You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

I need to get rid of this chill tab adware that keeps popping up even after I tried to delete in a number of ways. For Chrome, it doesn't show in my list of extensions so there isn't a way for me to delete it from there.

I used etrecheck and am posting the results here, if anyone could guide me through what and how I should get rid of it.
c

EtreCheck version: 3.4.6 (460)

Report generated 2018-01-14 15:08:25

Download EtreCheck from https://etrecheck.com

Runtime: 2:06

Performance: Excellent


Click the [Lookup] links for more information from Apple Support Communities.

Click the [Details] links for more information about that line.

Click the [Remove/Report] links to remove adware or update the whitelist of legitimate software.

Click the [Clean up] link to delete unused files.


Problem: Other problem

Description:

Chill tab virus


Hardware Information:

MacBook Air (13-inch, Early 2014)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Air - model: MacBookAir6,2

1 1.4 GHz Intel Core i5 (i5-4260U) CPU: 2-core

4 GB RAM Not upgradeable

BANK 0/DIMM0

2 GB DDR3 1600 MHz ok

BANK 1/DIMM0

2 GB DDR3 1600 MHz ok

Handoff/Airdrop2: supported

Wireless:
en0: 802.11 a/b/g/n/ac

Battery: Health = Normal - Cycle count = 541


Video Information:

Intel HD Graphics 5000 - VRAM: 1536 MB

Color LCD 1440 x 900


Disk Information:

APPLE SSD SD0128F disk0: (121.33 GB) (Solid State - TRIM: Yes)

[Show SMART report]

(disk0s1) <not mounted>
[EFI]: 210 MB

(disk0s2) <not mounted>
[CoreStorage Container]: 120.47 GB

(disk0s3) <not mounted>
[Recovery]: 650 MB


USB Information:

USB30Bus

Apple Inc. BRCM20702 Hub

Apple Inc. Bluetooth USB Host Controller


Thunderbolt Information:

Apple Inc. thunderbolt_bus


Virtual disks:

Untitled (disk1 - Journaled HFS+) /
[Startup]: 120.12 GB (39.93 GB free)

Encrypted AES-XTS (Unlocked)

Physical disk: disk0s2 120.47 GB Online


System Software:

OS X El Capitan 10.11.6 - Time since boot: less than an hour


Gatekeeper:

Mac App Store and identified developers


Possible adware:

Unknown file: ~/Library/LaunchAgents/com.habdalah.lp.plist

~/Library/habdalah.lp/habdalah.lp.app/Contents/MacOS/habdalah.lp

Unknown file: ~/Library/LaunchAgents/com.manucodiata.plist

~/Library/manucodiata/manucodiata

Unknown file: ~/Library/LaunchAgents/com.skewings-pappiform.plist

~/Library/lakist_graziery/DurlcLuf/vvLLCgwG/skewings-pappiform

Unknown file: ~/Library/LaunchAgents/com.tabefy.cc.plist

~/Library/tabefy.cc/tabefy.cc.app/Contents/MacOS/tabefy.cc

Adware: ~/Library/LaunchAgents/macsearch.plist

5 possible adware files found. [Remove/Report]


Clean up:

~/Library/LaunchAgents/com.iobit.MacBoosterMini6.plist

/Applications/MacBooster 6.app/Contents/Resources/MacBoosterMini.app/Contents/MacOS/MacboosterMini

Executable not found!

