illusiodiamond

Q: How do i get rid of deal top. offers4u and "from around the web" popups and unwanted links when popups are already turned off on my laptop

I have searched for the extensions responsible for this adware/malware and tried the launchdaemon fixes suggested and still cannot find where they are hiding on my computer.  One of them adds unwanted links with green circular arrows on other webpages and popup ads with offers for similar products pop up on both Safari and Chrome.  They are driving me crazy, I even paid for adblocking software which only serves to block sites I want to open and still allows the popups!

MacBook Air (13-inch, Early 2014), El Capitan

Posted on Mar 23, 2016 9:33 AM

Close

Q: How do i get rid of deal top. offers4u and "from around the web" popups and unwanted links when popups are already turned off on m ... more

  • All replies
  • Helpful answers

  • by Linc Davis,

    Linc Davis Linc Davis Mar 23, 2016 1:33 PM in response to illusiodiamond
    Level 10 (208,037 points)
    Applications
    Mar 23, 2016 1:33 PM in response to illusiodiamond

    You may have installed ad-injection malware ("adware").

    Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

    Back up all data first.

    Some of the most common types of adware can be removed by following Apple's instructions. But before you follow those instructions, you can attempt an automatic removal.

    If you're not already running the latest version of OS X ("El Capitan"), updating or upgrading in the App Store may cause the adware to be removed automatically. If you're already running the latest version of El Capitan, you can nevertheless download the current updater from the Apple Support Downloads page and run it. Again, some kinds of malware will be removed—not all. There is no such thing as automatic removal of all possible malware, either by OS X or by third-party software. That's why you can't rely on software to protect you.

    If the malware is removed in your case, you'll still need to make changes to the way you use the computer to protect yourself from further attacks. Ask if you need guidance.

    If the malware is not removed automatically, and you can't remove it yourself by following Apple's instructions, see below.

    This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.

    Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

    If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. That will disable the malware temporarily.

    Step 1

    Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

    ~/Library/LaunchAgents

    In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

    If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

    There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

    Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

    Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

    Leave the folder open for now.

    Step 2

    Do as in Step 1 with this line:

    /Library/LaunchAgents

    The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

    Step 3

    Repeat with this line:

    /Library/LaunchDaemons

    This time the folder will be named "LaunchDaemons."

    Step 4

    Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

    Step 5

    If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

  • by K Shaffer,Apple recommended

    K Shaffer K Shaffer Mar 23, 2016 1:36 PM in response to illusiodiamond
    Level 6 (14,547 points)
    Desktops
    Mar 23, 2016 1:36 PM in response to illusiodiamond

    You have a few hidden causes of the symptoms you cite and will have to look further.

     

    There are several places online that are helpful (without buying anything) and information

    learning how to use it, and what to look for, can take some time.

     

    • Adware Removal Guide - Identification - from The Safe Mac:

    http://www.thesafemac.com/arg-identification/

     

    Extensions, Library Launch Agents, and others bear looking into.

    Even the Support document about adware and safari covers how

    to locate hidden items that may not be extensions, via Go To Folder.

     

    • Stop pop-up ads and adware in Safari - Apple Support

     

    There are a few fairly good automated means to remove some or most of the present

    bad factors that may inhabit your Mac (mostly user controlled, not systemwide) such

    as http://adwaremedic.com/ can provide free, from the maker's site. A helpful report

    of probable causes, may be created w/ http://etrecheck.com/#about  to post in ASC.

     

    Usually there are similar removal paths where different browsers may be affected.

    And some add-ons from the browser maker (mozilla for firefox) to help the end user.

     

    Good luck & happy computing!

  • by illusiodiamond,

    illusiodiamond illusiodiamond Mar 24, 2016 6:11 AM in response to Linc Davis
    Level 1 (5 points)
    Notebooks
    Mar 24, 2016 6:11 AM in response to Linc Davis

    Hi, thank you for your reply.  There was nothing in the Launchagents window and no Safari extensions.  Here is the Launchdaemons window screenshot.

    file:///Library/LaunchDaemons/com.adobe.fpsaud.plist

    file:///Library/LaunchDaemons/com.microsoft.office.licensingV2.helper.plist

    file:///Library/LaunchDaemons/com.apple.installer.osmessagetracing.plist

    file:///Library/LaunchDaemons/com.Peutingerian.net-preferences.plist

    file:///Library/LaunchDaemons/com.semiattachedUpd.plist

    file:///Library/LaunchDaemons/com.fitbit.galileod.plist

    file:///Library/LaunchDaemons/PACESupport.plist

     

    Thank you,  Denise

  • by Linc Davis,

    Linc Davis Linc Davis Mar 24, 2016 11:04 AM in response to illusiodiamond
    Level 10 (208,037 points)
    Applications
    Mar 24, 2016 11:04 AM in response to illusiodiamond

    A

    Please back up all data before making any changes.

    Below is a suggested procedure to inactivate the malware you installed.

    The numbers refer to the items in the list, in the order shown. #1 would be the topmost item, #2 the one below, and so on.

