ThirdEye

Q: Pop up Virus Alert won't go away in Safari

I keep getting these pop-up windows (I have pop-ups disabled) for some sort of virus removal scam.  I've run Cocktail and Permissions Repair and deleted all History ... nothing helps.  Not only are these windows disrupting my usage of Safari, they have also changed my default browser from Google to Yahoo even though the box is checked for Google.  Screen Shot 2016-06-06 at 9.43.14 AM.png

I am totally lost on this one ... anybody else dealing with this?

 

Tommy Holt

Mac Pro, OS X Mavericks (10.9.5), 2009, 2.66 GHz Quad-Core, 32GB Mem

Posted on Jun 6, 2016 7:57 AM

Close

Q: Pop up Virus Alert won't go away in Safari

  • All replies
  • Helpful answers

Page 1 Next
  • by Linc Davis,Solvedanswer

    Linc Davis Linc Davis Jun 6, 2016 8:57 AM in response to ThirdEye
    Level 10 (208,000 points)
    Applications
    Jun 6, 2016 8:57 AM in response to ThirdEye

    Please disable all Safari extensions and test. If the problem is resolved, re-enable the extensions one or a few at a time until you find the culprit.

  • by stevejobsfan0123,

    stevejobsfan0123 stevejobsfan0123 Jun 6, 2016 8:54 AM in response to ThirdEye
    Level 8 (43,853 points)
    iPhone
    Jun 6, 2016 8:54 AM in response to ThirdEye

    Download and run MalwareBytes, and see if any adware is found: http://malwarebytes.org/antimalware/mac.

  • by pinkstones,

    pinkstones pinkstones Jun 6, 2016 8:55 AM in response to ThirdEye
    Level 5 (4,209 points)
    Safari
    Jun 6, 2016 8:55 AM in response to ThirdEye

    It sounds like you might have adware or malware installed on your computer.  You have two options available to remove it. 

     

    • Download Malwarebytes' Anti-Malware for Mac.  It was developed by a trusted and respected contributor here.  It's a simple, non-intrusive program that deletes known malware/adware from your hard drive.  That's all it does.  It doesn't add anything and it doesn't take away anything else.  Unlike anti-virus programs, it doesn't run in the background of your computer, using up resources, and also unlike anti-virus programs (which are unnecessary on Macs), it doesn't actively prevent malware or adware infections.  Its sole purpose is removing them.
    • Restart your computer.  As of April 26, 2016, changes made to the support article here --> https://support.apple.com/en-us/HT203987 state that El Capitan removes adware at login, but only at login.  So, if you don't want to use Malwarebytes, this is another option for you.

     

    Next, go to Safari Preferences --> Extensions and delete any you don't remember installing or that you don't need.  Then, go to Safari Preferences --> Search and change your preferred search engine back to Google.  Lastly, go to Safari Preferences --> General and make sure your homepage has not been changed, and if it has, change it back to what it was before.  In the future, only download applications/plugins/extensions/drivers from either the Mac App Store/Safari Extensions Gallery or the developer's own website. 

  • by Linc Davis,

    Linc Davis Linc Davis Jun 6, 2016 9:00 AM in response to ThirdEye
    Level 10 (208,000 points)
    Applications
    Jun 6, 2016 9:00 AM in response to ThirdEye

    Never use any kind of "anti-virus" or "anti-malware" software on a Mac. That's how you cause problems, not how you solve them.

  • by ThirdEye,

    ThirdEye ThirdEye Jun 6, 2016 9:04 AM in response to Linc Davis
    Level 1 (4 points)
    Safari
    Jun 6, 2016 9:04 AM in response to Linc Davis

    I looked in the Safari extensions pref and found a suspicious looking extension and deleted it.  This appears to be the solution.  Thanks to everyone for your help!!

