HT203987: Stop pop-up ads in Safari

Learn about Stop pop-up ads in Safari
Veritech99

Q: Legitimate program to clean Mac

I accidentally installed adware on my mac a month ago.  I was getting pop ups like crazy.  I removed mackeeper by moving it to the trash and emptying the trash but I still get an ad every time I restart my Mac.  I am a little worried this has gone on as long as it has. 

 

Is there a legit apple software that I can install to clean my Mac.

 

I upgraded to El Capitan but it still has that ad. 

iMac, iOS 9.3.2

Posted on Jun 22, 2016 7:09 PM

Close

Q: Legitimate program to clean Mac

  • All replies
  • Helpful answers

  • by Rysz,

    Rysz Rysz Jun 22, 2016 8:17 PM in response to Veritech99
    Level 6 (19,670 points)
    iTunes
    Jun 22, 2016 8:17 PM in response to Veritech99

    Quit Safari from the Apple > Force Quit menu. Relaunch Safari from the Dock icon while holding down the Shift key.

     

    Reading this might also be helpful.

    Mac Malware Guide: How do I protect myself?  http://www.thesafemac.com/mmg-defense/

  • by Linc Davis,Solvedanswer

    Linc Davis Linc Davis Jun 30, 2016 6:58 AM in response to Veritech99
    Level 10 (207,915 points)
    Applications
    Jun 30, 2016 6:58 AM in response to Veritech99

    You may have installed ad-injection malware ("adware").

    Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

    Back up all data first.

    If you're not already running the latest version of OS X, updating or upgrading in the App Store may cause the adware to be removed automatically. If you are already running the latest version, please log out or restart the computer. Again, some kinds of malware will be removed—not all. There is no such thing as automatic removal of all possible malware, either by OS X or by third-party software. That's why you can't rely on software to protect you.

    If the malware is removed in your case, you'll still need to make changes to the way you use the computer to protect yourself from further attacks. Ask if you need guidance.

    If the malware is not removed automatically, see below.

    This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.

    Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

    If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. The malware will be disabled temporarily.

    Step 1

    Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

    ~/Library/LaunchAgents

    In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

    If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

    There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

    Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

    Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

    Leave the folder open for now.

    Step 2

    Do as in Step 1 with this line:

    /Library/LaunchAgents

    The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

    Step 3

    Repeat with this line:

    /Library/LaunchDaemons

    This time the folder will be named "LaunchDaemons."

    Step 4

    Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

    Step 5

    If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

  • by Eric Root,

    Eric Root Eric Root Jun 23, 2016 6:47 AM in response to Veritech99
    Level 9 (69,536 points)
    iTunes
    Jun 23, 2016 6:47 AM in response to Veritech99

    Try running this program and then copy and paste the output in a reply. The program was created by Etresoft, a frequent contributor.  Please use copy and paste as screen shots can be hard to read. Click “Share Report” button in the toolbar, select “Copy to Clipboard” and then paste into a reply. This will show what is running on your computer. No personal information is shown.
      

    Etrecheck – System Information

  • by Veritech99,

    Veritech99 Veritech99 Jun 30, 2016 6:22 AM in response to Linc Davis
    Level 1 (6 points)
    Safari
    Jun 30, 2016 6:22 AM in response to Linc Davis

    Hi Linc,

     

    Thank you for your detailed steps.  I am following it now and I am post the screenshots I took for step 1.  I also am posting a screen shot of the actual type of pop up. 

     

    I will continue with the steps now and let you know how its going.

     

    Thank you!

     

    Chris

     

    Screen Shot 2016-06-30 at 9.21.47 AM.png

    Screen Shot 2016-06-30 at 9.20.50 AM.png

  • by Linc Davis,Helpful

    Linc Davis Linc Davis Jun 30, 2016 7:00 AM in response to Veritech99
    Level 10 (207,915 points)
    Applications
    Jun 30, 2016 7:00 AM in response to Veritech99

    You installed a fake "utility" called "Advanced Mac Cleaner" and/or "AdwareCleaner." Like any software that purports to automatically "clean up" or "speed up" a Mac, it's a scam.

    To inactivate it, please take the steps below. This procedure may leave a few small files behind, but they have no effect, and trying to remove them all would be more trouble than it's worth.

