Totiteck software

Is Safari affected?

Yes, Safari is affected.

You may have installed ad-injection malware ("adware").

Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

Some of the most common types of adware can be removed by following Apple's instructions. If those instructions don't work for you, or if you have trouble following them, see below.

This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure that doesn't involve downloading anything.

Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. That will disable the malware temporarily.

Step 1

Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

Leave the folder open for now.

Step 2

Do as in Step 1 with this line:

/Library/LaunchAgents

The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

Step 3

Repeat with this line:

/Library/LaunchDaemons

This time the folder will be named "LaunchDaemons."

Step 4

Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

Step 5

If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

I did install an adware service. I will go through the process of removing it now.

Also, I did find that in Chrome my default search engine was still set to Toit, so I had to change that back to Google. Anyone else having that issue, the instructions are below.

Computer

1. Open Google Chrome.
2. In the top right corner of the page, click the Chrome menu > Settings.
3. In the "Search" section, select Google from the drop-down menu.

Mobile

1. Open Google Chrome.
2. In the top right corner of the page, touch the Chrome menu >Settings.
3. In the "Basics" section, touch Search engine.
4. Select Google.

Thanks for all your help Linc. Your answers to this were well received 🙂

Guys, thanks to Linc's tips I think I've managed to remove the totiteck bug. Is this a malware bug?

And now that I've had it, would I need to change all my passwords and would the people who created it be able to see all the documents, emails, and files on my computer? I got the bug whilst downloading a programme called zipwire (or something similar).

Thanks

Sorry to bump this back up. It's just because I'm rather worried about what access this thing would give to dubious people.

I can wipe my hard drive but don't want to if it's not needed. I have a lot of stuff I'd then have to reinstall and setup.

Thanks.

Thank you Linc. I found keka and lots of others. Double checked all the sub folders - they were hiding just about everywhere. Appreciate your help.

Thank you, the write up is appreciated and very good, but your comment that antivirus software is never needed is incorrect, and it makes you less vulnerable to be compromised by an attack, not more. This is perpetuated falsehood in the Mac communities that I have seen, and it is problematic because it does not follow best IT security practices. The core of these practices is 'defense in depth', meaning you put more barriers in the way to limit and mitigate security compromises.

Thank you! Really helpful and easy to do. Fixed the problem within 10 minutes of downloading the malware.

Thanks for this post, it has been really helpful. Please can you advise me whether I should delete ALL files that end in .plist ?

I have lots that I am not sure about such as

OutlookProfile.plist

com.microsoft.officeprefs.plist

FirstRunSettings.plist

Proofingprefs.plist

hi guys, Can I ask when you say you shouldn't have malware on the mac is that all types? When i bought my mac, Norton 360 came as part of the package and so i have norton installed on the computer? Is this ok or does it put me at more risk? Thanks Jenny

Hi Linc,

Can I ask when you say you shouldn't have malware on the mac is that all types? When i bought my mac, Norton 360 came as part of the package and so i have norton installed on the computer? Is this ok or does it put me at more risk? Thanks Jenny

<Link Edited by Host>

Is there any update needed to the info on removing Totiteck?

What you can do is this, you can delete all the downloads/files you don't need then go to safari preferences, general and change the homepage to google or what you want to use. This worked for me.

I believe it is some kind of malware. Not sure what is does but you can remove when you go to your applications and put in trash.