I accidentally installed adware on my mac a month ago. I was getting pop ups like crazy. I removed mackeeper by moving it to the trash and emptying the trash but I still get an ad every time I restart my Mac. I am a little worried this has gone on as long as it has.
Is there a legit apple software that I can install to clean my Mac.
I upgraded to El Capitan but it still has that ad.
iMac, iOS 9.3.2
Quit Safari from the Apple > Force Quit menu. Relaunch Safari from the Dock icon while holding down the Shift key.
Reading this might also be helpful.
Mac Malware Guide: How do I protect myself? http://www.thesafemac.com/mmg-defense/
You may have installed ad-injection malware ("adware").
Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.
Back up all data first.
If you're not already running the latest version of OS X, updating or upgrading in the App Store may cause the adware to be removed automatically. If you are already running the latest version, please log out or restart the computer. Again, some kinds of malware will be removed—not all. There is no such thing as automatic removal of all possible malware, either by OS X or by third-party software. That's why you can't rely on software to protect you.
If the malware is removed in your case, you'll still need to make changes to the way you use the computer to protect yourself from further attacks. Ask if you need guidance.
If the malware is not removed automatically, see below.
This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.
Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.
If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. The malware will be disabled temporarily.
Step 1
Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:
~/Library/LaunchAgents
In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.
If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.
There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.
Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.
Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.
Leave the folder open for now.
Step 2
Do as in Step 1 with this line:
/Library/LaunchAgents
The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.
Step 3
Repeat with this line:
/Library/LaunchDaemons
This time the folder will be named "LaunchDaemons."
Step 4
Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.
Step 5
If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.
Try running this program and then copy and paste the output in a reply. The program was created by Etresoft, a frequent contributor. Please use copy and paste as screen shots can be hard to read. Click “Share Report” button in the toolbar, select “Copy to Clipboard” and then paste into a reply. This will show what is running on your computer. No personal information is shown.
Hi Linc,
Thank you for your detailed steps. I am following it now and I am post the screenshots I took for step 1. I also am posting a screen shot of the actual type of pop up.
I will continue with the steps now and let you know how its going.
Thank you!
Chris
You installed a fake "utility" called "Advanced Mac Cleaner" and/or "AdwareCleaner." Like any software that purports to automatically "clean up" or "speed up" a Mac, it's a scam.
To inactivate it, please take the steps below. This procedure may leave a few small files behind, but they have no effect, and trying to remove them all would be more trouble than it's worth.
Some of the files listed may be absent in your case. Back up all data before proceeding.
Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.
If you paid for the software with a credit card, consider reporting the charge to the bank as fraudulent.
Triple-click anywhere in the line below on this page to select it:
~/Library/LaunchAgents
Right-click or control-click the highlighted line and select
Services ▹ Open
from the contextual menu.* A folder named "LaunchAgents" may open. If it does, look inside it for files with a name that begins in either of these ways:
com.pcv.
com.adwarecleaner.
Move any such files to the Trash.
Log out or restart the computer and empty the Trash.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.
The malware is now permanently inactivated, as long as you don't reinstall it.
The problem started when you downloaded something, perhaps an application called "FileZilla" or "NicePlayer," when prompted to do so by a popup on a website. Never visit that site again. All legitimate software should be downloaded directly from the developer's website or from the Mac App Store, if applicable.
"Advanced Mac Cleaner" may have been bundled with other malware that was installed at the same time. If you still have problems with web browsers after removing it, ask for instructions.
Ok,
So I repeated the steps that you provided and posted the pics here beginning from step 1 again.
I saw two items that I was not familiar with and I googled them as well and lo and behold they are the adware that infected my mac. I also spotted one of your posts with a user that had the same problems in which you provided directions to remove those items so I went ahead and did that. Trashed those items and restarted and so far so good. No pop ups. I noticed that when I opened Chrome to check the extensions (which I use for work since we use Google Apps at work) I saw that the homepage was hijacked by a yahoo search which I never use. I think someone in my family was using Chrome and clicked something. Safari had no extensions. Thank you for your help Linc and I will be more careful next time.
Chris
Screenshot
Thank you
Screenshot
Hi! I have a similar problem. I can't open any webpage either through safari or chrome. I was only able to do so on safe mode. I'm using a macbook air 10.10.5
I followed the steps you have outlined and am attaching the screenshots. Hope you can help me out!
Thanks in advance!
You might want to consider starting a new discussion. Since this one is marked solved, less people are likely to look at it. A new post would be much more visible. You can link to this one. See Linc Davis's 5 Jul 14 post for vsearch.
Legitimate program to clean Mac