    Some of the files listed may be absent in your case. Back up all data before proceeding.

    Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

    If you paid for the software with a credit card, consider reporting the charge to the bank as fraudulent.

    Triple-click anywhere in the line below on this page to select it:

    ~/Library/LaunchAgents

    Right-click or control-click the highlighted line and select

              Services Open

    from the contextual menu.* A folder named "LaunchAgents" may open. If it does, look inside it for files with a name that begins in either of these ways:

              com.pcv.

              com.adwarecleaner.

    Move any such files to the Trash.

    Log out or restart the computer and empty the Trash.

    *If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination  command-C. In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

    The malware is now permanently inactivated, as long as you don't reinstall it.

    The problem started when you downloaded something, perhaps an application called "FileZilla" or "NicePlayer," when prompted to do so by a popup on a website. Never visit that site again. All legitimate software should be downloaded directly from the developer's website or from the Mac App Store, if applicable.

    "Advanced Mac Cleaner" may have been bundled with other malware that was installed at the same time. If you still have problems with web browsers after removing it, ask for instructions.

  • by Veritech99,

    Veritech99 Veritech99 Jun 30, 2016 6:56 AM in response to Linc Davis
    Level 1 (6 points)
    Safari
    Jun 30, 2016 6:56 AM in response to Linc Davis

    Ok,

     

    So I repeated the steps that you provided and posted the pics here beginning from step 1 again. 

     

    Screen Shot 2016-06-30 at 9.21.47 AM.pngScreen Shot 2016-06-30 at 9.24.52 AM.pngScreen Shot 2016-06-30 at 9.23.39 AM.pngScreen Shot 2016-06-30 at 9.26.59 AM.png

     

    I saw two items that I was not familiar with and I googled them as well and lo and behold they are the adware that infected my mac.  I also spotted one of your posts with a user that had the same problems in which  you provided directions to remove those items so I went ahead and did that.  Trashed those items and restarted and so far so good.  No pop ups.  I noticed that when I opened Chrome to check the extensions (which I use for work since we use Google Apps at work) I saw that the homepage was hijacked by a yahoo search which I never use.  I think someone in my family was using Chrome and clicked something.  Safari had no extensions.  Thank you for your help Linc and I will be more careful next time. 

     

    Chris

  • by camistripes,

    camistripes camistripes Jul 19, 2016 1:33 AM in response to Veritech99
    Level 1 (4 points)
    Safari
    Jul 19, 2016 1:33 AM in response to Veritech99

    Screenshot

    Thank you

    ScreenshotCaptura de pantalla 2016-07-19 a las 3.12.19 a.m..png

    Captura de pantalla 2016-07-19 a las 3.28.27 a.m..png

  • by Eric Root,

    Eric Root Eric Root Jul 19, 2016 6:32 AM in response to camistripes
    Level 9 (69,536 points)
    iTunes
    Jul 19, 2016 6:32 AM in response to camistripes
  • by pol28,

    pol28 pol28 Sep 5, 2016 9:53 AM in response to Linc Davis
    Level 1 (4 points)
    Safari
    Sep 5, 2016 9:53 AM in response to Linc Davis

    Hi! I have a similar problem. I can't open any webpage either through safari or chrome. I was only able to do so on safe mode. I'm using a macbook air 10.10.5

     

    I followed the steps you have outlined and am attaching the screenshots. Hope you can help me out!

     

    Thanks in advance!

     

    Screen Shot 2016-09-06 at 12.36.05 AM.png

    Screen Shot 2016-09-06 at 12.38.39 AM.png

     

    Screen Shot 2016-09-06 at 12.39.06 AM.png

  • by Eric Root,

    Eric Root Eric Root Sep 5, 2016 10:28 AM in response to pol28
    Level 9 (69,536 points)
    iTunes
    Sep 5, 2016 10:28 AM in response to pol28

    You might want to consider starting a new discussion. Since this one is marked solved, less people are likely to look at it. A new post would be much more visible. You can link to this one. See Linc Davis's 5 Jul 14 post for vsearch.

     

     

    Spotify Uninstall


    Vsearch-a in fseventsd