Q: how do i remove virus?

Viruses for Mac do not exist. Most likely it is adware.

Use Malwarebytes Anti-Malware: http://www.adwaremedic.com/index.php 

You can also remove the adware manually using the steps provided by Apple: https://support.apple.com/en-us/HT203987

After that, make sure your default search engine is set to the one you always use. To do so, Open Safari - Preferences - Search.

Go to Safari menu (At the very top right side of your screen next to Apple icon), choose "Quit Safari"

press "Shift" button and while holding this button on your keyboard single click on the Safari icon on your Dock.

Open Safari - Preferences - Privacy - Remove All Website Data.

Also, I believe it would be a good idea to install AdBlock.

Try Malwarebytes for Mac:

https://www.malwarebytes.org/antimalware/mac/

Fast easy and safe.  Used by many on these forums with success.

Ciao.

Stop pop-up ads and adware in Safari - Apple Support

A

Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

Your problem may not caused by malware. It may be a Web scam that only affects the browser, and only temporarily. There are several ways to recover.

1. The easiest thing to do is to force quit the browser. Relaunch it by holding down the shift key and clicking its icon in the Dock, the LaunchPad, or the Applications folder.

You will lose the state of other open tabs and windows. Either Step 2 or Step 3 may enable you to keep that state information. If those steps don't work, fall back to Step 1.

2. Press the key combination command-W to close the tab or window. A huge box will pop up. Press the return key and both the box and the page may close. If that doesn't happen, press and hold command-W. You may hear repeating alert sounds. While holding the keys, click the OK button in the popup. A different popup may appear, which you can cancel out of as usual.

3. From the Safari menu bar, select

          Safari ▹ Preferences... ▹ Security

and uncheck the box marked Enable JavaScript.

After closing the malicious page, select from the menu bar

          Safari ▹ Preferences... ▹ Privacy ▹ Remove All Website Data

to get rid of any cookies or other data left by the server. Open the Downloads folder and delete anything you don't recognize.

B

If the problem isn't solved, you may have installed ad-injection malware ("adware").

Some of the most common types of adware can be removed by following Apple's instructions.

If you're not already running the latest version of OS X ("El Capitan"), updating or upgrading in the App Store may cause the adware to be removed automatically. Back up all data before taking that step. If you're already running the latest version of El Capitan, you can nevertheless download the current updater from the Apple Support Downloads page and run it. Again, some kinds of malware will be removed. That may be all you need to do as far as removal is concerned, but you'll still need to make changes to the way you use the computer to protect yourself from further attacks.

If the above steps don't work for you, see below.

This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.

Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. That will disable the malware temporarily.

Step 1

Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

          Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

Leave the folder open for now.

Step 2

Do as in Step 1 with this line:

/Library/LaunchAgents

The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

Step 3

Repeat with this line:

/Library/LaunchDaemons

This time the folder will be named "LaunchDaemons."

Step 4

Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

Step 5

If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

The problem that you face in trying to find useful information on this site is that there are often differences of opinion, and often no easy way to distinguish between truth and falsehood (which is plentiful.) Fortunately, in this case, there is an easy way to make that distinction.

A link has been posted to an obsolete Apple Support page. That page, in turn, links to a "Macintosh Product Guide" where you can supposedly find "anti-malware" products endorsed by Apple. I suggest that you follow that link and see what happens. If it leads to "malwarebytes" or anything similar, then by all means, use it. Otherwise, you'll know what to think of the advice you were given.

Here's a hint: The product guide hasn't existed for years, and "malwarebytes" wasn't on it when it did exist.

Linc Davis wrote:

 

A link has been posted to an obsolete Apple Support page.

If it were obsolete, it would not be available or there would be a statement that it has been archived.

Ciao.

OGELTHORPE wrote:

 

Linc Davis wrote:

 

A link has been posted to an obsolete Apple Support page.

If it were obsolete, it would not be available or there would be a statement that it has been archived.

 

Ciao.

Please note: Safety tips for handling email attachments and content downloaded from the Internet - Apple Support

Distinguishing legitimate and malicious applications

Where you got the file is the most important indicator. Only download and install applications from trusted sources, such as well-known application publishers, authorized resellers, or other well-known distributors. It is also advisable to use antivirus software to scan any files before installation.

 

Last Modified: Mar 27, 2015

In the greater scheme of things, the point I am making is if one purports to insist that what Apple publishes is not to deviated from (such as exceeding RAM capacity specifications, among other things) then there should be consistency.  If there is not consistant, then it may seem like one simply is using Apple published information to serve their agenda when it suits their convenience in a given situation.  'That is all you need to know' is a common phrase used by some.

Ciao.

In the greater scheme of things, I don't really care whether or not Apple "officially" endorses the use of anti-malware/A-V. I make that decision myself, based on my own understanding of the threats and the nature of whatever particular anti-malware or A-V might be appropriate.

However, given the strong insistence here at ASC by many, who may or may not know what they are talking about (there are many who just automatically repeat what they have heard without, themselves, being adequately informed), I do find the recommendation to use A-V, in that Apple article, rather interesting, to say the least.