Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

How can I remove tradeadexchange malware?

I have had tradeadexchange malware creating new tabs randomly for a few weeks now. I have uninstalled Chrome and reinstalled it several times, using crunchify to remove all traces of it. I have run Malwarebytes, Admedic, F-secure and ClamXAV, none of which detected anything. I have looked at all my extensions and disabled them and re-enabled them one by one, to no avail. I really don't know very much about computers at all, and have followed more knowledgeable friends' advice as far as I can, but no one seems to be able to get rid of it. Please help me find out how to get rid of it. I have no idea what to do. Any replies will be most gratefully received. Please feel free to talk to me like an idiot, because I don't know what I'm doing! Thanks so much!

MacBook Air, OS X Yosemite (10.10.5)

Posted on Aug 26, 2015 3:22 PM

Reply
73 replies

Aug 27, 2015 7:57 AM in response to Linc Davis

Too late. I'm afraid I don't know what to do for the best. You both seem like you know what you are toalking about. How am I to judge?


I've removed the extension Adblock Super but does it all get deleted? Does it leave stuff behind? When I uninstalled and reinstalled Chrome as a possible solution, I was told to use crunchify to remove any residual stuff. Simply clicking the extension dustbin looks far too simple.

Aug 27, 2015 8:00 AM in response to Linc Davis

Do not install Sophos, which is just another worse-than-useless "anti-malware" product. Never install any such product for any reason.

I would completely disagree that it is worse than useless. It depends on the A-V and the purpose to which it is being put. But did you not read that I suggested running it for the purpose of scanning for adware? What would make it useless for that? When are you going to start supplying real evidence for the position you take against running a program to scan for adware?

Aug 27, 2015 8:02 AM in response to Carnationlilyrose

Adblock Super is definitely adware, and should be detected by Malwarebytes Anti-Malware for Mac. I'm guessing that you may have installed this after the last scan with Malwarebytes Anti-Malware for Mac, in an attempt to fix the problem, but that will only make it worse. Within Chrome, choose Window -> Extensions, then click the little trash can icon next to the Adblock Super extension.


I don't recognize any of the others as known adware, but there are a number of extensions there I'm not familiar with, so you'd be wise to turn them all off and test. You can do that in the same extensions list by unchecking the Enabled box next to each extension. If the problem goes away with all of them unchecked, one of them was the culprit... you'll just need to re-enable them until you've found the one causing the problem.


It's also entirely possible that the issue isn't related to any of your Chrome extensions. Does the issue also happen in Safari? If so, it could be a network hack, as John has suggested. A good test of this is if it happens in all browsers, but if you go to another network (coffee shop, local library, friend's house, etc), the problem goes away. If that's the case, some network device on the network where your Mac experiences trouble has been hacked.


For more information about some further steps to try to solve this problem, see:


https://support.malwarebytes.org/customer/portal/articles/2045704-what-should-i- do-if-malwarebytes-anti-malware-for-mac-didn-t-solve-my-problem-?b_id=9511


(Fair disclosure: I am affiliated with Malwarebytes.)

Aug 27, 2015 8:07 AM in response to Carnationlilyrose

I understand your confusion. If I were you I would scan with Sophos, which has an excellent reputation, or again with Malwarebytes for Mac, and then uninstall Sophos, should you want to. Running an A-V for a possible post-infection event is a completely valid reason to use an A-V. I don't think it will cause any harm.


Anyway, I'm not going to respond any more to these groundless challenges you have been getting. I've said everything I need to on the subject.

Aug 27, 2015 8:08 AM in response to Carnationlilyrose

How am I to judge?

ASC provides a very crude and unreliable way to judge the credibility of members. It isn't worth much, but perhapsin a case like this it's better than nothing. Beneath each member's icon, or "avatar," is a "reputation" rating. Compare.

If you've stopped getting popups in Chrome, then the problem is solved and you don't need to do anything else. If you're still getting popups, keep removing extensions. The most efficient way to proceed, if you have many of them, is to save a complete list, then remove half the items on the list. If the popups stop, you know that the bad extension(s) are in the group you removed. Otherwise, remove half of what remains. By iterating in this way you should be able to isolate the culprit.

Aug 27, 2015 8:09 AM in response to thomas_r.

Thank you for joining the discussion. Malwarebytes for Mac didn't pick it up on any of the (I think) 4 scans I did with it. In fact it didn't pick up anything, so I removed it. (I did use to use it on my Windows computers and it always worked then, so I don't mean to sound ungrateful.) I have deleted Adblock Super via the trashcan. I just wondered if getting rid of it that way got rid of it entirely. Nothing else seems that easy!


I don't use Safari - the only time I use it is to download Chrome when I uninstalled it. It doesn't happen when I use Safari on my ipad, however, nor on my husband's windows laptop, if that is relevant to the hijack question.


I've worked my way through the other suggestions on your link each time I ran Malwarebytes, but none of them did anything, I'm afraid.

Aug 27, 2015 8:14 AM in response to Linc Davis

The problem with this adware is how infrequent and unpredictable it is. It can go for 48 hours without popping up and then it'll be twice in a couple of hours. As I don't know what triggers it, it's impossible to test to see if it's gone.


Is the consensus that it is caused by an extension, then? And if the extension is gone, it should also be gone?

Aug 27, 2015 8:19 AM in response to Linc Davis

Linc Davis wrote:


How am I to judge?

ASC provides a very crude and unreliable way to judge the credibility of members. It isn't worth much, but perhapsin a case like this it's better than nothing. Beneath each member's icon, or "avatar," is a "reputation" rating. Compare.

Is it not like comparing nothing to nothing? If you are trying to make a point I find it very obtuse. The only solid correlation of points accumulated by any individual is a reflection of their activity on these forums. Since all participants start at level one, I submit that there may very well be level 1's who are more technically competent that some level 10's. I would rather compare the substance of the advice offered than the number of points.


Ciao.

Aug 27, 2015 8:26 AM in response to WZZZ

As a moderator on a student forum, I'm hyper-aware that reputation is oft got without merit and lost without deserving! The problem with what is a robust exchange of opinion is that the gullible and naive like myself get lost in the middle of it, having stirred up a hornets' nest when all I wanted was a solution to an annoying problem that I can't solve by myself. I'm very grateful for your patience.

How can I remove tradeadexchange malware?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.