kcaloca

Q: Malware: Domain Error Assistant   Ebay Shopping Assistant

I got some kind of malware. I have tried numerous tutorials online to remove it completely. I'm at a loss. I delete the extensions from Chrome (and report them every time), but when I create a new Chrome profile they come back. So I know that there are remnants lurking in my files somewhere.

 

Please help!

MacBook Pro with Retina display, OS X El Capitan (10.11.2)

Posted on Dec 26, 2015 3:57 PM

Close

Q: Malware: Domain Error Assistant   Ebay Shopping Assistant

  • All replies
  • Helpful answers

Page 1 Next
  • by macjack,

    macjack macjack Dec 26, 2015 3:59 PM in response to kcaloca
    Level 9 (55,668 points)
    Mac OS X
    Dec 26, 2015 3:59 PM in response to kcaloca

    Try Malwarebytes, developed by one of our helpers here in Apple Support Community.

  • by kcaloca,

    kcaloca kcaloca Dec 26, 2015 4:00 PM in response to macjack
    Level 1 (0 points)
    Dec 26, 2015 4:00 PM in response to macjack

    Yep, already tried it - it doesn't detect anything.    

  • by my ginger,

    my ginger my ginger Dec 26, 2015 4:10 PM in response to kcaloca
    Level 4 (2,472 points)
    Dec 26, 2015 4:10 PM in response to kcaloca

    If you have safari also ,it will be in there too. You will have to remove the extensions from all browsers you use.  http://www.thesafemac.com/arg-spigot/

  • by BobTheFisherman,

    BobTheFisherman BobTheFisherman Dec 26, 2015 4:16 PM in response to kcaloca
    Level 6 (15,176 points)
    Dec 26, 2015 4:16 PM in response to kcaloca

    MalwareBytes should find Domain Error Assistant. Are you sure this is the malware you have? How do you know?

  • by macjack,

    macjack macjack Dec 26, 2015 4:14 PM in response to kcaloca
    Level 9 (55,668 points)
    Mac OS X
    Dec 26, 2015 4:14 PM in response to kcaloca

    .

  • by kcaloca,

    kcaloca kcaloca Dec 26, 2015 4:38 PM in response to my ginger
    Level 1 (0 points)
    Dec 26, 2015 4:38 PM in response to my ginger

    I did remove from Safari already.

  • by kcaloca,

    kcaloca kcaloca Dec 26, 2015 4:39 PM in response to BobTheFisherman
    Level 1 (0 points)
    Dec 26, 2015 4:39 PM in response to BobTheFisherman

    Every time I create a new profile in Google Chrome, it automatically installs Ebay Shopping Assistant and Domain Error assistant. I manually delete and report the extensions, but next time I add a profile, they come back again. Even on a fresh installation of Google Chrome.

  • by BobTheFisherman,

    BobTheFisherman BobTheFisherman Dec 26, 2015 4:48 PM in response to kcaloca
    Level 6 (15,176 points)
    Dec 26, 2015 4:48 PM in response to kcaloca

    Are you force quitting Chrome or are you just closing the window before restarting and creating the new profile?

  • by kcaloca,

    kcaloca kcaloca Dec 26, 2015 4:50 PM in response to BobTheFisherman
    Level 1 (0 points)
    Dec 26, 2015 4:50 PM in response to BobTheFisherman

    This is after uninstalling Chrome and reinstalling from a fresh download.

  • by Linc Davis,

    Linc Davis Linc Davis Dec 26, 2015 5:56 PM in response to kcaloca
    Level 10 (207,925 points)
    Applications
    Dec 26, 2015 5:56 PM in response to kcaloca

    First, never use any kind of "anti-virus" or "anti-malware" software on a Mac. That's how you create problems, not how you solve them. You've already seen how much good it does.


    If Safari is not affected, please see below.


    Create a new browser user profile - Chrome Help

  • by kcaloca,

    kcaloca kcaloca Dec 26, 2015 6:11 PM in response to Linc Davis
    Level 1 (0 points)
    Dec 26, 2015 6:11 PM in response to Linc Davis

    the problem is every time i create a new profile the two troublemaker extensions come back.

  • by Linc Davis,

    Linc Davis Linc Davis Dec 26, 2015 6:25 PM in response to kcaloca
    Level 10 (207,925 points)
    Applications
    Dec 26, 2015 6:25 PM in response to kcaloca

    You may have installed ad-injection malware ("adware").

    Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

    Some of the most common types of adware can be removed by following Apple's instructions.

    If you're not already running the latest version of OS X ("El Capitan"), updating or upgrading in the App Store may cause the adware to be removed automatically. Back up all data before taking that step. If you're already running the latest version of El Capitan, you can nevertheless download the current updater from the Apple Support Downloads page and run it. Again, some kinds of malware will be removed. That may be all you need to do as far as removal is concerned, but you'll still need to make changes to the way you use the computer to protect yourself from further attacks.

    If the above steps don't work for you, see below.

    This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.

    Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

    If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. That will disable the malware temporarily.

    Step 1

    Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

    ~/Library/LaunchAgents

    In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

    If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

    There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

    Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

    Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

    Leave the folder open for now.

    Step 2

    Do as in Step 1 with this line:

    /Library/LaunchAgents

    The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

    Step 3

    Repeat with this line:

    /Library/LaunchDaemons

    This time the folder will be named "LaunchDaemons."

    Step 4

    Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

    Step 5

    If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

  • by kcaloca,

    kcaloca kcaloca Dec 26, 2015 6:35 PM in response to Linc Davis
    Level 1 (0 points)
    Dec 26, 2015 6:35 PM in response to Linc Davis

    Screenshot 2015-12-26 18.32.31.png

    Screenshot 2015-12-26 18.33.17.png

  • by kcaloca,

    kcaloca kcaloca Dec 26, 2015 6:36 PM in response to Linc Davis
    Level 1 (0 points)
    Dec 26, 2015 6:36 PM in response to Linc Davis

    found one more LaunchAgents folder

     

    Screenshot 2015-12-26 18.36.13.png

Page 1 Next