     

    Tommy Holt

  • by ThirdEye,

    ThirdEye ThirdEye Jun 6, 2016 9:28 AM in response to Linc Davis
    Level 1 (4 points)
    Safari
    Jun 6, 2016 9:28 AM in response to Linc Davis

    Well, it looks like I spoke too soon.  The pop-up window has reappeared in Safari.  Now I am lost  :-(

     

    Tommy Holt

  • by stevejobsfan0123,

    stevejobsfan0123 stevejobsfan0123 Jun 6, 2016 9:44 AM in response to ThirdEye
    Level 8 (43,853 points)
    iPhone
    Jun 6, 2016 9:44 AM in response to ThirdEye

    Follow the other instructions you were already given.

  • by Linc Davis,

    Linc Davis Linc Davis Jun 6, 2016 11:03 AM in response to ThirdEye
    Level 10 (208,000 points)
    Applications
    Jun 6, 2016 11:03 AM in response to ThirdEye

    You may have installed ad-injection malware ("adware").

    Back up all data first.

    If you're not already running the latest version of OS X, updating or upgrading in the App Store may cause the adware to be removed automatically. If you are already running the latest version, please log out or restart the computer. Again, some kinds of malware will be removed—not all. There is no such thing as automatic removal of all possible malware, either by OS X or by third-party software. That's why you can't rely on software to protect you.

    If the malware is removed in your case, you'll still need to make changes to the way you use the computer to protect yourself from further attacks. Ask if you need guidance.

    If the malware is not removed automatically, see below.

    This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.

    Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

    If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. The malware will be disabled temporarily.

    Step 1

    Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

    ~/Library/LaunchAgents

    In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

    If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

    There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

    Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

    Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

    Leave the folder open for now.

    Step 2

    Do as in Step 1 with this line:

    /Library/LaunchAgents

    The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

    Step 3

    Repeat with this line:

    /Library/LaunchDaemons

    This time the folder will be named "LaunchDaemons."

    Step 4

    Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

    Step 5

    If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

  • by ThirdEye,

    ThirdEye ThirdEye Jun 6, 2016 11:16 AM in response to Linc Davis
    Level 1 (4 points)
    Safari
    Jun 6, 2016 11:16 AM in response to Linc Davis

    Okay, I did everything as you described. Steps 1 and 2 had no results.  Step 3 gave me the folder (screenshot) posted here.  Step 4, there are no extensions listed.

     

    Am I supposed to do something with the folder named LaunchDaemons?  I feel like I'm missing something since nothing will have changed.

     

    Tommy HoltLaunchDaemons.png

  • by Linc Davis,

    Linc Davis Linc Davis Jun 6, 2016 11:21 AM in response to ThirdEye
    Level 10 (208,000 points)
    Applications
    Jun 6, 2016 11:21 AM in response to ThirdEye

    There is no malware.

    From the menu bar, please select

              ▹ System Preferences... ▹ Network ▹ Advanced... ▹ DNS

    Under DNS Servers you should have one or more numerical addresses, such as “192.168.1.1” or “10.0.0.1”. What are those addresses?

  • by ThirdEye,

    ThirdEye ThirdEye Jun 6, 2016 12:49 PM in response to Linc Davis
    Level 1 (4 points)
    Safari
    Jun 6, 2016 12:49 PM in response to Linc Davis

    Under DNS Servers: 192.168.1.254

     

    That's it.

     

    Tommy

  • by Linc Davis,

    Linc Davis Linc Davis Jun 6, 2016 12:52 PM in response to ThirdEye
    Level 10 (208,000 points)
    Applications
    Jun 6, 2016 12:52 PM in response to ThirdEye

    Are you revisiting the same website where you originally saw the popups? Is the search engine still being changed to Yahoo?

  • by ThirdEye,

    ThirdEye ThirdEye Jun 6, 2016 12:55 PM in response to Linc Davis
    Level 1 (4 points)
    Safari
    Jun 6, 2016 12:55 PM in response to Linc Davis

    The website where I first noticed it is just my homepage (local weather).  I am not now seeing that pop-up anymore.  Last one I saw was when I posted the retraction earlier.

     

    Tommy

  • by ThirdEye,

    ThirdEye ThirdEye Jun 6, 2016 12:57 PM in response to Linc Davis
    Level 1 (4 points)
    Safari
    Jun 6, 2016 12:57 PM in response to Linc Davis

    Oh, and no, the search engine does not seem to be changing anymore.

     

    Tommy

Page 1 Next