I loaded a plugin that installed apps. I deleted all the apps but when I open Safari I am taking to the site nariabox.com When I click on the address/search bar I'm always sent to the bing search engine. Do I have some adware? How do I remove it?

I added a plugin from the nba-streaming site and it loaded some apps I didn't want. Can't recall all the apps, but one of them was something like nariabox


I deleted all the apps, but now when I open Safari I am taken to the page "nariabox.com". When I click the address/search bar and type in something, I am directly taken to the "bing" website search results. This also happens when I use firefox.
Just for the sake of it I downloaded crome to see if it had the same problem. I down loaded crome after I had deleted the apps. When I open crome it takes me to the google webpage and not nariabox.com


Do I have some type of adware/malware? How would I remove it?

MacBook Air, OS X Yosemite (10.10.3), safari

Posted on Jun 17, 2015 10:48 PM

Reply
2 replies

Jun 18, 2015 6:23 AM in response to itsllgood11

There is no need to download anything to solve this problem.

If Safari crashes on launch and you don't have another web browser, you should be able to launch Safari by starting up in safe mode.

You may have installed the "Genieo" or "InstallMac" ad-injection malware. Follow the instructions on this Apple Support page to remove it.

Back up all data before proceeding.

Malware is always changing to get around the defenses against it. In addition to the files listed in the support article, you may also have some of the following:

~/Library/LaunchAgents/com.Installer.completer.download.plist

~/Library/LaunchAgents/com.Installer.completer.ltvbit.plist

~/Library/LaunchAgents/com.Installer.completer.update.plist

~/Library/LaunchAgents/com.spigot.SearchProtection.plist

~/Library/Application Support/IM.Installer

Removing these files, if they exist, is optional if you've already followed Apple's instructions.

One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.

After removing the malware, remember to reset your home page in all the web browsers affected, if it was changed.

If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, then you may have one of the other kinds of adware covered by the support article. Follow the rest of the instructions in the article.

If you find Apple's instructions too hard to follow, ask for an alternative that doesn't require you to trust a black-box application without knowing what it does.

Make sure you don't repeat the mistake that led you to install the malware. Chances are you got it from an Internet cesspit such as "Softonic," "CNET Download," or "SourceForge." Never visit any of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

I loaded a plugin that installed apps. I deleted all the apps but when I open Safari I am taking to the site nariabox.com When I click on the address/search bar I'm always sent to the bing search engine. Do I have some adware? How do I remove it?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.