    The names in quotes refer to malware types, not to the names of the files. Don't expect the files to have similar names. For example, if you installed the "VSearch" malware, usually none of the files will have the word "VSearch" in the name. Malware attackers don't make it that easy for you.

    In the folder arranged as shown in the list

              #4 and #5 ("VSearch")

    You may be prompted for your password.

    Restart the computer. Until you've done that, the malware will still be active, even after you delete the files.

    Uninstall any Safari extensions you don't know you need. If in doubt, remove all of them. None is needed for normal operation.

    Do the equivalent in the Chrome and Firefox browsers, if you use either of those.

    Reset the Safari home page, if it was changed. You may need to do the same in the other browsers.

    From the Applications folder (not shown in the screenshots), delete items with any of the following names:

              MPlayerX

    These steps will permanently inactivate the malware, as long as you never reinstall it. A few small files may remain in hidden folders, but they have no effect.

    The instructions above apply only to you. I'm including more general—and complete—self-contained removal instructions below for the benefit of others who may find this discussion. You can skip the remaining steps, but you should read them.

    B (optional)

    You installed one or more variants of the "VSearch" ad-injection malware. Please back up all data, then take the steps below to inactivate it.

    Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

    Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

    The VSearch malware tries to hide itself by varying the names of the files it installs. To remove it, you must first identify the naming pattern.

    1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination  command-C:

    /Library/LaunchDaemons

    In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

    A folder named "LaunchDaemons" may open. If it does, press the key combination command-2 to select list view, if it's not already selected.

    There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. Please don't skip this step. Files that belong to an instance of VSearch will have the same modification time to within about one minute, so they will be clustered together when you sort the folder this way, making them easy to identify.

    Look inside the folder for files with a name of any of these forms:

              com.something.daemon.plist

              com.something.helper.plist

              com.something.net-preferences.plist

    Here something is a meaningless, random string of characters, which can be different in each instance of VSearch. So far it has always been an alphanumeric string without punctuation, such as "disbalance" or "thunderbearer."

    You could have more than one copy of the malware, with different values of something.

    There may also be one or more files with a name of this form:

               com.somethingelseUpd.plist

    where somethingelse may be a different meaningless string than something. Again, there may be more than one such file, with different values of somethingelse.

    Here's a typical example of a VSearch infection:

              com.disbalance.net-preferences.plist

              com.thunderbearerUpd.plist

    You will have files with names similar, but probably not identical, to these.

    If you feel confident that you've identified the above files, drag just those files—nothing else—to the Trash. You may be prompted for your administrator login password. Close the Finder window.

    2. Open this folder as in Step 1:

    /Library/LaunchAgents

    Move to the Trash any files with a name of the form

              com.something.agent.plist

    where something is one of the strings you found in Step 1. There may not be any such files.

    3. If you moved anything to the Trash in Step 1 and/or Step 2, restart the computer and empty the Trash.

    Don't delete the "LaunchAgents" or "LaunchDaemons" folder, or anything else inside either one, unless you know you have some other kind of unwanted software besides VSearch. The folders are a normal part of OS X. The terms "agent' and "daemon" refer to a program that starts automatically. That's not inherently bad, but the mechanism is sometimes exploited by malware attackers.

    4. Reset the home page in each of your browsers, if it was changed. In Safari, first load the home page you want, then select

              Safari Preferences... General

    and click

              Set to Current Page

    The malware is now permanently inactivated, as long as you never reinstall it. A few small files will be left behind, but they have no effect, and trying to find them all is more trouble than it's worth.

    5. If you didn't find the files or you're not sure about the identification, post what you found.

    If in doubt, or if you have no backups, change nothing at all.

    6. The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it. I don't recommend that you install the genuine "MPlayerX," because it's hosted on the rogue "SourceForge" website and is bundled with other malware.

    This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.

    In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere  should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

    Then, still in System Preferences, open the App Store or Software Update pane and check the box marked

              Install system data files and security updates (OS X 10.10 or later)

    or

              Download updates automatically (OS X 10.9 or earlier)

    if it's not already checked.

  • by lautom,

    lautom lautom May 16, 2016 1:45 AM in response to Linc Davis
    Level 1 (4 points)
    May 16, 2016 1:45 AM in response to Linc Davis

    I have removed two files from the LaunchDeamons folder: com.swampishnessUpd.plist and com.Trionychoideachid.net-preferences.plist and corresponding folders from the Library. But there are two other files I feel unsure of; com.apple.nalen.plist and com.uashsul.plist - because they are created within minutes from the two previous files, but come up as being created before 2015 when I list the files after dates created in the LaunchDeamons folder.

     

    In the Library-folder there are also folders with the names Nalen (with a square icon) and uashsui (with a stop sign in the corner of the icon) created at the same time as all the other files, settings.dat and backup.zip are also created at the same time, yesterday at 22.09.

     

    The problem seems to have disapeared though, I no longer get the annoying arrows and popups when browsing. Should I still deleate any of the files mentionned above?

    Skjermbilde 2016-05-16 kl. 10.21.34.pngSkjermbilde 2016-05-16 kl. 10.30.59.png