Q: Do I Have Viruses?

Click here and follow the instructions, or if there’s a type of adware not covered by them on the computer, these ones. If you'd rather not remove it manually, you can instead run MalwareBytes for Mac.

MalwareBytes is a removal tool and doesn't stop adware or other malware from getting onto the computer. It shouldn’t be relied on to prevent future incidents; instead, avoid downloading software from sources other than the Mac App Store or the developer websites.

(141569)

This is not a virus.  It's adware/malware.

Try to go to the apple in the top left corner of your screen.  Click on force quit and force quit safari.

Hold down shift key and reopened safari.  Downloaded malwarebytes by going to adwaremedic.com and remov adware/malware.  Restart computer, empty trash, clear history

Issue should be resolved.

Another thing you can try if you can not get all the Junk off that you need is to go into finder and sort all files and put them on an external HDD.  Then do a completely new fresh install. The way I did it on mine was

1. VERIFY THAT YOU DO HAVE ALL YOUR IMPORTANT STUFF BACKED UP ON THE EXTERNAL. YOU WILL TOTALLY WIPE EVERYTHING OFF THE DRIVE USING THE PROCESS BELOW.

2. Download OSX El Capitan

3. Partition your drive

     a. go into disk utility and make a partition (I recommend naming it El Capitan or something)

     b. I recommend at least a partition of 50 gbs but you can get away with 35 (smallest I have tried)

4. Once you have El Capitan downloaded click and drag it to your NEW hdd partition

5. Launch go through the install process 

6.Once that partition is up and running delete the other (older partition)

7. Then expand your new one to the entire size of the drive

8. Plug in your external and get all of the data you need and put it back onto your mac

9. Enjoy

This is like having a brand new computer while maintaining all of your old important stuff.  I did this and wow Im so happy

PS.DONT DOWNLOAD ANY JUNK FROM ONLINE YOU HAVE EVERYTHING YOU NEED ALREADY BUILT INTO THE MACHINE.

Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

You installed one or more variants of the "InstallMac" trojan. Please take the steps below to disable it.

The criminal behind this attack tries to make the malware hard to remove by varying the names of the files it installs. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

Back up all data before continuing.

1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

          Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return. A folder named "LaunchAgents" will open.

2. Inside the folder you just opened, there may be files with a name of any of these forms:

          something.AppRemoval.plist

          something.download.plist

          something.ltvbit.plist

          something.update.plist

Here something is usually a meaningless string, such as any of the following:

          Epolife

          InstallMac

          Javeview

          Kuklorest

          Manroling

          Otwexplain

These are examples, not a complete list. The string could be anything. The point is that the same string will usually appear in the name of three or four files.

Lately, the "InstallMac" attacker has been scrambling the strings "AppRemoval," "download," "ltvbit," and "update" in the names of his files. For example, you might see file names such as these, instead of the above:

          something.AppVemoral.plist

          something.dolnwoad.plist

          something.btvlit.plist

          something.uadpte.plist

You could have more than one copy of the malware, with different values of something.

Move all such items to the Trash. If there are any other files with a name that begins with something, move those to the Trash also. You may get an alert that some of the files are locked; delete them anyway.

After you've done that, there may not be anything left in the LaunchAgents folder; in that case, you can delete the folder, but otherwise don't delete it. Other files in the folder are not necessarily malicious (though they could be, if you also installed some other kind of malware.)

Log out or restart the computer. The trojan should now be inactive.

3. This step is optional. Open the following folder as in Step 1:

~/Library/Application Support

and move to the Trash any subfolders with the name something that you found in Step 2.

Don't move the Application Support folder or anything else inside it.

4. Open the Applications folder. If there is an item named something, or "Zip Devil," or with any of the other names listed in Step 2, drag it to the Trash.

If in doubt, press the key combination option-command-4 to arrange the apps by date added. Look at the apps that have been added since you first noticed the problem. If there is one you don't recognize, drag it to the Trash.

You may get an alert that the item is locked. Confirm that you want to move it to the Trash.

Empty the Trash.

If you get an alert that the application is in use, force it to quit.

5. From the Safari menu bar, select

          Safari ▹ Preferences... ▹ Extensions

Uninstall all extensions you don't know you need. If in doubt, remove all of them. None is required for normal operation. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.

If the Preference window won't open, restart the computer in safe mode. Certain caches maintained by the system will be rebuilt.

6. Reset the search engine and the home page in each of your browsers, if either was changed. In Safari, first load the home page you want, then select

          Safari ▹ Preferences... ▹ General

and click

          Set to Current Page