Want to highlight a helpful answer? Upvote!

Did someone help you, or did an answer or User Tip resolve your issue? Upvote by selecting the upvote arrow. Your feedback helps others! Learn more about when to upvote >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Pop ups on safari, google chrome and firefox!

Hi

Ever since I have my new macbook pro, i kept getting pop up windows whether i am using safari or google chrome (less on chrome) or firefox. Why is this happening? I checked the settings and pop ups are blocked but they keep popping up!


Also each time i re start my laptop, i have about ten maybe windows asking me to enter my password to allow for example icloud access to my keychain etc! Why? this has never ever happened before with macintosh until now? This is now like using a PC!


Anyone able to help please?


thank you in advance and best

norhayah

MacBook Pro, Mac OS X (10.7.1)

Posted on Aug 4, 2015 2:29 PM

Reply
Question marked as Best reply

Posted on Aug 4, 2015 2:39 PM

You may have installed one or more of the common types of ad-injection malware. Follow the instructions on this Apple Support page to remove it. It's been reported that some variants of the "VSearch" malware block access to the page. If that happens, start in safe mode by holding down the shift key at the startup chime, then try again.

Back up all data before making any changes.

One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those. If Safari crashes on launch, skip that step and come back to it after you've done everything else.

If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, ask for further instructions.

Make sure you don't repeat the mistake that led you to install the malware. Chances are you got it from an Internet cesspit such as "Softonic," "CNET Download," or "SourceForge." Never visit any of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.

Malware is also found on websites that traffic in pirated content such as video. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

7 replies
Question marked as Best reply

Aug 4, 2015 2:39 PM in response to norhayah

You may have installed one or more of the common types of ad-injection malware. Follow the instructions on this Apple Support page to remove it. It's been reported that some variants of the "VSearch" malware block access to the page. If that happens, start in safe mode by holding down the shift key at the startup chime, then try again.

Back up all data before making any changes.

One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those. If Safari crashes on launch, skip that step and come back to it after you've done everything else.

If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, ask for further instructions.

Make sure you don't repeat the mistake that led you to install the malware. Chances are you got it from an Internet cesspit such as "Softonic," "CNET Download," or "SourceForge." Never visit any of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.

Malware is also found on websites that traffic in pirated content such as video. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

Aug 4, 2015 7:50 PM in response to Linc Davis

Thank you so much. I will try this and see if it works. I had checked the extensions in safari and google and i have not installed anything except for two which i had deleted and uninstalled.


i do however kept receiving these messages when i re start my laptop :

1) talagent wants to use the "local Items' keychain.

2) Messages aget wants to use the "local items" keychain

3) CallHistoryPlugInHelper wants to use the "local items" keychain

4) Calendar Agent wants to use the "local items" keychain

5) AddressBookSourceSync wnats to use the "local items" keychain

6) com.apple.icloud.helper.xpc wants to use the "local items" keychain

7) accountsd wants to use the "local items' keychain

8) cloudd wants to use the "local items" keychain

9) scopedbookmarkaget wants to jsue the "local items" keychain


are these from Apple or virus? i never had this issue with my old macbook pro.


thanks again in advance for any help and advice you could offer.


best

norhayah

Aug 4, 2015 7:56 PM in response to norhayah

That's not adware. You can disregard my first comment.

Back up all data before proceeding.

Launch the Keychain Access application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Select the login keychain from the list on the left side of the Keychain Access window. If your default keychain has a different name, select that.

If the lock icon in the top left corner of the window shows that the keychain is locked, click to unlock it. You'll be prompted for the keychain password, which is the same as your login password, unless you've changed it.

Right-click or control-click the login entry in the list. From the menu that pops up, select

Change Settings for Keychain "login"

In the sheet that opens, uncheck both boxes, if not already unchecked.

From the menu bar, select

Keychain Access Preferences... First Aid

There are four checkboxes in the window that opens. Check all of them. if they're not already checked. Close the window.

Select

Keychain Access Keychain First Aid

from the menu bar and repair the keychain. Quit Keychain Access.

If you use iCloud Keychain, open the iCloud preference pane and uncheck the Keychain box. You'll be prompted to delete the local iCloud keychain. Confirm. Then re-check the box. Follow one of the procedures described in this support article to set up iCloud Keychain on an additional device.

Aug 5, 2015 3:42 PM in response to norhayah

"Ever since I have my new macbook pro, i kept getting pop up windows whether i am using safari or google chrome (less on chrome) or firefox. Why is this happening?"


Download and run Malwarebyyes Anti-Malware for Mac formerly known as AdwareMedic. It's free.


Make sure Mac App Store and identified developers is selected in System Preferences > Security & Privacy > General

Pop ups on safari, google chrome and firefox!

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.