Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

how do i stop ams1.lb.adnxis.com popping up?

I get a lot of safari warnings about ams1 and fra1 urls popping up: i can't find how to remove block these?

iMac (24-inch Early 2009), OS X Yosemite (10.10.3)

Posted on Jul 25, 2015 10:54 AM

Reply
4 replies

Jul 25, 2015 10:59 AM in response to robmaw

You may have installed the "Trovi," "Conduit," or "SearchProtect" ad-injection malware. Follow the instructions on this Apple Support page to remove it.

Back up all data before making any changes.

Besides the files listed in the linked support article, you may also need to remove these files in the same way:

~/Library/Application Support/Firefox/searchplugins/MyBrand.xml
~/Library/Application Support/Google/Chrome/External Extensions/fjadmdmahkpbhgbmmkiiaanlnlekelmn.json
~/Library/Application Support/Mozilla/Extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}/deacruzemiliano@outlook.com

Note that when you go to remove the "SearchProtect" app in the Applications folder, you may find instead a subfolder named "SearchProtect" with several apps inside it. Remove that subfolder together with all its contents.

One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those. If Safari crashes on launch, skip that step and come back to it after you've done everything else.

If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, then you may have one of the other kinds of adware covered by the support article. Follow the rest of the instructions in the article.

Make sure you don't repeat the mistake that led you to install the malware. Chances are you got it from an Internet cesspit such as "Softonic," "CNET Download," or "SourceForge." Never visit any of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.

"SearchProtect" may be distributed along with two other applications: "MacKeeper," which is a scam, and "ZipCloud," which, if not actually a scam, has a dubious reputation. Ask if you need instructions to remove those items.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

Jul 25, 2015 11:02 AM in response to robmaw

Scam pop-ups/Scamware?

1. Force Quit .


Press command + option + esc keys together at the same time. Wait.

When Force Quit window appears, select Safari if not already.

Press Force Quit button at the bottom of the window. Wait.

Safari will quit.


2. Relaunch Safari holding the shift key down.


3. Turn off wifi and turn it back on.


Turn off Wifi. Click Wifi icon in the menu bar and select “Turn Wifi off”.

Visit another website.

You won’t have internet connection.

Turn on Wifi. Click Wifi icon in the menu bar and select “Turn Wifi on”.

Select your Network.


4. Safari > Preferences > Privacy

Cookies and website data:

Click “Details” button.

Remove the cookie related to this, if there is one.


Adware?


1. Use free Malwarebytes Anti-Malware for Mac/ AdwareMedic to remove adware


http://www.adwaremedic.com/index.php


Download, install , open, and run it by clicking “Scan for Adware” button to remove adware.

Once done, quit Malwarebytes Anti-Malware.


or


Remove the adware manually by following the “HowTo” from Apple.

http://support.apple.com/en-us/HT203987




2. Safari > Preferences > Extensions

Turn those off and relaunch Safari.

Turn those on one by one and test.


3. Safari > Preferences > Search > Search Engine :

Select your preferred search engine.


4. Safari > Preferences > General > Homepage:

Set your Homepage.

Jul 25, 2015 11:25 AM in response to robmaw

You are given all options available.

You be the judge, based on facts.

Anyone has the right to express his thoughts on how to solve the problem.


I have been using and posting the link to Adware Removal Tool/AdwareMedic for last 8 months here.

No adverse effect was ever noted or notified.

I strongly believe in the principle of "Do no harm" and practice it.

I am not a promoter of malware here.

how do i stop ams1.lb.adnxis.com popping up?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.