rgarrett

Q: What is crushviral? Its running in Safari

I have a late 2010 MacBook Air running OS X El Capitan. Soon after starting Safari, the computer runs hot and slows down considerably. When I look at Activity Monitor, I see that a process is running in conjunction with Safari called crushviral.com and that it seems to occupy a lot of CPU cycles and consumes a significant amount of energy.

 

I've searched the Apple Community and done a Google search for CrushViral.com - Google shows it is some kind of social website.  There doesn't seem to be any indication that it is a virus or infects one's computer.

 

Any thoughts would be much appreciated!

Posted on Jul 15, 2016 7:34 AM

Close

Q: What is crushviral? Its running in Safari

  • All replies
  • Helpful answers

  • by Linc Davis,

    Linc Davis Linc Davis Jul 15, 2016 7:48 AM in response to rgarrett
    Level 10 (207,926 points)
    Applications
    Jul 15, 2016 7:48 AM in response to rgarrett

    Please quit and relaunch Safari. Any change?

  • by rgarrett,

    rgarrett rgarrett Jul 15, 2016 8:04 AM in response to Linc Davis
    Level 1 (14 points)
    Notebooks
    Jul 15, 2016 8:04 AM in response to Linc Davis

    When I quit Safari and relaunch, the problem returns.  Safari is slow, sometimes unresponsive and my fan runs.  In turn the whole system slows down. I am in the process of checking out this idea from Apple (If Safari is slow, stops responding, quits unexpectedly, or has other issues - Apple Support)  which tells me not to remove certain plug-ins and yet at least one is not present, the QuickTime Plugin.plugin

     

    I appreciate your help.

  • by rgarrett,

    rgarrett rgarrett Jul 15, 2016 8:09 AM in response to Linc Davis
    Level 1 (14 points)
    Notebooks
    Jul 15, 2016 8:09 AM in response to Linc Davis

    An update, Quick Time PlugIn.plugin and nslQTScriptablePlugin.xpt are both in a folder labeled 'Disabled Plug-ins' and yet Apple's advice is to not remove those.

  • by rgarrett,

    rgarrett rgarrett Jul 15, 2016 8:20 AM in response to Linc Davis
    Level 1 (14 points)
    Notebooks
    Jul 15, 2016 8:20 AM in response to Linc Davis

    If you take a look at the CPU load graph, you'll see a big spike just after I started Safari (and at which point http://crushviral.com reappeared)

    Screen Shot 2016-07-15 at 9.18.01 AM.png

  • by Linc Davis,

    Linc Davis Linc Davis Jul 15, 2016 10:10 AM in response to rgarrett
    Level 10 (207,926 points)
    Applications
    Jul 15, 2016 10:10 AM in response to rgarrett

    Please disable all Safari extensions and test. If the problem is resolved, re-enable the extensions one or a few at a time until you find the culprit.

  • by rgarrett,

    rgarrett rgarrett Jul 15, 2016 10:12 AM in response to Linc Davis
    Level 1 (14 points)
    Notebooks
    Jul 15, 2016 10:12 AM in response to Linc Davis

    Hello Linc. I did disable my only extension, LastPass. It did not resolve the problem. Thanks for the idea!

  • by Linc Davis,

    Linc Davis Linc Davis Jul 15, 2016 10:15 AM in response to rgarrett
    Level 10 (207,926 points)
    Applications
    Jul 15, 2016 10:15 AM in response to rgarrett

    Please read this whole message before doing anything.

    This procedure is a diagnostic test. It’s unlikely to solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.

    The purpose of the test is to determine whether the problem is caused by third-party software that loads automatically at startup or login, by a peripheral device, by a font conflict, or by corruption of the file system or of certain system caches.

    Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards, if applicable. Start up in safe mode and log in to the account with the problem.

    Note: If FileVault is enabled in OS X 10.9 or earlier, or if a firmware password is set, or if the startup volume is a software RAID, you can’t do this. Ask for further instructions.

