Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

How can I remove tradeadexchange malware?

I have had tradeadexchange malware creating new tabs randomly for a few weeks now. I have uninstalled Chrome and reinstalled it several times, using crunchify to remove all traces of it. I have run Malwarebytes, Admedic, F-secure and ClamXAV, none of which detected anything. I have looked at all my extensions and disabled them and re-enabled them one by one, to no avail. I really don't know very much about computers at all, and have followed more knowledgeable friends' advice as far as I can, but no one seems to be able to get rid of it. Please help me find out how to get rid of it. I have no idea what to do. Any replies will be most gratefully received. Please feel free to talk to me like an idiot, because I don't know what I'm doing! Thanks so much!

MacBook Air, OS X Yosemite (10.10.5)

Posted on Aug 26, 2015 3:22 PM

Reply
73 replies

Aug 27, 2015 6:02 AM in response to Carnationlilyrose

but I'm guessing that the adware is here to stay now, and getting rid of the vehicle it arrived in wouldn't help. Am I right?


Depends. I'd start by disabling the one you think was recently updated and test.


If that doesn't do it, then, since you already ran Adware Medic in its different incarnations, you might now want to try running the new, preview version of Sophos Anti-Virus for Mac Home Edition, 9.4.0, (it's a "beta" version, but almost ready for final release and usable right now), which has a new feature that, in addition to finding malware (will find both Windows and Mac malware), now scans for adware, and PUAs (Potentially Unwanted Applications). It might find something that Adware M didn't. The previous Sophos, which I use without any problems, didn't have this anti-adware feature. For download, it's here. Sophos is free, and has a generally very good reputation. (Ignore those who will now chime in to dissuade you from running it. You can use it to scan just this once, which may take a while, and then uninstall it, or keep it, as you like).


http://www.sophos.com/Pages/DownloadRedirect.aspx?downloadKey=8579BC43-753D-48D0 -8C74-60593FEB7097


To get it, you will be presented with a user agreement and an export control form. They are legitimate.

Aug 27, 2015 6:28 AM in response to Carnationlilyrose

Are you saying that F-Secure is blocking the download? That most certainly has to be a false positive. See https://www.f-secure.com/v-descs/false_positive.shtml


But you should at least temporarily disable F-Secure if you do a Sophos scan, since running two A-V concurrently is a bad idea.


I just submitted that link to Virus Total, the gold standard in malware identification, and it comes back overwhelmingly clean.


User uploaded file


User uploaded file


User uploaded file

Aug 27, 2015 6:48 AM in response to Carnationlilyrose

tradeadexchange may be caused a malicious router modification, something that can occur with any router that uses a web page for configuration. Read this post: How do I remove tradeadexchange virus from iPad mini?.


If that is what happened to yours, fixing it will require that you reset your router using its hardware reset procedure. Different routers have different ways of accomplishing that so you need to consult its documentation.


Please feel free to talk to me like an idiot,

You are not an idiot, but I suggest you cease downloading and installing products to solve problems caused by downloading and installing other products. That is never necessary, and it is the reason that you have become so confused. If malicious tampering with your router is the cause of your difficulties, then no software in existence can or will ever solve it.


"Anti-virus" and similarly categorized junk conveys no benefit on a Mac and can only cause problems or exacerbate existing ones. Stop installing those things. F-Secure has a particularly poor user interface and will have a detrimental effect on a Mac's performance, even when you are not actively using it. To remove it, use its downloaded uninstaller included in your Mac's Utilities folder. Beware that the uninstaller's effectiveness is poor, leaving components behind that can affect your Mac's operation.

Aug 27, 2015 6:48 AM in response to WZZZ

Two other things to try:


-go to "about:settings" in Chrome, scroll down to Advanced and hit Reset Settings.


-Start using OpenDNS, which may prevent these redirects.


Put these numbers for your Interface (e.g. Ethernet, Airport) in to System Preferences> Network>TCP/IP>DNS Servers and "apply"


208.67.222.222

208.67.220.220


They are from Open DNS and protected against DNS poisoning such as you may have gotten. The OpenDNS servers are usually faster and safer than the ones you may be using from your ISP.


To check that it is working, go to


http://www.opendns.com/welcome/

Aug 27, 2015 7:03 AM in response to John Galt

"Anti-virus" and similarly categorized junk conveys no benefit on a Mac and can only cause problems or exacerbate existing ones.

Depends on the A-V, and the reason why it is being run. And while it may not be needed, not all A-V is junk. Anyway, in this case I am recommending a Sophos version only in order to scan for adware, after which it can be uninstalled.


And yes, might be a router hijack too. If so, that will get the OP in to very uncharted territory.

Aug 27, 2015 7:03 AM in response to Carnationlilyrose

... the idea of not having any antivirus at all is very scary.

That is a popular misconception commonly held by Mac users inured to decades of having been shacked to the tyranny of Windows PCs. To them, suggesting that a Mac needs nothing other than what Apple provides can be incomprehensible. Overcome. Read below.



There will always be threats to your information security associated with using any Internet - connected communications tool:


  1. You can mitigate those threats by following commonsense practices
  2. Delegating that responsibility to software is an ineffective defense
  3. Assuming that any product will protect you from those threats is a hazardous attitude that is likely to result in neglecting point #1 above.

OS X already includes everything it needs to protect itself from viruses and malware. Keep it that way with software updates from Apple.


A much better question is "how should I protect my Mac":

  • Never install any product that claims to "clean up", "speed up", "optimize", "boost" or "accelerate" your Mac; to "wash" it, "tune" it, or to make it "shiny". Those claims are absurd.

    Such products are very aggressively marketed. They are all scams.

