Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

How can I remove pop up ads or a redirect virus in Safari?

So, I've tried following instructions on almost every post I could find to remove adware in Safari. I have had no luck. I keep being redirected to ads that won't close unless I quit Safari. I have no extensions in Safari. I have not been able to find any of the files that are mentioned to be removed manually. I ran Malwarebytes and it did not find anything. I am currently running Avast, but have found no viruses. What can I do?

MacBook Pro, OS X El Capitan (10.11.1)

Posted on Dec 8, 2015 11:08 AM

Reply
20 replies

Dec 8, 2015 3:03 PM in response to paulfromdaphne

"Avast" is the worst of the whole wretched lot of commercial "security" products for the Mac. Not only does it fail to protect you from any real danger, it may send personal data (such as web browsing history and the contents of email messages) back to the developer without your knowledge, give false warnings, destabilize and slow down the computer, expose you to network attack, and corrupt the network settings and the permissions of files in your home folder. Removing it may not repair all the damage.

Some versions of the product also inject advertising into web pages. In short, apart from the fine print in the license agreement, Avast is indistinguishable from malware, and is arguably worse than any known malware now in circulation.

Please back up all data, then remove Avast according to the developer's instructions. Restart. Never install any "anti-virus" or "anti-malware" software again, including the "malwarebytes" product.

If you tried to remove Avast by dragging an application to the Trash, you'll have to reinstall it and then follow the instructions linked above.

Dec 8, 2015 3:19 PM in response to paulfromdaphne

Force quit Safari using the Command + Option + Esc keyboard shortcut.


Then relaunch Safari while holding down the Shift key then download and run Malwarebutes Anti-Malware


Make sure Mac App Store and identified developers is selected in System Preferences > Security & Privacy > General


If you would rather not download Malwarebytes Anti-Malware, you can remove the malware manually following the instructions here > Remove unwanted adware that displays pop-up ads and graphics on your Mac - Apple Support

Dec 8, 2015 3:21 PM in response to paulfromdaphne

Your question brings up the subject of removing adware. This is a general comment on that subject.

Under no circumstances should you ever allow anti-virus software to delete something for you.

The only tools that anyone needs to detect and remove adware are the Finder and a web browser, both of which you already have. Anyone who has enough computer skill to install adware can just as well remove it without using anything else.

Apple's general statements about malware protection are here and here, and here are its instructions for removing the most common types of ad-injection malware. Those statements don't mention any third-party "anti-virus" or "anti-malware" product. Apple's method for removing adware involves, as I say, only the Finder and a web browser.

You become infected with malware by downloading unknown software without doing research to determine whether it's safe. If you keep making that mistake, the same, and worse, will keep happening, and no anti-malware will rescue you. The only safety lies in safe computing practices.

The Windows/Android anti-malware industry had more than $75 billion in sales in 2014 [source: Gartner, Inc.] Its marketing strategy is to convince people that they're helpless against malware attack unless they use its products. But with all that anti-malware, the Windows and Android platforms are still infested with malware—most of it far more harmful than mere adware. The same can be expected to happen to the Mac platform if its users trust the same industry to protect them, instead of protecting themselves.

You are not helpless, and you don't have to give full control of your computer—and your data—to strangers in order to be rid of adware.

These are generalities. Regarding the "malwarebytes" product in particular, you may be told that there are no reports that is has caused damage. In fact, there are such reports; for example:

I found malware or adware on my system the other day. I removed it with Maleware Bytes and since then Safari has not worked proper at all.

preferences pane will not load

Read that report and draw your own conclusions—not anyone else's conclusions.

The developer itself admitted that the Windows version of the product has been known to delete essential system files.

Whether the software damages the system or not, it prompts for your password in order to take full adminstrative control, and connects via the Internet to a server controlled by the developer. The developer's privacy policy, linked directly to the product page, reads in part as follows:

"Without limiting the Privacy Policy, you agree that Malwarebytes may track certain data it obtains from your Computer including data about any malicious software or other threats flagged by the Software, data about your license, data about what version of the Software you are using and what operating conditions it runs under and data concerning your geographic location."

(Emphasis added.) So the developer admits to tracking your location, as well as other unspecified data, and gives itself the legal right to collect any data it chooses. How it uses that right, you don't know. By running the software, you accept these terms.

It's sometimes said that the Malwarebytes product only removes adware rather than malware as such (if there's a difference), and that it therefore shouldn't be stigmatized as anti-malware. The developer's own description does distinguish between adware and malware, and specifically mentions removing malware as a selling point six times. A self-described employee of the developer wrote in an ASC discussion, "Actually, it's also a malware removal app..." (emphasis added.)

The question then is: as a security-conscious computer user, do you want to take risks where there is no benefit?

Dec 9, 2015 8:15 AM in response to Linc Davis

I did not install anything before the ads started appearing. I usually don't download things into this computer (other than Adobe, and I've already uninstalled Flash), because it's from work. I only downloaded Malwarebytes because it is mentioned in plenty of these threads. I have uninstalled it now. I had seen all those links you posted, I followed all the instructions, but none of the files mentioned in those are in my computer.

Dec 9, 2015 8:40 AM in response to paulfromdaphne

I don't know, I don't think so though. I only installed Avast yesterday, and I've had this problem for about a week. The thing is it doesn't happen all the time, whenever I think I've solved it they pop up again. I went through a whole day of work without a single ad on Thursday, and then on Friday they came up again. I thought it was related to certain sites, it happened a lot on Ticketmaster, so I had been using it to see if my problem was solved; but it wasn't, they stopped popping up there and came up in the New York Time's website. I had been trying to find a pattern, usually they came up when I clicked on links, but not always, and sometimes they come up when I'm typing on some website. I'll see how it goes throughout the day.

Dec 9, 2015 9:02 AM in response to paulfromdaphne

Go to http://www.etresoft.com/etrecheck — download and run EtreCheck, copying the status report to paste here. If there's something on your computer that is causing these pop-ups to continue happening, even after other avenues have been explored, it should hopefully be present, and then we'll tell you where to go from there.


As an aside, have you tried opening Safari in Safe Mode? As I suggested to you earlier in the thread, Force Quit Safari, then open in Safe Mode by holding down the Shift key.

Dec 9, 2015 9:09 AM in response to paulfromdaphne

Your router has been hacked to direct DNS queries to a malicious server.

Follow the manufacturer's instructions to reset the router to the default state. Usually that involves inserting the end of a straightened paper clip or a similar tool into a pinhole somewhere in the back of the device, and pressing a switch inside for about 15 seconds. The pinhole may be marked "RESET."

Repeat the initial setup process. Make sure the router does not allow remote setup from the Internet (WAN port), if it has that feature—most do. The DNS servers should be set automatically by your ISP. If you still have trouble with those servers selected, contact your ISP.

Check the router manufacturer's website for a firmware update.

If you have a wireless network, it must be secured with WPA 2 encryption. The passwords for the network and the router must each be a string of at least 10 random upper- and lower-case letters and digits, and they should be different. Any password that you can remember is weak.

How can I remove pop up ads or a redirect virus in Safari?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.