How do I remove "around the web" pop ups?
How do I remove "around the web" pop ups from Safari on my macbook air?
MacBook Air, OS X El Capitan (10.11.4)
How do I remove "around the web" pop ups from Safari on my macbook air?
MacBook Air, OS X El Capitan (10.11.4)
Download and run Malwarebytes Anti-Malware: http://www.adwaremedic.com/index.php
You can also remove the adware manually using the steps provided by Apple: https://support.apple.com/en-us/HT203987
After that, make sure your default search engine is set to the one you always use. To do so, Open Safari - Preferences - Search.
Go to Safari menu (At the very top right side of your screen next to Apple icon), choose "Quit Safari"
press "Shift" button and while holding this button on your keyboard single click on the Safari icon on your Dock.
Open Safari - Preferences - Privacy - Remove All Website Data.
Also, I believe it would be a good idea to install AdBlock.
Download and run Malwarebytes Anti-Malware: http://www.adwaremedic.com/index.php
You can also remove the adware manually using the steps provided by Apple: https://support.apple.com/en-us/HT203987
After that, make sure your default search engine is set to the one you always use. To do so, Open Safari - Preferences - Search.
Go to Safari menu (At the very top right side of your screen next to Apple icon), choose "Quit Safari"
press "Shift" button and while holding this button on your keyboard single click on the Safari icon on your Dock.
Open Safari - Preferences - Privacy - Remove All Website Data.
Also, I believe it would be a good idea to install AdBlock.
You inadvertently installed adware. You do not need to download or install anything to fix it.
For a description of how this may have occurred, how to avoid it in the future, and for Apple's recommended actions read How to install adware. Apple's instructions are linked in the Recovery Procedure near the end of that document. Read and follow them carefully. Pay particular attention to the easily overlooked passages directing you to restart your Mac when required.
Review your Gatekeeper settings: OS X : About Gatekeeper - Apple Support. Gatekeeper is designed to help prevent you from inadvertently installing garbage software.
You may have installed ad-injection malware ("adware").
Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.
Back up all data first.
Some of the most common types of adware can be removed by following Apple's instructions. But before you follow those instructions, you can attempt an automatic removal.
If you're not already running the latest version of OS X ("El Capitan"), updating or upgrading in the App Store may cause the adware to be removed automatically. If you're already running the latest version of El Capitan, you can nevertheless download the current updater from the Apple Support Downloads page and run it. Again, some kinds of malware will be removed—not all. There is no such thing as automatic removal of all possible malware, either by OS X or by third-party software. That's why you can't rely on software to protect you.
If the malware is removed in your case, you'll still need to make changes to the way you use the computer to protect yourself from further attacks. Ask if you need guidance.
If the malware is not removed automatically, and you can't remove it yourself by following Apple's instructions, see below.
This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.
Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.
If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. That will disable the malware temporarily.
Step 1
Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:
~/Library/LaunchAgents
In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.
If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.
There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.
Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.
Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.
Leave the folder open for now.
Step 2
Do as in Step 1 with this line:
/Library/LaunchAgents
The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.
Step 3
Repeat with this line:
/Library/LaunchDaemons
This time the folder will be named "LaunchDaemons."
Step 4
Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.
Step 5
If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.
A
Below is a suggested procedure to inactivate the malware you installed.
Please back up all data before making any changes.
The numbers refer to the items in the screenshots, in the order shown. Use the screenshots as a guide. #1 would be the topmost item, #2 the one below, and so on.
The names in quotes refer to malware types, not to the names of the files. Don't expect the files to have similar names. For example, if you installed the "VSearch" malware, usually none of the files will have the word "VSearch" in the name. Malware attackers don't make it that easy for you.
You may be prompted for your administrator name and/or password when you delete some of the files listed below, or you may be prompted to confirm because a file is locked.
In the first folder arranged as shown in the screenshots, delete these items:
None
In the second folder:
None
In the third folder:
#5, #6, and #11 ("VSearch")
Restart the computer. Until you've done that, the malware will still be active, even after you delete the files.
