Unable to remove malware: popups, .pkg downloads, adware links

Download and run MalwareBytes Malwarebyes was developed by one of our own colleagues here in ASC. It gets rave reviews and is about the most proven anti-malware software for Mac.

When you say it didn't work, exactly what do you mean, that It did not identify any malware or adware on your system?

http://amc.kayako.com/Knowledgebase/Article/View/4/0/how-to-uninstall-advanced-m ac-cleaner

Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

Some of the most common types of adware can be removed by following Apple's instructions.

If you're not already running the latest version of OS X ("El Capitan"), updating or upgrading in the App Store may cause the adware to be removed automatically. Back up all data before taking that step. If you're already running the latest version of El Capitan, you can nevertheless download the current updater from the Apple Support Downloads page and run it. Again, some kinds of malware will be removed. That may be all you need to do as far as removal is concerned, but you'll still need to make changes to the way you use the computer to protect yourself from further attacks.

If the above steps don't work for you, see below.

This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.

Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. That will disable the malware temporarily.

Step 1

Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

Leave the folder open for now.

Step 2

Do as in Step 1 with this line:

/Library/LaunchAgents

The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

Step 3

Repeat with this line:

/Library/LaunchDaemons

This time the folder will be named "LaunchDaemons."

Step 4

Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

Step 5

If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

<Edited by Host>

Link. You advise is good. But I have to tell you that I have experience with this AdvancedMac Cleaner. To be able to delete it you have to go to the activity monitor and kill it to begin to remove it. It stays running in the background. It was on my daughters Macbook and I was doing what you recommended and it would not let me delete it until I did that.

lisa sonora wrote:

I've followed instructions for removing malware on several threads here without success, and then tried using the Malwarebytes Anti-Malware for Mac - which didn't work.

If Malwarebytes Anti-Malware for Mac didn't detect any malware on your system, there are two likely explanations: 1) it's not due to adware, or 2) it's something new that Malwarebytes Anti-Malware for Mac isn't detecting.

With regard to #2, can you post a system snapshot taken with Malwarebytes Anti-Malware for Mac? To do so, open Malwarebytes Anti-Malware for Mac and choose Take System Snapshot from the Scanner menu. Then, in the window that opens, select all the text (Edit → Select All), copy it and paste into a reply to this message.

Alternately, if you'd rather not post that in a public forum, you could choose Contact Support from the Help menu in Malwarebytes Anti-Malware for Mac to contact our support techs directly.

This will help us determine whether it's likely that you have some kind of new adware, or whether we need to be looking elsewhere for the cause of the problem.

Thomas Reed

Director of Mac Offerings, Malwarebytes

I either didn't see your case, in which case someone else must be handling it, or I haven't made the connection with this topic. If you sent in a system snapshot, let me know what the case number is and I'll go look it up.

Thomas Reed

Director of Mac Offerings, Malwarebytes

My Daughter had AdvancedMacCleaner on her Macbook This is how I got rid of it. http://chaosisbalance.com/index.php/how-to-s/mac-os-x/14-a-how-to-guide-removing -adva Because it gets installed and becomes a startup item, the usual ways to remove don't work. And malwarebytes doesn't pick it up. You need to make sure you get it all.

my ginger wrote:

And malwarebytes doesn't pick it up.

Actually, it should these days. We started detecting that back in September. If you tried prior to that, we didn't at the time.

Thomas Reed

Director of Mac Offerings, Malwarebytes

Yes. But if you read her post, she tried Malwarebytes and it didn't remove it. This is a sneaky download like MacKeeper. But it stays running in the background and unless you kill it in the activity monitor it won't let you delete it. I have never tried killing it first and then running Malwarebytes. That might work.

It really isn't that sneaky, unless you're trying to remove it manually. We see many apps with similar behaviors.

As for why it wasn't removed, I'm trying to determine why that might be. There are many potential issues with the system that could cause that kind of thing, or it could be a new variant of AMC.

Thomas Reed

Director of Mac Offerings, Malwarebytes

Here is a link to where I found it. But what is being put on computers may be a variant of it. http://www.pcvark.com/amc/