How to remove ad pop ups

I have been getting pop up ads from pages that say "advance mac cleaner", "free rewards" and some survey ones as well. It started last week after I mistakenly clicked on a pop up that either said said my flash was out of date or it was an Adobe update. The ads started that day. I use Safari almost exclusively but do have Chrome installed. When I checked Chrome the page that loaded was Chumsearch.com. That was never my home page for Chrome. I checked my applications folder and there was something in there called Coupon something and I believe MacOpitimizer. I trashed those but am still having the pop up problem. I downloaded Malwarebytes, ran the scan and deleted the things it found yet I still have the pop ups. I'm assuming I've installed some adware that I didn't know I was doing. My iMac says I am running OS X El Capitan 10.11.6 and Safari says I am running version 10.0.1.

Can anyone please help me? I am not tech savvy at all.

VIN, iMac (21.5-inch Mid 2010), OS X El Capitan (10.11.6)

Posted on Nov 29, 2016 3:13 PM

20 replies

thomas_r.

Level 7

32,031 points

Dec 2, 2016 4:40 AM in response to klsaxt

I've seen some other similar reports now, all with the same com.trt.opaoc.plist file. So, it looks like either the trt.com site isn't as trustworthy as it appears, or someone is using that domain in the filename as a decoy.

Delete that file. Also, go to the following folder:

~/Library/Application Support/

From there, delete the folder named BioJednomJedanApp.

klsaxt Author

Level 1

8 points

Dec 2, 2016 10:34 AM in response to thomas_r.

Going to delete those right now. I saw the BioJednomJedanApp in the Application Support folder and it is time stamped as the same time as the MacOptimizer log. I could not find anything on the web about it. I'm trashing them and restarting the computer. Aside from (hopefully) not seeing the pop up ads any longer, how will I know I've completely gotten rid of this thing?

thomas_r.

Level 7

32,031 points

Dec 2, 2016 10:51 AM in response to klsaxt

I've seen a couple other cases, and it looks like the com.trt.opaoc.plist file and BioJednomJedanApp folders are the only components of that particular adware, as far as I can tell. We've got those added to the Malwarebytes Anti-Malware for Mac signatures now.

Do you happen to know what was downloaded and installed that would have caused this infection? I'd feel much better telling you that it's gone if I could analyze that installer and see what it drops.

klsaxt Author

Level 1

8 points

Dec 2, 2016 12:15 PM in response to thomas_r.

There was a pop up page that came up over the web page I was on that said my flash was out of date & to click for the update. I thought it was from Adobe and clicked it. Two seconds after I did it I realized it was not legit. The ads started right after that. The page looked like the flash updates from Adobe to me. I don't remember what web page I was looking at when it happened--it was NOT any adult type sight--probably Pinterest, Facebook or something like that.

I went back into the back ups from my external hard drive and looked at the logs from last week. I compared the logs from November 22 (the day before), November 23 (the day it started) and November 24. I saw a thing in the Applications folder on November 23 that said "My Updater". It was not on the log from the day before. It was removed the day I first ran the Malwarebyte's scanner.

I also looked at the Home->Library->Launch Agents files for those days and the same applied as what I said above. The suspicious files (the txt and BioJednam ones) were not there on November 22 but the day after.

If those files are on the external backup can it still get back into my computer?

BDAqua

Level 10

250,259 points

Nov 30, 2016 9:59 AM in response to klsaxt

So, how is it running after it removed those items & you restarted?

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

How to remove ad pop ups