  • Never install pirated or "cracked" software, software obtained from dubious websites, or other questionable sources.
    • Illegally obtained software is almost certain to contain malware.
    • "Questionable sources" include but are not limited to spontaneously appearing web pages or popups, download hosting sites such as C net dot com, Softonic dot com, Soft pedia dot com, Download dot com, Mac Update dot com, or any other site whose revenue is primarily derived from junk product advertisements.
    • If you need to install software that isn't available from the Mac App Store, obtain it only from legitimate sources authorized by the software's developer.
  • Don’t supply your password in response to a popup window requesting it, unless you know what it is and the reason your credentials are required.
  • Don’t open email attachments from email addresses that you do not recognize, or click links contained in an email:
    • Most of these are scams that direct you to fraudulent sites that attempt to convince you to disclose personal information.
    • Such "phishing" attempts are the 21st century equivalent of a social exploit that has existed since the dawn of civilization. Don’t fall for it.
    • Apple will never ask you to reveal personal information in an email. If you receive an unexpected email from Apple saying your account will be closed unless you take immediate action, just ignore it. If your iCloud, iTunes, or App Store account becomes disabled for valid reasons, you will know when you try to buy something or log in to this support site, and are unable to.
  • Don’t install browser extensions unless you understand their purpose:

    Go to the Safari menu > Preferences > Extensions. If you see any extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone.

  • Don’t install Java unless you are certain that you need it:
    • Java, a non-Apple product, is a potential vector for malware. If you are required to use Java, be mindful of that possibility.
    • Java can be disabled in System Preferences.
    • Despite its name JavaScript is unrelated to Java. No malware can infect your Mac through JavaScript. It’s OK to leave it enabled.
    • The same precaution applies to Adobe Flash Player. Newly discovered Flash vulnerabilities appear almost weekly.
  • Beware spontaneous popups: Safari menu > Preferences > Security > check "Block popup windows".
    • Popup windows are useful and required for some websites, but unsolicited popups are commonly used to deceive people into installing unwanted software they would never intentionally install.
    • The mere appearance of a popup itself does not infect your Mac with anything malicious, but many contain resource-hungry code that will slow down Internet browsing.
    • If you ever receive a popup window indicating that your Mac is infested with some ick or that you won some prize, it is 100% fraudulent. Ignore it.
    • The same goes for a spontaneously appearing dialog insisting that you upgrade your video player right this instant. Such popups are frequently associated with sites that promise to deliver "free" movies, music, or other copyrighted content that is not normally "free".
    • If you find Safari has locked up, leaving you unable to dismiss the page, read Phony "tech support" / "ransomware" popups and web pages for the solution.
  • Ignore hyperventilating popular media outlets that thrive by promoting fear and discord with entertainment products arrogantly presented as "news". Learn what real threats actually exist and how to arm yourself against them:
    • The most serious threat to your data security is phishing. Most of these attempts are pathetic and are easily recognized, but that hasn't stopped prominent public figures from recently succumbing to this age-old scam.
    • OS X viruses do not exist, but intentionally malicious or poorly written code, created by either nefarious or inept individuals, is nothing new.
    • Never install something without first knowing what it is, what it does, how it works, and how to get rid of it when you don’t want it any more.
    • If you elect to use "anti-virus" software, familiarize yourself with its limitations and potential to cause adverse effects, and apply the principle immediately preceding this one.
    • Most such utilities will only slow down and destabilize your Mac while they look for viruses that do not exist, conveying no benefit whatsoever - other than to make you "feel good" about security, when you should actually be exercising sound judgment, derived from accurate knowledge, based on verifiable facts.
  • Do install updates from Apple as they become available. No one knows more about Macs and how to protect them than the company that builds them.


Summary: Use common sense and caution when you use your Mac, just like you would in any social context. There is no product, utility, or magic talisman that can protect you from all the evils of mankind.

Aug 27, 2015 7:24 AM in response to WZZZ

Thanks! I'm sorry if I sounded ungrateful in the last post! It wasn't intended that way! I was amused by the irony! This is a problem of 21st century internet etiquette, isn't it? You've spent all this time trying to help me escape the problems of downloading something from somewhere dodgy, and I complain that what you've sent me is dodgy! Difficult!


Ok, I will give it a go and get back to you.

Aug 27, 2015 7:40 AM in response to Carnationlilyrose

I'm certainly confused now!

I don't blame you. That's one of the drawbacks of looking for help on a public message board, where anyone can post pretty much anything.


You already know that no "anti-malware" product can solve your problem, so there's no cause for confusion on that point.


A

If Safari is not affected, you may have installed a malicious Chrome extension such as "Adblock Super" or "News Ticker Remover." Remove all extensions you don't know you need. If in doubt, remove all of them.

B

Remove the F-Secure product.

Back up all data before making any changes. Never install any "anti-virus" or "anti-malware" software again.

C

Remove "malwarebytes" by quitting it if it's running, then dragging it to the Trash.

Aug 27, 2015 7:44 AM in response to Linc Davis

I have indeed installed Adblock Super. I have now trashed it, but is that enough to get rid of it?


Malwarebytes is gone.


If you are all in agreement that F-Secure isn't needed, I will remove that.


I'm not a newbie at using computers, but I am a newbie at macs and I've never understood how computers work. One thing I have learned, though, is that it seems impossible to ask an innocent question without starting a fight!

Aug 27, 2015 7:52 AM in response to Carnationlilyrose

I have indeed installed Adblock Super. I have now trashed it, but is that enough to get rid of it?

Chrome extensions are uninstalled from within the application.


https://support.google.com/chrome_webstore/answer/2664769

running Sophos

Do not install Sophos, which is just another worse-than-useless "anti-malware" product. Never install any such product for any reason.

How can I remove tradeadexchange malware?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.