Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

how do I get rid of webshoppy pop ups

How do I get rid of webshoppy pop up?

MacBook Pro, OS X El Capitan (10.11.2)

Posted on Jan 16, 2016 1:35 PM

Reply
Question marked as Best reply

Posted on Jan 16, 2016 1:37 PM

You may have installed ad-injection malware ("adware").

Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

Back up all data first.

Some of the most common types of adware can be removed by following Apple's instructions. But before you follow those instructions, you can attempt an automatic removal.

If you're not already running the latest version of OS X ("El Capitan"), updating or upgrading in the App Store may cause the adware to be removed automatically. If you're already running the latest version of El Capitan, you can nevertheless download the current updater from the Apple Support Downloads page and run it. Again, some kinds of malware will be removed—not all. There is no such thing as automatic removal of all possible malware, either by OS X or by third-party software. That's why you can't rely on software to protect you.

If the malware is removed in your case, you'll still need to make changes to the way you use the computer to protect yourself from further attacks. Ask if you need guidance.

If the malware is not removed automatically, and you can't remove it yourself by following Apple's instructions, see below.

This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.

Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. That will disable the malware temporarily.

Step 1

Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

Go â–¹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

Leave the folder open for now.

Step 2

Do as in Step 1 with this line:

/Library/LaunchAgents

The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

Step 3

Repeat with this line:

/Library/LaunchDaemons

This time the folder will be named "LaunchDaemons."

Step 4

Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

Step 5

If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

14 replies
Question marked as Best reply

Jan 16, 2016 1:37 PM in response to oxbow damsel

You may have installed ad-injection malware ("adware").

Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

Back up all data first.

Some of the most common types of adware can be removed by following Apple's instructions. But before you follow those instructions, you can attempt an automatic removal.

If you're not already running the latest version of OS X ("El Capitan"), updating or upgrading in the App Store may cause the adware to be removed automatically. If you're already running the latest version of El Capitan, you can nevertheless download the current updater from the Apple Support Downloads page and run it. Again, some kinds of malware will be removed—not all. There is no such thing as automatic removal of all possible malware, either by OS X or by third-party software. That's why you can't rely on software to protect you.

If the malware is removed in your case, you'll still need to make changes to the way you use the computer to protect yourself from further attacks. Ask if you need guidance.

If the malware is not removed automatically, and you can't remove it yourself by following Apple's instructions, see below.

This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.

Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. That will disable the malware temporarily.

Step 1

Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

Go â–¹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

Leave the folder open for now.

Step 2

Do as in Step 1 with this line:

/Library/LaunchAgents

The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

Step 3

Repeat with this line:

/Library/LaunchDaemons

This time the folder will be named "LaunchDaemons."

Step 4

Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

Step 5

If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

Jan 16, 2016 3:18 PM in response to oxbow damsel

Is there another way to do back up without an external storage device?

No, and if you don't already have a backup, backing up should be a much higher priority than removing adware. See below:


Use Time Machine to back up or restore your Mac - Apple Support


The worst thing you can do in the circumstances is to repeat the mistake that caused the problem in the first place: downloading unknown software that you don't need, just because someone or something on a website told you to.

Jan 18, 2016 11:23 AM in response to Linc Davis

Linc Davis wrote:


The worst thing you can do in the circumstances is to repeat the mistake that caused the problem in the first place: downloading unknown software that you don't need, just because someone or something on a website told you to.

There are often cases where third party software can be very helpful and I would suggest that this may be one of them.


Ciao.


<Edited by Host>

Apr 29, 2016 12:08 PM in response to Linc Davis

Trying to fix my kid's computer, I've followed your instrux to a tee (thank you!) ...but what to do after your #5? I have identified what I believe to be suspicious downloads in the ~/Library/LaunchAgents and the /Library/LaunchDaemons files, although each file has different info/files. (There is nothing in the /Library/LaunchAgents file). So other than taking screen shots of them (see below), should/can I delete them from these folders? If yes, how? I had no extensions in either Safari or Chrome. Thank you for your help!!


User uploaded fileUser uploaded file

Apr 29, 2016 1:06 PM in response to janexdec

In the first screenshot, everything is malware except #5, #6, and #17. Please back up all data first. Move all the malware files to the Trash, then log out or restart the computer and empty the Trash (in that order.) You will be warned that some of the files are locked; confirm.


The second screenshot is OK.


You also installed "MacKeeper," which is not technically malware but is a scam. Remove it according to the developer's instructions.

Until your child has more maturity as a Mac user, I suggest that you change a setting to allow only Apple updates and software from the App Store to be installed.

Open the Security & Privacy pane in System Preferences and select the General tab. Click the lock icon in the lower left corner and enter your password to unlock the settings. Select the button marked

Mac App Store

and close the preference pane. For information about the effects of the setting, see this support article. You may need to change the setting temporarily to install some third-party software, such as Adobe Flash Player. Be especially careful with that, as malware is often distributed in the form of a fake Flash update. Never follow a link to a Flash update on any web page. Instead, use the built-in updater in the Flash Player preference pane.

The products in the App Store, while they aren't always very good, can at least be considered safe enough to use.

You will also need to remove administrator privileges from your child's account so that he or she can't revert the setting.

Apr 30, 2016 4:52 PM in response to Linc Davis

I know what makes me a "1" and what makes you a "10" on this blog! After following your instrux, I have successfully backed up the computer, rid it of the malware files you flagged and have changed my kid's security settings to "apple only" updates from "apple & identified developers" which I had, I believe, set it to originally but only recently. I have separately tackled ridding the "mackeeper" but, having read your separate post on that elsewhere, I'm having difficulty. I don't want to go to the developer, since they're not trustworthy. I've gone into Applications, but cannot find the folder. However, when I do a "find" in Finder, I do find a "MacKeeper Backups" folder in "This Mac/"Applications"/Shared, but it's empty. Not liking the "Shared" part. Thoughts?

May 1, 2016 1:59 PM in response to Linc Davis

Yes. The only folder I could find (with finder) was a "MacKeeper Backups" folder, but there is nothing in it. I tried to throw the empty folder in the trash, but to no avail. I could not find a plain "MacKeeper" file. What may have happened is that I inadvertently put it in the trash from the ~/Library/LaunchAgents file (#6 in that first screen grab above slugged: com.mackeeper.MacKeeper.Helper.plist) when I was throwing out the other mal/adware plists. Perhaps I was inadvertently successful in getting rid of it. Or not. I hope that made sense.


May 1, 2016 2:37 PM in response to janexdec

The only folder I could find (with finder) was a "MacKeeper Backups" folder

That folder doesn't matter. You can just delete it. You seem to have deleted the application, and that should have caused all other functional components of the software to be deleted as well. But if you have doubts, you would have to reinstall it and then remove it again according to the developer's instructions.

how do I get rid of webshoppy pop ups

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.