at the startup chime, then try again.

Back up all data before making any changes.

One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those. If Safari crashes on launch, skip that step and come back to it after you've done everything else.

If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, ask for further instructions.

Make sure you don't repeat the mistake that led you to install the malware. Chances are you got it from an Internet cesspit such as "Softonic," "CNET Download," or "SourceForge." Never visit any of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.

Malware is also found on websites that traffic in pirated content such as video. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

Jun 3, 2015 1:09 PM in response to jwiththek

You've likely installed some form of adware which is causing the issue. Download and run a scan with AdwareMedic: http://adwaremedic.com/index.php.


The best way to remove adware is often the subject of heated debates on these forums. If you feel comfortable running a program, prefer a quicker solution, and don’t want to risk incompletely or incorrectly removing the adware manually, then you should run AdwareMedic as I suggested. If you would rather remove the adware manually because you don’t want to run any programs to solve the problem, then follow Apple’s instructions at https://support.apple.com/en-us/HT203987. Note that this document does not cover all types of adware. If those instructions do not solve the problem, see http://thesafemac.com/arg (from the same author as AdwareMedic).


You will probably hear others’ opinions about whether you should run a program or remove the adware manually. AdwareMedic gets my vote, but don’t let that, or anyone else’s opinions sway you one way or the other.

My sister's computer has a virus

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.