How to remove Around the Web

Try Malwarebytes Anti-Malware for Mac:

https://www.malwarebytes.org/antimalware/mac/

If no success, try these Apple instructions:

https://support.apple.com/en-us/HT203987

Ciao.

You may have installed ad-injection malware ("adware").

Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

Back up all data first.

Some of the most common types of adware can be removed by following Apple's instructions. But before you follow those instructions, you can attempt an automatic removal.

If you're not already running the latest version of OS X ("El Capitan"), updating or upgrading in the App Store may cause the adware to be removed automatically. If you're already running the latest version of El Capitan, you can nevertheless download the current updater from the Apple Support Downloads page and run it. Again, some kinds of malware will be removed—not all. There is no such thing as automatic removal of all possible malware, either by OS X or by third-party software. That's why you can't rely on software to protect you.

If the malware is removed in your case, you'll still need to make changes to the way you use the computer to protect yourself from further attacks. Ask if you need guidance.

If the malware is not removed automatically, and you can't remove it yourself by following Apple's instructions, see below.

This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.

Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. That will disable the malware temporarily.

Step 1

Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

Leave the folder open for now.

Step 2

Do as in Step 1 with this line:

/Library/LaunchAgents

The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

Step 3

Repeat with this line:

/Library/LaunchDaemons

This time the folder will be named "LaunchDaemons."

Step 4

Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

Step 5

If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

Linc Davis is absolutely correct when he says "There is no such thing as automatic removal of all possible malware, either by OS X or by third-party software. That's why you can't rely on software to protect you." That is why you have to initiate in running Malwarbytes Anti-Malware for Mac in order to rid the MBP od unwanted Adware/Malware. It also will provide a list of possible candidates that should be removed, but you will have to make the specific selections. It certainly is not an automatic process.

This excellence of Malwarebytes Anti-Malware for Mac is evidenced by the fact that many Apple telephone support personnel advocate it's use to Mac users and genius bar technicians use it in preference to the Apple alternative that I posted. Their reasoning is simple, it is the fastest and most effective method of eliminating unwanted adware and malware.

Ciao.

No "anti-virus" or "anti-malware" software should ever be used for any reason, no matter who tells you to.

I hope you are not suggesting that the following is 'anti-malware' or 'anti-software':

https://support.apple.com/en-us/HT203987

After all you, as well as I, have suggested it use.

Ciao.

Linc thank you so much for helping with this malware that made me quit Safari, Firefox and Chrome. Just after downloading Opera hoping it would be immune to the adware (i see it isn't) I came across your post.
I had deleted the apps Tunnelblick and Cyberghost using App Cleaner but I see there are still plists. Should I delete apps the regular way?

I tried Safari with all extensions off but still get the ads. I know I have too many extensions but I was still in the process of trying some of them.
I'm sending the requested print screens.
Thanks

§ 1§e

A

Please back up all data before making any changes.

Below is a suggested procedure to inactivate the malware you installed.

The numbers refer to the items in the screenshots, in the order shown. Use the screenshots as a guide. #1 would be the topmost item, #2 the one below, and so on.

The names in quotes refer to malware types, not to the names of the files. Don't expect the files to have similar names. For example, if you installed the "VSearch" malware, usually none of the files will have the word "VSearch" in the name. Malware attackers don't make it that easy for you.

In the first folder arranged as shown in the screenshots, delete these items:

#4 and #5 ("ZipCloud")

#8 through #10 ("Flashmall")

In the second folder:

None

In the third folder:

#4 and #6 ("VSearch")

You may be prompted for your password.

Restart the computer. Until you've done that, the malware will still be active, even after you delete the files.

Uninstall any Safari extensions you don't know you need. If in doubt, remove all of them. None is needed for normal operation.

Do the equivalent in the Chrome and Firefox browsers, if you use either of those.

Reset the Safari home page, if it was changed. You may need to do the same in the other browsers.

From the Applications folder (not shown in the screenshots), delete items with any of the following names:

Flashmall

mediaDownloader

JustCloud

MPlayerX

WebShopper

WebTools

ZipCloud

Open your home folder by clicking the house icon with your name in the sidebar of a Finder window. If there is a subfolder named "Applications" (different from the main Applications folder), remove anything in it that you don't recognize.

These steps will permanently inactivate the malware, as long as you never reinstall it. A few small files may remain in hidden folders, but they have no effect.

"MacKeeper" is a scam with only one useful feature: it deletes itself.

If you have incompletely removed MacKeeper—for example, by dragging the application to the Trash and immediately emptying—then you'll have to reinstall it and start over.

Note: These instructions apply to the version of the product that I downloaded and tested in early 2012. I can't be sure that they apply to other versions.

