Q: what are suspicious malware files?

Remove Browser Pop-up Problems

     Malwarebytes | Free Anti-Malware Detection & Removal Software for

     Apple Macintosh Computers

     Adblock Plus 1.8.9, GlimmerBlocker, or AdBlock

     Remove adware that displays pop-up ads and graphics on your Mac

     How to remove the FlashMall adware from OS X

     Stop pop-up ads and adware in Safari - Apple Support

How to safely use MacUpdate to download malware-free software:

This site has both free and paid membership accounts. If you have neither then some software will be distributed as an installer wrapper that includes adware/malware you may not want. Such a download may appear on your computer like this: Firefox Installer.dmg. Delete the download and return to the main site where you will find a direct link to the developer's website. Use that link from which to download the software.

To avoid such downloads from MU just create a free membership account. Log into your account prior to using the site. This will avoid the installer wrappers and downloading adware or malware. I continue to use their site without any problems.

If you prefer not to create a membership account then note that on the download page under the price box will be the link to the developer’s site. Use that link and download the software directly from the developer circumventing the use of MU altogether.

You may be sent warnings from sone users that warns that the site is “dangerous.” This is an exaggeration. Learn the facts. You merely need to use the site intelligently. Support the site but do so wisely - establish a free or paid membership to avoid problems with malware. Don’t pay attention to other users who warn you away with hyperbole.

Please download and install EtreCheck from http://etrecheck.com/

Run it and post the report here.

Please review the options below to determine which method is best to deal with the Adware installed on your computer.

The Easy, safe, effective method: https://www.malwarebytes.org/antimalware/mac/

If you are comfortable doing manual file removals, use the Apple support document below.

http://support.apple.com/en-us/HT203987

Also, read the articles below to better understand why it has happened and be more prepared for the next time there is an issue on your computer. https://discussions.apple.com/docs/DOC-7471

https://discussions.apple.com/docs/DOC-8071

http://www.thesafemac.com/tech-support-scam-pop-ups/

A

You may have installed ad-injection malware ("adware").

Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

Some of the most common types of adware can be removed by following Apple's instructions.

If you're not already running the latest version of OS X ("El Capitan"), updating or upgrading in the App Store may cause the adware to be removed automatically. Back up all data before taking that step. If you're already running the latest version of El Capitan, you can nevertheless download the current updater from the Apple Support Downloads page and run it. Again, some kinds of malware will be removed. That may be all you need to do as far as removal is concerned, but you'll still need to make changes to the way you use the computer to protect yourself from further attacks.

If the above steps don't work for you, see below.

This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.

Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. That will disable the malware temporarily.

Step 1

Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

          Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

Leave the folder open for now.

Step 2

Do as in Step 1 with this line:

/Library/LaunchAgents

The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

Step 3

Repeat with this line:

/Library/LaunchDaemons

This time the folder will be named "LaunchDaemons."

Step 4

Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

Step 5

If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

B

Links have been posted in this thread to the "macupdate" website. Do not follow the links, and never download anything from that site. It intentionally distributes OS X malware by packaging some free applications (such as "Firefox" and "Skype") in an unnecessary and malicious "installer."

All software should be downloaded directly from the developer's website or from the App Store. Don't trust any site such as "macupdate" that aggregates links.

Pepperment wrote:

 

Allan,

I sent you the report as you suggested. Now I'm concerned this may have not been a smart thing to do....Please advise.

Why?

Have you followed any of the instructions above to rid your computer of the AdWare you have installed?

Pepperment wrote:

 

Allan,

I sent you the report as you suggested. Now I'm concerned this may have not been a smart thing to do....Please advise.

There is nothing inherently wrong with the Etrecheck report.  It will do your MBP no harm whatsoever.  It simply records certain elements and items from your MBP so that it can be used as an initial staring point for analyzing and pinpointing potential problems.  It is merely a utility, nothing more.

Ciao.

I agree with Stedman and Oglethorpe.

<Edited by Host>

Linc Davis wrote:

Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less

Apple in their OFFICIAL documentation does condone the use of AV applications making this statement in conflict with OFFICIAL Apple policy.

https://support.apple.com/en-us/HT201675

The best course of action the user should take is to download Malwarebytes Anti-Malware for Mac

https://www.malwarebytes.org/mac-download/

It is faster, simpler and more comprehensive than any other approach to adware/malware removal.  In addition, it is widely recommenced for use by Apple telephone support personnel and Apple genius bar technicians.  One cannot find a better endorsement than that..

Ciao.

Hello Pepperment,

Now you know the reason for that big disclaimer when you copied your EtreCheck report to the clipboard.

All you need to do is what others have suggested and run MalwareBytes for Mac. Your adware will be gone in seconds.

Just because some software is in the Mac App Store does not mean it is safe. And just because some software is not in the Mac App Store doesn't mean it is unsafe. Apps in the Mac App Store have very strict limitations on what they can do. Any apps that need to do more than that cannot be in the Mac App Store. That doesn't mean there is anything wrong with them. In fact, the more powerful the software is, the less likely that it will qualify for the Mac App Store. MalwareBytes is perfectly safe and is by far the best anti-adware and anti-malware tool for the Mac.