    Safe mode is much slower to start up and run than normal, with limited graphics performance, and some things won’t work at all, including sound output and Wi-Fi on certain models. The next normal startup may also be somewhat slow.

    The login screen appears even if you usually login automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.

    Test while in safe mode. Same problem?

    After testing, restart as usual (not in safe mode) and verify that you still have the problem. Post the results of the test.

  • by rgarrett,

    rgarrett rgarrett Jul 17, 2016 5:50 PM in response to Linc Davis
    Level 1 (14 points)
    Notebooks
    Jul 17, 2016 5:50 PM in response to Linc Davis

    Hello Linc, I booted into Safe Mode as recommended. Yes, it was slow and no, it didn't help solve my problem.  Safari still runs slowly (both in Safe Mode and after restarting). The fan runs and the whole system slows down. On the upside, crushviral.com is not showing up in Activity Monitor any longer.  Also, it might interest you to know that Firefox does not impact my computer at all in the ways that Safari does. I really appreciate your help.

  • by Linc Davis,

    Linc Davis Linc Davis Jul 18, 2016 2:49 PM in response to rgarrett
    Level 10 (207,926 points)
    Applications
    Jul 18, 2016 2:49 PM in response to rgarrett

    Please back up all data before proceeding.

    Quit Safari if it’s running.

    Step 1

    Hold down the option key and select

              Go Library

    from the Finder menu bar. A folder named "Library" will open.

    Delete the following items from the Library folder (some may not exist):

              Caches/com.apple.Safari

              Caches/com.apple.Safari.SearchHelper

              Caches/com.apple.SafariServices

              Caches/com.apple.WebKit.PluginProcess

              Caches/com.apple.WebProcess

              Caches/Metadata/Safari

              Preferences/com.apple.WebKit.PluginHost.plist

              Preferences/com.apple.WebKit.PluginProcess.plist

              Saved Application State/com.apple.Safari.savedState

              WebKit/com.apple.Safari

    Leave the Library folder open. Try Safari again. If the problem is solved, stop here. Close the Library folder. If you still have a problem, continue.

    Step 2

    Move the following items from the open Library folder to the Desktop (again, some may not exist):

              Cookies/Cookies.binarycookies

              Cookies/com.apple.Safari.SearchHelper.binarycookies

              Internet Plug-Ins

              Preferences/ByHost/com.apple.Safari.*.plist

              Preferences/com.apple.Safari.Extensions.plist

              Preferences/com.apple.Safari.LSSharedFileList.plist

              Preferences/com.apple.Safari.plist

              Preferences/com.apple.WebFoundation.plist

              PubSub/Database

              Safari

              SyncedPreferences/com.apple.Safari-com.apple.Safari.UserRequests.plist

              SyncedPreferences/com.apple.Safari.plist

    Here, "*" stands for a long string of letters, numbers, and dashes.

    Note 1: You are not moving the Safari application. You’re moving a folder named “Safari.”

    Note 2: This step will remove your Safari extensions, if any, and their settings. If you choose to reinstall them, do so one at a time, testing each time to make sure you haven’t restored the problem.

    Try again. Your settings and bookmarks will be lost. The default set of bookmarks will be restored. Delete them all.

    If Safari is now working normally (apart from the lost settings), look inside the “Safari” folder on the Desktop for a file named “Bookmarks.plist”. Select

              File Import From Bookmarks HTML File... (or Import Bookmarks...)

    from the Safari menu bar. Import from that file. Recreate the rest of your Safari settings. You can then delete the items you moved to the Desktop.

    If the issue is still not resolved, quit Safari again and put all the items you moved to the Desktop back where they were, overwriting the newer ones that may have been created in their place. You don’t need to replace the files you deleted in Step 1. Stop here and post again.

    If you don’t like the results of the last step, you can undo it completely by quitting Safari and restoring the items you moved or deleted in that step from your backup, overwriting any that were created in their place.