Reset the Safari home page and search engine, if either was changed. You may need to do the same in other browsers.
From the Applications folder (not shown in the screenshots), delete items with any of the following names:
MPlayerX
PDF Pronto
These steps will permanently inactivate the malware, as long as you never reinstall it. A few small files may remain in hidden folders, but they have no effect.
The instructions above apply only to you. I'm including more general—and complete—self-contained removal instructions below for the benefit of others who may find this discussion. You can skip the remaining steps, but you should read them.
B (optional)
You may have installed one or more variants of the "VSearch" ad-injection malware. Please back up all data, then take the steps below to inactivate it.
Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.
Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.
The VSearch malware tries to hide itself by varying the names of the files it installs. To remove it, you must first identify the naming pattern.
1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:
/Library/LaunchDaemons
In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.
A folder named "LaunchDaemons" may open. If it does, press the key combination command-2 to select list view, if it's not already selected.
There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. Please don't skip this step. Files that belong to an instance of VSearch will have the same modification time to within about one minute, so they will be clustered together when you sort the folder this way, making them easy to identify.
Look inside the folder for files with a name of any of these forms:
com.something.daemon.plist
com.something.helper.plist
com.something.net-preferences.plist
Here something is a meaningless, random string of characters, which can be different in each instance of VSearch. So far it has always been an alphanumeric string without punctuation, such as "disbalance" or "thunderbearer."
You could have more than one copy of the malware, with different values of something.
There may also be one or more files with a name of this form:
com.somethingelseUpd.plist
where somethingelse may be a different meaningless string than something. Again, there may be more than one such file, with different values of somethingelse.
Here's a typical example of a VSearch infection:
com.disbalance.net-preferences.plist
com.thunderbearerUpd.plist
You will have files with names similar, but probably not identical, to these.
IMPORTANT: Lately the attacker has been breaking out of his usual naming pattern in an attempt to defeat this procedure. If you see any files in the LaunchDaemons folder that have a modification time within one minute of files that fit the pattern, those can be assumed to be part of the infection. The name may contain the word "apple" to make it look like part of OS X. Normally there would be no OS X files in that folder, and if there were any, they would have a different modification time. Ask if you're in doubt.
If you feel confident that you've identified the malicious files, drag just those files—nothing else—to the Trash. You may be prompted for your administrator login password. Close the Finder window.
2. Open this folder as in Step 1:
/Library/LaunchAgents
Move to the Trash any files with a name of the form
com.something.agent.plist
where something is one of the strings you found in Step 1. There may not be any such files.
3. If you moved anything to the Trash in Step 1 and/or Step 2, restart the computer and empty the Trash.
Don't delete the "LaunchAgents" or "LaunchDaemons" folder, or anything else inside either one, unless you know you have some other kind of unwanted software besides VSearch. The folders are a normal part of OS X. The terms "agent' and "daemon" refer to a program that starts automatically. That's not inherently bad, but the mechanism is sometimes exploited by malware attackers.
4. Reset the home page in each of your browsers, if it was changed. In Safari, first load the home page you want, then select
Safari ▹ Preferences... ▹ General
and click
Set to Current Page
The malware is now permanently inactivated, as long as you never reinstall it. A few small files will be left behind, but they have no effect, and trying to find them all is more trouble than it's worth.
5. If you didn't find the files or you're not sure about the identification, post what you found.
If in doubt, or if you have no backups, change nothing at all.
6. The trouble may have started when you downloaded and ran an application called "MPlayerX" or "PDF Pronto." If there is an item with either name in the Applications folder, delete it.
This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Then, still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates (OS X 10.10 or later)
or
Download updates automatically (OS X 10.9 or earlier)
if it's not already checked.
The malware files are #1 and #2 in the first screenshot. I don't know about the "downloader" extensions for Chrome. I would not trust such things.
