I am using a MacBook with OS X Yosemite 10.10.4. Every time I open Safari I get a pop up saying "HIGHLY RECOMMENDED You may need to fix Windows Errors" etc. This is on a page from Trovi.com.
I have reset Safari and run Malware Bytes Anti-Malware, as recommended on this site, but still have the problem. What else can I do to get rid of this? I assume it's Adware.
MacBook Pro with Retina display, OS X Yosemite (10.10.1)
Quit Safari and relaunch it while holding down the shift key.
I'm afraid the same still happens when I open Safari holding the shift key down.
if you think it's adware consider running adware medic on your mac
http://www.adwaremedic.com/index.php
which is free and developed by one of the frequent contributors to this forum.
pvreed wrote:
I'm afraid the same still happens when I open Safari holding the shift key down.
That works for some people, but for reasons that remain a mystery, doesn't work for others. If it's not working for you, try the alternate solutions here:
(Fair disclosure: I am affiliated with Malwarebytes, whose site I am linking to above.)
Disconnect from the Internet and try again. For instructions and illustrations read Phony "tech support" / "ransomware" popups and web pages.
Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.
This easy procedure will detect any kind of ad-injection malware that I know of. Deactivating the malware is a separate, and even easier, procedure that doesn't involve downloading anything.
Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up.
Step 1
Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:
~/Library/LaunchAgents
In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.
If the folder does open, press the key combination command-2 to select list view, if it's not already selected. There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.
Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.
Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.
Leave the folder open for now.
Step 2
Do as in Step 1 with this line:
/Library/LaunchAgents
The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.
Step 3
Repeat with this line:
/Library/LaunchDaemons
This time the folder will be named "LaunchDaemons."
Step 4
Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.
Step 5
If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.
Hi Linc
I've done as you, including the Chrome screenshot as I occasionally use Chrome. If I may say, your instructions were excellent and very easy to follow, but what do I do now?
Many thanks
Peter
There are no signs in those screenshots of any adware that would be affecting Safari. In Chrome, you have the AS Magic Player extension, which a Google search shows may be adware, but such information can be quite fickle and inaccurate, and that would not affect Safari anyway.
Note, though, that what you describe is not something that is typically caused by adware, but by visiting a bad or hacked site that redirects you to a scam. See the link I gave in my previous post for information about these scams and how to make the message go away.
One last thing: your first screenshot shows components of MacKeeper and ZipCloud, both junk and both frequently installed alongside adware. Both should be removed. For MacKeeper removal, see:
http://applehelpwriter.com/2011/09/21/how-to-uninstall-mackeeper-malware/
For ZipCloud, put the app itself in the trash, as well as those two "com.jdibackup.ZipCloud" items from the LaunchAgents folder in your first screenshot, then restart the computer.
A
You don't have any known adware that could affect Safari. You do have "ZipCloud," which has not been reported to be adware (as far as I know) but is usually bundled with adware, so perhaps you did have some adware and removed it, but didn't log out or restart after doing so. In that case, the deleted adware could still be active. Or maybe ZipCloud itself has now become adware. Whether it has or not, it's not to be trusted, so I suggest that you remove it by simply deleting the two files with "ZipCloud" in the name from the folder shown in the first screenshot. Log out or restart, then delete the "ZipCloud" or "JustCloud" application from the Applications folder. See whether the problem goes away.
B
"MacKeeper" is a scam with only one useful feature: it deletes itself.
First, back up all data.
Note: These instructions apply to the version of the product that I downloaded and tested in early 2012. I can't be sure that they apply to other versions.
If you have incompletely removed MacKeeper—for example, by dragging the application to the Trash and immediately emptying—then you'll have to reinstall it and start over.
IMPORTANT: "MacKeeper" has what the developer calls an “encryption” feature. In my tests, I didn't try to verify what this feature really does. If you used it to “encrypt” any of your files, “decrypt” them before you uninstall, or (preferably) restore the files from backups made before they were “encrypted.” As the developer is not trustworthy, you should assume that the "decrypted" files are corrupt unless proven otherwise.
In the Finder, select
Go ▹ Applications
from the menu bar, or press the key combination shift-command-A. The "MacKeeper" application is in the folder that opens. Quit it if it's running, then drag it to the Trash. You'll be prompted for your login password. Click the Uninstall MacKeeper button in the dialog that appears. All the other functional components of the software will be deleted. Restart the computer and empty the Trash.
☞ Quit MacKeeper before dragging it to the Trash.
☞ Let MacKeeper delete its other components before you empty the Trash.
☞ Don't try to drag MacKeeper from the Dock or the Launchpad to the Trash.
☞ Don't try to remove MacKeeper while running in safe mode.
How to get rid of travi.com's "You May need to fix Windows"