One orphan file found. [Clean up]


System Launch Agents:

[not loaded] 7 Apple tasks

[loaded] 156 Apple tasks

[running] 77 Apple tasks


System Launch Daemons:

[not loaded] 47 Apple tasks

[loaded] 158 Apple tasks

[running] 86 Apple tasks


Launch Agents:

[not loaded] com.adobe.AAM.Updater-1.0.plist (Adobe Systems, Inc. - installed 2017-03-23) [Lookup]

[running] com.adobe.AdobeCreativeCloud.plist (Adobe Systems, Inc. - installed 2017-07-26) [Lookup]


Launch Daemons:

[loaded] com.adobe.SwitchBoard.plist (? 68cad67 0 - installed 2017-03-23) [Lookup]

[loaded] com.adobe.acc.installer.plist (Adobe Systems, Inc. - installed 2017-09-23) [Lookup]

[running] com.adobe.adobeupdatedaemon.plist (Adobe Systems, Inc. - installed 2017-07-26) [Lookup]

[running] com.adobe.agsservice.plist (Adobe Systems, Inc. - installed 2017-09-25) [Lookup]

[loaded] com.adobe.fpsaud.plist (Adobe Systems, Inc. - installed 2017-12-15) [Lookup]

[running] com.iobit.MBHelpToolerDaemon.plist (Apperience Corporation - installed 2018-01-07) [Lookup]

[loaded] com.microsoft.office.licensing.helper.plist (? 6d8cb30e a77a86d3 - installed 2012-11-05) [Lookup]


User Launch Agents:

[loaded] com.adobe.AAM.Updater-1.0.plist (Adobe Systems, Inc. - installed 2016-09-17) [Lookup]

[failed] com.google.keystone.agent.plist (Google, Inc. - installed 2017-09-28) [Lookup]

[loaded] com.habdalah.lp.plist (? 3303386b 41109ad0 - installed 2018-01-02) [Lookup]

[failed] com.iobit.MacBoosterMini6.plist (? 4339b97e 0 - installed 2018-01-07) [Lookup] - /Applications/MacBooster 6.app/Contents/Resources/MacBoosterMini.app/Contents/MacOS/MacboosterMini: Executable not found!

[running] com.manucodiata.plist (? 54bb5d4c b342a111 - installed 2018-01-01) [Lookup]

[running] com.skewings-pappiform.plist (? 214a63b2 e1925981 - installed 2018-01-02) [Lookup]

[loaded] com.tabefy.cc.plist (? 251d6621 41109ad0 - installed 2017-12-30) [Lookup]

[loaded] macsearch.plist (? 9989e0fa 4f77794f - installed 2017-12-30) Adware!
[Remove/Report]

~/Library/Application Support/Agent/macsearch


User Login Items:

iTunesHelper Application (Apple, Inc. - installed 2017-11-10)

(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

com.adobe.SwitchBoard.monitor.plist MachInit - Hidden

(/etc/mach_init_per_user.d/com.adobe.SwitchBoard.monitor.plist)

Mach Init items are deprecated


Internet Plug-ins:

AdobeAAMDetect: 3.0.0.0 (installed 2017-07-26) [Lookup]

FlashPlayer-10.6: 28.0.0.137 (installed 2018-01-09) [Lookup]

QuickTime Plugin: 7.7.3 (installed 2017-11-10)

Flash Player: 28.0.0.137 (installed 2018-01-09) [Lookup]

Default Browser: 601 (installed 2016-07-09)

SharePointBrowserPlugin: 14.3.0 (installed 2016-07-25) [Lookup]

MeetingJoinPlugin: Unknown (installed 2016-07-25) [Lookup]

JavaAppletPlugin: 15.0.1 (installed 2016-12-01) Check version


Safari Extensions:

[enabled] Chill-Tab - Chill-Tab (installed 2018-01-13)


3rd Party Preference Panes:

Flash Player (installed 2017-12-15) [Lookup]


Time Machine:

Time Machine not configured!