A
You installed one or more variants of the "VSearch" trojan. Please inactivate them as follows. This procedure will leave a few small files behind, but they have no effect, and trying to remove them all would be a lot more trouble than it's worth.
This malware has many variants. Anyone else finding this comment should not expect it to be applicable.
Back up all data before proceeding.
The VSearch variant that you have regenerates itself if you try to delete it while it's running. To remove it, you must first start up in safe mode to disable the malware temporarily.
Note: If FileVault is enabled in OS X 10.9 or earlier, or if a firmware password is set, or if the startup volume is a software RAID, you can’t do this. Ask for other instructions.
While running in safe mode, triple-click anywhere in the line below on this page to select it:
/Library/LaunchDaemons
Right-click or control-click the line and select
Services ▹ Open
from the contextual menu.* A folder named "LaunchDaemons" should open.
Inside that folder there are one or more items with a name that begins like this:
com.apple.
There are also one or more items with a three-part name of this form:
com.something.plist
where something is a meaningless string of letters, different in every case. Typical examples:
com.semifasciaUpd.plist
com.ubuiling.plist
Drag all such items to the Trash. Also drag the file with "butterbird" in the name. You may be prompted for your administrator login password.
Restart the computer and empty the Trash.
Reset the home page in each of your web browsers, if it was changed. In Safari, first load the home page you want, then select
Safari ▹ Preferences... ▹ General
and click
Set to Current Page
If you use the Firefox and/or Chrome web browser, remove any extensions or add-ons that you don't know you need. If in doubt, remove all of them.
If the files come back after you have deleted them, or if they're replaced by others with similar names, then either you didn't start up in safe mode or you didn't get all of them. Try again.
The malware is now permanently inactivated, as long as you never reinstall it. A few small files will be left behind, but they have no effect, and trying to find them all is more trouble than it's worth.
B
"MacKeeper" is a scam with only one useful feature: it deletes itself.
If you have incompletely removed MacKeeper—for example, by dragging the application to the Trash and immediately emptying—then you'll have to reinstall it and start over.
Note: These instructions apply to the version of the product that I tested in early 2012. I haven't tested other versions, but so far I've had no reports of failure, and the issue comes up often.
IMPORTANT: "MacKeeper" has what the developer calls an “encryption” feature. In my tests, I didn't try to verify what this feature really does. If you used it to “encrypt” any of your files, “decrypt” them before you uninstall, or (preferably) restore the files from backups made before they were “encrypted.” As the developer is not trustworthy, you should assume that the "decrypted" files are corrupt unless proven otherwise.
Please back up all data before making any changes.
In the Finder, select
Go ▹ Applications
from the menu bar, or press the key combination shift-command-A. The "MacKeeper" application is in the folder that opens. Quit it if it's running, then drag it to the Trash. You'll be prompted for your login password. Click the Uninstall MacKeeper button in the dialog that appears. All the other functional components of the software will be deleted. Restart the computer and empty the Trash.
☞ Quit MacKeeper before dragging it to the Trash.
☞ Let MacKeeper delete its other components before you empty the Trash.
☞ Don't try to drag MacKeeper from the Dock or the Launchpad to the Trash.
☞ Don't try to remove MacKeeper while running in safe mode.
C
Until you have more experience as a Mac user, I suggest that you change a setting to allow only Apple updates and software from the App Store to be installed.
Open the Security & Privacy pane in System Preferences and select the General tab. Click the lock icon in the lower left corner and enter your password to unlock the settings. Select the button marked
Mac App Store
and close the preference pane. For information about the effects of the setting, see this support article. You may need to change the setting temporarily to install some third-party software, such as Adobe Flash Player. Be especially careful with that, as malware is often distributed in the form of a fake Flash update. Never follow a link to a Flash update on any web page. Instead, use the built-in updater in the Flash Player preference pane.
The products in the App Store, while they aren't always very good, can at least be considered safe enough to use.
How do I remove "around the web" pop ups?