Andre Klein

Q: Safari 9.0.3: Stalled with JavaScript enabled. Works fine with JavaScript disabled.

On one of my Macs (OS X 10.11.3), Safari 9.0.3 is unusable if JavaScript is activated: Google Search results are not clickable, and Safari presents you a virtually forever spinning beachball no matter which URL you open. Disable JavaScript and Safari runs flawlessly (but try surfing the web without JavaScript).

 

Already disable all plug-ins/extensions, cleared the cookies & cache, disable & re-enabled warnings on dangerous sites & web GL. No change. Latest FireFox on the same machine has no problems at all with JavaScript.

 

Any ideas or suggestions what to try next?

MacBook Pro, OS X El Capitan (10.11.3), MacBook Pro i5 2.3 GHz 16/1TB/128GB

Posted on Feb 15, 2016 9:59 AM

Close

Q: Safari 9.0.3: Stalled with JavaScript enabled. Works fine with JavaScript disabled.

  • All replies
  • Helpful answers

  • by Linc Davis,

    Linc Davis Linc Davis Feb 15, 2016 12:42 PM in response to Andre Klein
    Level 10 (208,000 points)
    Applications
    Feb 15, 2016 12:42 PM in response to Andre Klein

    You may have installed one or more variants of the "VSearch" ad-injection malware. Please back up all data, then take the steps below to inactivate it.

    Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

    Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

    The VSearch malware tries to hide itself by varying the names of the files it installs. To remove it, you must first identify the naming pattern.

    1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination  command-C:

    /Library/LaunchDaemons

    In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

    A folder named "LaunchDaemons" may open. If it does, press the key combination command-2 to select list view, if it's not already selected.

    There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. Please don't skip this step. Files that belong to an instance of VSearch will have the same modification time to within about one minute, so they will be clustered together when you sort the folder this way, making them easy to identify.

    Look inside the folder for files with a name of any of these forms:

              com.something.daemon.plist

              com.something.helper.plist

              com.something.net-preferences.plist

    Here something is a meaningless, random string of characters, which can be different in each instance of VSearch. So far it has always been an alphanumeric string without punctuation, such as "disbalance" or "thunderbearer."

    You could have more than one copy of the malware, with different values of something.

    There may also be one or more files with a name of this form:

               com.somethingelseUpd.plist

    where somethingelse may be a different meaningless string than something. Again, there may be more than one such file, with different values of somethingelse.

    Here's a typical example of a VSearch infection:

              com.disbalance.net-preferences.plist

              com.thunderbearerUpd.plist

    You will have files with names similar, but probably not identical, to these.

    If you feel confident that you've identified the above files, drag just those files—nothing else—to the Trash. You may be prompted for your administrator login password. Close the Finder window.

    2. Open this folder as in Step 1:

    /Library/LaunchAgents

    Move to the Trash any files with a name of the form

              com.something.agent.plist

    where something is one of the strings you found in Step 1. There may not be any such files.

    3. If you moved anything to the Trash in Step 1 and/or Step 2, restart the computer and empty the Trash.

    Don't delete the "LaunchAgents" or "LaunchDaemons" folder, or anything else inside either one, unless you know you have some other kind of unwanted software besides VSearch. The folders are a normal part of OS X. The terms "agent' and "daemon" refer to a program that starts automatically. That's not inherently bad, but the mechanism is sometimes exploited by malware attackers.

    4. Reset the home page in each of your browsers, if it was changed. In Safari, first load the home page you want, then select

              Safari Preferences... General

    and click

              Set to Current Page

    The malware is now permanently inactivated, as long as you never reinstall it. A few small files will be left behind, but they have no effect, and trying to find them all is more trouble than it's worth.

    5. If you didn't find the files or you're not sure about the identification, post what you found.

    If in doubt, or if you have no backups, change nothing at all.

    6. The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it. I don't recommend that you install the genuine "MPlayerX," because it's hosted on the rogue "SourceForge" website and is bundled with other malware.

    This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.

    In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere  should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

    Then, still in System Preferences, open the App Store or Software Update pane and check the box marked

              Install system data files and security updates (OS X 10.10 or later)

    or

              Download updates automatically (OS X 10.9 or earlier)

    if it's not already checked.

  • by Andre Klein,

    Andre Klein Andre Klein Feb 15, 2016 4:51 PM in response to Linc Davis
    Level 1 (20 points)
    Feb 15, 2016 4:51 PM in response to Linc Davis

    Linc, thanks (honestly) for your very detailed, foolproof description. I should mention that I'm since 1989 on Mac and consider myself as „power user“, thus have no problems navigating around, regardless whether we are talking about Finder or Terminal level.

     

    I checked both the LaunchAgents and LaunchDaemons folder and there isn't a single suspicious file. Everything I see there is familar to me.

     

    I dug deeper and searched system-wide for every single file or Adware name mentioned in here: Stop pop-up ads and adware in Safari - Apple Support. Nothing. No Adware/Malware indication whatsoever.

     

    Further ideas?

  • by Linc Davis,

    Linc Davis Linc Davis Feb 15, 2016 4:58 PM in response to Andre Klein
    Level 10 (208,000 points)
    Applications
    Feb 15, 2016 4:58 PM in response to Andre Klein

    Please read this whole message before doing anything.

    This procedure is a test, not a solution. Don’t be disappointed when you find that nothing has changed after you complete it.