IMPORTANT: "MacKeeper" has what the developer calls an “encryption” feature. In my tests, I didn't try to verify what this feature really does. If you used it to “encrypt” any of your files, “decrypt” them before you uninstall, or (preferably) restore the files from backups made before they were “encrypted.” As the developer is not trustworthy, you should assume that the "decrypted" files are corrupt unless proven otherwise.

Please back up all data before making any changes.

In the Finder, select

Go ▹ Applications

from the menu bar, or press the key combination shift-command-A. The "MacKeeper" application is in the folder that opens. Quit it if it's running, then drag it to the Trash. You'll be prompted for your login password. Click the Uninstall MacKeeper button in the dialog that appears. All the other functional components of the software will be deleted. Restart the computer and empty the Trash.

☞ Quit MacKeeper before dragging it to the Trash.

☞ Let MacKeeper delete its other components before you empty the Trash.

☞ Don't try to drag MacKeeper from the Dock or the Launchpad to the Trash.

☞ Don't try to remove MacKeeper while running in safe mode.

The instructions above apply only to you. I'm including more general—and complete—self-contained removal instructions below for the benefit of others who may find this discussion. You can skip the remaining steps, but you should read them.

B (optional)

You may have installed one or more variants of the "VSearch" ad-injection malware. Please back up all data, then take the steps below to inactivate it.

Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

The VSearch malware tries to hide itself by varying the names of the files it installs. To remove it, you must first identify the naming pattern.

1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

/Library/LaunchDaemons

In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

A folder named "LaunchDaemons" may open. If it does, press the key combination command-2 to select list view, if it's not already selected.

There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. Please don't skip this step. Files that belong to an instance of VSearch will have the same modification time to within about one minute, so they will be clustered together when you sort the folder this way, making them easy to identify.

Look inside the folder for files with a name of any of these forms:

com.something.daemon.plist

com.something.helper.plist

com.something.net-preferences.plist

Here something is a meaningless, random string of characters, which can be different in each instance of VSearch. So far it has always been an alphanumeric string without punctuation, such as "disbalance" or "thunderbearer."

You could have more than one copy of the malware, with different values of something.

There may also be one or more files with a name of this form:

com.somethingelseUpd.plist

where somethingelse may be a different meaningless string than something. Again, there may be more than one such file, with different values of somethingelse.

Here's a typical example of a VSearch infection:

com.disbalance.net-preferences.plist

com.thunderbearerUpd.plist

You will have files with names similar, but probably not identical, to these.

If you feel confident that you've identified the above files, drag just those files—nothing else—to the Trash. You may be prompted for your administrator login password. Close the Finder window.

2. Open this folder as in Step 1:

/Library/LaunchAgents

Move to the Trash any files with a name of the form

com.something.agent.plist

where something is one of the strings you found in Step 1. There may not be any such files.

3. If you moved anything to the Trash in Step 1 and/or Step 2, restart the computer and empty the Trash.

Don't delete the "LaunchAgents" or "LaunchDaemons" folder, or anything else inside either one, unless you know you have some other kind of unwanted software besides VSearch. The folders are a normal part of OS X. The terms "agent' and "daemon" refer to a program that starts automatically. That's not inherently bad, but the mechanism is sometimes exploited by malware attackers.

4. Reset the home page in each of your browsers, if it was changed. In Safari, first load the home page you want, then select

Safari ▹ Preferences... ▹ General

and click

Set to Current Page

The malware is now permanently inactivated, as long as you never reinstall it. A few small files will be left behind, but they have no effect, and trying to find them all is more trouble than it's worth.

5. If you didn't find the files or you're not sure about the identification, post what you found.

If in doubt, or if you have no backups, change nothing at all.

6. The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it. I don't recommend that you install the genuine "MPlayerX," because it's hosted on the rogue "SourceForge" website and is bundled with other malware.

This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Then, still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

C (optional)

"ZipCloud," sometimes named "JustCloud," is a cloud-storage service with a doubtful reputation. The OS X client is sometimes distributed along with malware. Although ZipCloud may not be malicious itself, it should be suspected by virtue of the company it keeps.

To remove ZipCloud, please start by backing up all data (not with ZipCloud itself, of course.)

Quit the "ZipCloud" or "JustCloud" application, if it's running, and drag it from the Applications folder to the Trash. Don't try to empty yet.

Triple-click anywhere in the line below on this page to select it:

~/Library/LaunchAgents

Right-click or control-click the highlighted line and select

Services ▹ Open

from the contextual menu.* A folder named "LaunchAgents" should open.

In the folder, there may be one or more files with a name beginning as follows:

com.jdibackup.

