Apple Event: May 7th at 7 am PT
I've tried following instructions posted previously on these forums. I downloaded Malwarebytes and scanned my computer in safe mode, removed extensions from safari (I actually never saw any), reset my search engine and home page, and restarted my computer, but it didn't work. HELPPP.
iMac, macOS High Sierra (10.13.5)
Hello sillynaseem,
Hello sillynaseem,
I don't see anything abnormal in the report. What is happening when you use Safari?
Safari/Preferences/Advanced - enable the Develop menu, then go there and Empty Caches. Quit/reopen Safari and test. Then try Safari/History/Show History and delete all history items. Quit/reopen Safari and test. You can also try try Safari/Clear History…. The down side is it clears all cookies. Doing this may cause some sites to no longer recognize your computer as one that has visited the web site. Go to Finder and select your user/home folder. With that Finder window as the front window, either select Finder/View/Show View options or go command - J. When the View options opens, check ’Show Library Folder’. That should make your user library folder visible in your user/home folder. Select Library/Caches/com.apple.Safari/Cache.db and move it to the trash.
Go to Safari Preferences/Extensions and turn all extensions off. Test. If okay, turn the extensions on one by one until you figure out what extension is causing the problem.
Safari Corruption See post by Linc Davis
No actually, I couldn't find any of the manual files listed. I'm going to paste the files below; do you see any I should delete? I don't....
LaunchAgents
6H4HRTU5E3.com.avast.passwords.Agent.plist
com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a2 3d420d.plist
com.avast.userinit.plist
com.google.keystone.agent.plist
com.malwarebytes.mbam.frontend.agent.plist
com.microsoft.update.agent.plist
com.oracle.java.Java-Updater.plist
LaunchDaemons
6H4HRTU5E3.com.avast.passwords.AgentXPC.plist
com.adobe.ARMDC.Communicator.plist
com.adobe.ARMDC.SMJobBlessHelper.plist
com.adobe.fpsaud.plist
com.avast.init.plist
com.avast.uninstall.plist
com.avast.update.plist
com.google.keystone.daemon.plist
com.malwarebytes.mbam.rtprotection.daemon.plist
com.malwarebytes.mbam.settings.daemon.plist
com.microsoft.autoupdate.helper.plist
com.microsoft.office.licensingV2.helper.plist
com.oracle.java.Helper-Tool.plist
Application Support Files
Adobe
App Store
Apple
ApplePushService
Avast
com.apple.TCC
CrashReporter
GarageBand
iLifeMediaBrowser
Logic
Macromedia
Malwarebytes
Microsoft
Oracle
ProApps
Script Editor
SubmitDiagInfo
Try running this program in your normal user account, then copy and paste the output in a reply. The program was created by etresoft, a frequent contributor. Please use copy and paste as screen shots can be hard to read. Click “Share Report” button in the toolbar, select “Copy Report” and then paste into a reply. This will show what is running on your computer. No personal information is shown. You can run the report for free at least once, but if you run it several times, at some point it will ask you to pay a license fee.
Etrecheck – System Information
I would uninstall Avast. It tends to interfere with the computer's operation while providing minimal to no benefit unless you work with Windows files. Most long time posters recommend not using antivirus software or cleaning software such as CleanMyMac.
EtreCheck version: 4.3.2 (4D034)
Report generated: 2018-06-23 11:05:18
Download EtreCheck from https://etrecheck.com
Runtime: 3:34
Performance: Good
Problem: Other problem
Description:
Trying to remove playsearchnow from my computer
Major Issues:
Anything that appears on this list needs immediate attention.
No Time Machine backup - Time Machine backup not found.
Minor Issues:
These issues do not need immediate attention but they may indicate future problems.
Clean up - There are orphan files that could be removed.
Unsigned files - There is unsigned software installed. They appear to be legitimate but should be reviewed.
32-bit Apps - This machine has 32-bits apps that may have problems in the future.