    Step 1

    The purpose of this step is to determine whether the problem is localized to your user account.

    Enable guest logins* and log in as Guest. Don't use the Safari-only “Guest User” login created by “Find My Mac.”

    While logged in as Guest, you won’t have access to any of your documents or settings. Applications will behave as if you were running them for the first time. Don’t be alarmed by this behavior; it’s normal. If you need any passwords or other personal data in order to complete the test, memorize, print, or write them down before you begin.

    Test while logged in as Guest. Same problem?

    After testing, log out of the guest account and, in your own account, disable it if you wish. Any files you created in the guest account will be deleted automatically when you log out of it.

    *Note: If you’ve activated “Find My Mac” or FileVault, then you can’t enable the Guest account. The “Guest User” login created by “Find My Mac” is not the same. Create a new account in which to test, and delete it, including its home folder, after testing.

    Step 2

    The purpose of this step is to determine whether the problem is caused by third-party system modifications that load automatically at startup or login, by a peripheral device, by a font conflict, or by corruption of the file system or of certain system caches.

    Please take this step regardless of the results of Step 1.

    Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards, if applicable. Start up in safe mode and log in to the account with the problem.

    Note: If FileVault is enabled in OS X 10.9 or earlier, or if a firmware password is set, or if the startup volume is a software RAID, you can’t do this. Ask for further instructions.

    Safe mode is much slower to start up and run than normal, with limited graphics performance, and some things won’t work at all, including sound output and Wi-Fi on certain models. The next normal startup may also be somewhat slow.

    The login screen appears even if you usually log in automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.

    Test while in safe mode. Same problem?

    After testing, restart as usual (not in safe mode) and verify that you still have the problem. Post the results of Steps 1 and 2.

  • by Andre Klein,

    Andre Klein Andre Klein Feb 16, 2016 6:03 PM in response to Linc Davis
    Level 1 (20 points)
    Feb 16, 2016 6:03 PM in response to Linc Davis

    Tried both, step 1 and 2, both with guest user account and freshly created, new user account. Same problem: With JavaScript enabled Google Search results were not clickable and endlessly spinning beachball almost instantly showed up.

     

    Now comes the interesting bit: As there was an audio issues (no output device shown in System Preferences > Sound) I did a PRAM reset (CMD-opt-P-R) on the next restart. Not only was the sound output back to normal, but the JavaScript issue since then is gone too ... huh!?

     

    I remember having done a PRAM reset a couple of days before, yet ran into that (formerly) unseen JavaScript problem. My fear is now that it'll return.

     

    Any idea what’s going on here?

  • by carefulowner,

    carefulowner carefulowner Feb 22, 2016 5:36 PM in response to Andre Klein
    Level 1 (47 points)
    Mac OS X
    Feb 22, 2016 5:36 PM in response to Andre Klein

    André,

     

    The problem you're describing looks very much like that that you'll find in the recent Safari forum called "What could be causing the whirling ball or page freezing in Safari (most often in Amazon)?" That forum's been going for a few weeks now. Certain websites seem to trigger the condition more easily than others, eg. the Amazon website, albeit that sometimes it takes a few minutes of browsing and clicking before the webpage 'crashes'. The result is usually the classic spinning beachball.

     

    Those of us who have been pursuing the problem have been able to establish that it happens irrespective of whether you run under Mavericks, Yosemite or El capitan, and also irrespective of whether Flash is installed. Many of us have done all the usual things, like resetting Safari, clearing the caches, deleting history, deleting cookies - even deleting the Safari plist files and allowing them to be reinstated on restart - but all to no avail.

     

    Today, I visited my nearest Apple Store and had a play with one of the latest 5K iMacs there. I was not able to reproduce the problem on that.

     

    Aside from the UK Amazon site triggering it most easily, I myself have had the beachball appearing momentarily even when going into the GUI of my router, so this is definitely a Safari bug, and is not confined to showing itself only at actual websites. Personally, I'm convinced that the problem was introduced in a recent Apple update to OSX/Safari. This would have therefore been an incremental update, whereas my guess is that the Store's iMac probably had its El Capitan put on it as a new, one-off clean install.

     

    Using Activity Monitor (in the Utilities folder in Applications), a few hours ago I was able to see that when the crashing occurs the process called 'Secure Web Content' uses up 100% of the CPU. A bit of subsequent googling has revealed that this 'memory leak' issue has been kicking around for a long time on Macs, and Apple have never really addressed it and fixed it.

     

    Like you, I've found that if I turn off JavaScript in Safari's Preferences, the crashing stops, ie. the problem goes away. However, because JavaScript is off, a few functions in the webpage then don't work. As you say, most sites require JavaScript to be set.

     

    This is a subtle Safari problem that's now affecting increasing numbers of Mac users. Techies in the various Apple Stores are, it seems, totally unaware of the issue (though those in my local Store now know, because I've told them), and I guess that's probably true also of the Apple developers themselves; the issue doesn't seem to exist on brand new, clean-installed Macs, but only on Macs that have undergone the usual monthly updates to OSX/Safari. Recent updates have included some security fixes, I believe, so maybe that's a factor in this.

     

    I think all we can do is inform Apple, using either www.apple.com/feedback or the phone-back person-on-person help facility which has a guide-in link on the Apple Support (Apple Communities) webpage. Apple's only likely to respond when sufficient numbers of us report the self same or similar symptoms to them.