Move all such files to the Trash.

Log out or restart the computer and empty the Trash.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

D (optional)

Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

You installed the "Flashmall" trojan. Please take the steps below to disable it.

Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

Back up all data before continuing.

1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return. A folder named "LaunchAgents" will open.

2. Inside the folder you just opened, there may be files with a name beginning in any of the following ways:

com.crossrider

com.extensions

com.flashmall

com.Installer.completer

com.webhelper

com.WebShopper

com.webtools

flashmall

UpdateDownloader

WebSocketServerApp

Move any such files to the Trash and close the Finder window. Log out or restart the computer. The trojan will now be inactive.

3. This step, and also Steps 4 and 5, are optional. Do as in Step 1 with this line:

~/Library/Application Support

A folder named "Application Support" will open. Inside it there may be subfolders with any of these names:

IM.Installer

webHelperApp

WebShopper

WebTools

If so, move those subfolders—not the "Application Support" folder—to the Trash.

4. Open this folder in the same way as above:

~/Library/ScriptingAdditions

and remove an item named

BrowserHelper.osax

if present.

5. Open this folder:

~/Library

Look for subfolders with either of these names:

flashmall

WebTools

and move them to the Trash, if present. Don't remove the subfolder named "WebKit".

6. Open the Applications folder. Move to the Trash items with any of these names:

Flashmall

mediaDownloader

WebShopper

WebTools

Important: You can't delete applications by trying to drag them from the Dock or the LaunchPad. Open the Applications folder in the Finder.

7. Open this folder in the same way as above:

~/Applications

This is not the usual Applications folder, but a different one inside your home folder. Look for an application with a name like this:

flashmall

and move it to the Trash, if present. Also remove anything else in that folder that you don't recognize.

Empty the Trash.

8. From the Safari menu bar, select

Safari ▹ Preferences... ▹ Extensions

Uninstall all extensions you don't know you need, including one called "GoldenBoy," if it's present. If in doubt, remove all of them. None is required for normal operation. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.

E (optional)

You've installed malware on at least three different occasions. Something has to change, or you'll be victimized again, maybe with much worse consequences.

Until you have more experience as a Mac user, I suggest that you change a setting to allow only Apple updates and software from the App Store to be installed.

Open the Security & Privacy pane in System Preferences and select the General tab. Click the lock icon in the lower left corner and enter your password to unlock the settings. Select the button marked

Mac App Store

and close the preference pane. For information about the effects of the setting, see this support article. You may need to change the setting temporarily to install some third-party software, such as Adobe Flash Player. Be especially careful with that, as malware is often distributed in the form of a fake Flash update. Never follow a link to a Flash update on any web page. Instead, use the built-in updater in the Flash Player preference pane.

The products in the App Store, while they aren't always very good, can at least be considered safe enough to use.

andrekorreia wrote:

I had deleted the apps Tunnelblick and Cyberghost using App Cleaner but I see there are still plists. Should I delete apps the regular way?

The best way to make sure all Tunnelblick components are uninstalled is to follow the instructions at Uninstalling Tunnelblick.

In fact, the best way to uninstall any software is to use the software's own uninstaller. If you do a Google search on "uninstall tunnelblick", for example, the second entry is the page I linked to above, which is on the Tunnelblick website (tunnelblick.net).

Thank you so much Linc. I've done everything you suggested including installing MacKeeper and using its uninstaller.
After cleaning trash and restarting Macbook "All around the world" hasn't popped up on any browser anymore.
Safari keeps shutting down every time I go into a new page, be it typing URL or clicking link.

The other browsers seem to be working fine and previously they were going unbearably slow.
I wouldn't bother about Safari if it wasn't my favourite browser in terms of memory usage and always being able to restore previous sessions, which not always happens in Firefox and Chrome. But I'm prepared to let Safari go and use sessions extension on the other browsers (I use at least 3 browsers simultaneously).
Cheers mate!

jkbull thanks for the tip. Whenever a program has uninstaller (I guess most don't) I'll use that from now on.
Appcleaner promises to safely delete app components that supposedly just moving the app icon to the thrash may not do.
I have no clue if this is false propaganda, but as it has 4/5 star ratings on some reputable sites I thought using it just in case.

I agree with you with respect to using Malwarebytes.

It roots out the very obvious malware, saving you time and effort.

Use a more thorough method, as suggested by Linc, if it doesn't work.

You seem to have a new variant of "VSearch." Please select the file named "com.apple.builing.plist" and press the space bar. A window containing text will open. Enlarge the window, if necessary, to show all the text, then post a screenshot that shows the contents. Be careful not to include any private information.

Start a reply to this message. Drag the image file into the editing window to upload it.