Top Processes by CPU:

5%
WindowServer

4%
launchservicesd

4%
Google Chrome

4%
mdworker

4%
mds


Top Processes by Memory:

479 MB kernel_task

272 MB Google Chrome Helper

254 MB Google Chrome Helper

181 MB Google Chrome

121 MB Google Chrome Helper


Top Processes by Energy Use:

6.50 WindowServer

4.56 Google Chrome

3.96 launchservicesd

3.68 Google Chrome Helper


Virtual Memory Information:

1.07 GB
Available RAM

37 MB Free RAM

2.93 GB
Used RAM

1.03 GB
Cached files

1 MB Swap Used




MacBook Air, OS X El Capitan (10.11.6)

Posted on Jan 14, 2018 2:10 AM

Reply
Question marked as Top-ranking reply

Posted on Jan 14, 2018 3:14 AM

1. Run EtreCheck again.


Possible adware:

Unknown file: ~/Library/LaunchAgents/com.habdalah.lp.plist

~/Library/habdalah.lp/habdalah.lp.app/Contents/MacOS/habdalah.lp

Unknown file: ~/Library/LaunchAgents/com.manucodiata.plist

~/Library/manucodiata/manucodiata

Unknown file: ~/Library/LaunchAgents/com.skewings-pappiform.plist

~/Library/lakist_graziery/DurlcLuf/vvLLCgwG/skewings-pappiform

Unknown file: ~/Library/LaunchAgents/com.tabefy.cc.plist

~/Library/tabefy.cc/tabefy.cc.app/Contents/MacOS/tabefy.cc

Adware: ~/Library/LaunchAgents/macsearch.plist

5 possible adware files found. [Remove/Report]



Click the “Remove/Report” button next to “5 possible adware files found”.


User Launch Agents:

[loaded] macsearch.plist (? 9989e0fa 4f77794f - installed 2017-12-30) Adware! [Remove/Report]

~/Library/Application Support/Agent/macsearch


Click “Remove/Report” button.




2. Uninstall extensions.

Section: Manage extensions: https://support.apple.com/guide/safari/use-safari-extensions-sfri32508/mac


3. Choose a search engine.

Delete all text in the Smart Search field, click the magnifying glass , then choose a search engine from the list.

https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac


4. Set your Home Page. https://support.apple.com/guide/safari/set-your-homepage-ibrw1020/mac


5. Restart your Mac.


6. Launch Safari holding the Shift key down.

2 replies
Question marked as Top-ranking reply

Jan 14, 2018 3:14 AM in response to dhwani_

1. Run EtreCheck again.


Possible adware:

Unknown file: ~/Library/LaunchAgents/com.habdalah.lp.plist

~/Library/habdalah.lp/habdalah.lp.app/Contents/MacOS/habdalah.lp

Unknown file: ~/Library/LaunchAgents/com.manucodiata.plist

~/Library/manucodiata/manucodiata

Unknown file: ~/Library/LaunchAgents/com.skewings-pappiform.plist

~/Library/lakist_graziery/DurlcLuf/vvLLCgwG/skewings-pappiform

Unknown file: ~/Library/LaunchAgents/com.tabefy.cc.plist

~/Library/tabefy.cc/tabefy.cc.app/Contents/MacOS/tabefy.cc

Adware: ~/Library/LaunchAgents/macsearch.plist

5 possible adware files found. [Remove/Report]



Click the “Remove/Report” button next to “5 possible adware files found”.


User Launch Agents:

[loaded] macsearch.plist (? 9989e0fa 4f77794f - installed 2017-12-30) Adware! [Remove/Report]

~/Library/Application Support/Agent/macsearch


Click “Remove/Report” button.




2. Uninstall extensions.

Section: Manage extensions: https://support.apple.com/guide/safari/use-safari-extensions-sfri32508/mac


3. Choose a search engine.

Delete all text in the Smart Search field, click the magnifying glass , then choose a search engine from the list.

https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac


4. Set your Home Page. https://support.apple.com/guide/safari/set-your-homepage-ibrw1020/mac


5. Restart your Mac.


6. Launch Safari holding the Shift key down.

I need to get rid of this chill tab adware that keeps popping up even after I tried to delete in a number of ways. For Chrome, it doesn't show in my list of extensions so there isn't a way for me to delete it from there.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.