Hardware Information:
iMac (21.5-inch, Late 2012)
iMac Model: iMac13,1
1 2.9 GHz Intel Core i5 (i5-3470S) CPU: 4-core
8 GB RAM - Upgradeable
BANK 0/DIMM0 - 4 GB DDR3 1600 ok
BANK 1/DIMM0 - 4 GB DDR3 1600 ok
Video Information:
NVIDIA GeForce GT 650M - VRAM: 512 MB
iMac 1920 x 1080
Drives:
disk0 - APPLE HDD HTS541010A9E662 1.00 TB (Mechanical)
Internal SATA 3 Gigabit Serial ATA
disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB
disk0s2 - Macintosh HD (Journaled HFS+) 999.35 GB
disk0s3 - Recovery HD [Recovery] 650 MB
Mounted Volumes:
disk0s2 - Macintosh HD 999.35 GB (936.62 GB free)
Journaled HFS+
Mount point: /
Network:
Interface en0: Ethernet
Interface en5: iPhone
Interface en1: Wi-Fi
802.11 a/b/g/n
One IPv4 address
2 IPv6 addresses
Interface en2: Bluetooth PAN
Interface bridge0: Thunderbolt Bridge
iCloud Quota: 1.38 GB available
System Software:
macOS High Sierra 10.13.5 (17F77)
Time since boot: About 9 days
System Load: 1.94 (1 min ago) 1.93 (5 min ago) 2.07 (15 min ago)
Security:
| System | Status |
|---|---|
| Gatekeeper | Mac App Store and identified developers |
| System Integrity Protection | Enabled |
Unsigned Files:
Launchd: /Library/LaunchDaemons/6H4HRTU5E3.com.avast.passwords.AgentXPC.plist
Executable: /Library/Application Support/Avast Passwords/components/AppLifecycleAgent.bundle/Contents/XPCServices/AppLifecycle AgentXPC.xpc/Contents/MacOS/AppLifecycleAgentXPC
Details: Exact match found in the whitelist - probably OK
Launchd: /Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist
Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Helper-Tool
Details: Exact match found in the whitelist - probably OK
Launchd: ~/Library/LaunchAgents/spid-uninstall.plist
Executable: /bin/sh -c "$HOME/Library/SPI/uninstallerwatcher.sh"
Details: Domain name invalid - possibly adware
Launchd: /Library/LaunchAgents/com.oracle.java.Java-Updater.plist
Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater -bgcheck
Details: Exact match found in the whitelist - probably OK
32-bit Applications:
3 32-bit apps
Kernel Extensions:
/Library/Extensions
[Loaded] MB_MBAM_Protection.kext (Malwarebytes Corporation, 3.3 - SDK 10.13)
System Launch Agents:
| [Not Loaded] | 9 Apple tasks |
| [Loaded] | 162 Apple tasks |
| [Running] | 103 Apple tasks |
| [Killed] | 18 Apple tasks |
| [Other] | One Apple task |
System Launch Daemons:
| [Not Loaded] | 37 Apple tasks |
| [Loaded] | 172 Apple tasks |
| [Running] | 99 Apple tasks |
| [Killed] | 27 Apple tasks |
Launch Agents:
| [Loaded] | com.microsoft.update.agent.plist (Microsoft Corporation - installed 2018-06-11) |
| [Loaded] | com.google.keystone.agent.plist (Google, Inc. - installed 2018-02-03) |
| [Running] | com.oracle.java.Java-Updater.plist (? 6f7e3645 - installed 2018-02-19) |
| [Other] | com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a2 3d420d.plist (Adobe Systems, Inc. - installed 2018-02-15) |
| [Running] | com.malwarebytes.mbam.frontend.agent.plist (Malwarebytes Corporation - installed 2018-05-22) |
| [Other] | 6H4HRTU5E3.com.avast.passwords.Agent.plist (? 4801c4b2 - installed 2018-06-14) |
Launch Daemons:
| [Loaded] | com.adobe.ARMDC.SMJobBlessHelper.plist (Adobe Systems, Inc. - installed 2018-02-15) |
| [Loaded] | 6H4HRTU5E3.com.avast.passwords.AgentXPC.plist (? 2178120a - installed 2018-06-14) |
| [Running] | com.malwarebytes.mbam.settings.daemon.plist (Malwarebytes Corporation - installed 2018-05-22) |
| [Loaded] | com.microsoft.autoupdate.helper.plist (Microsoft Corporation - installed 2018-06-11) |
| [Running] | com.malwarebytes.mbam.rtprotection.daemon.plist (Malwarebytes Corporation - installed 2018-05-22) |
| [Loaded] | com.adobe.fpsaud.plist (Adobe Systems, Inc. - installed 2018-06-01) |
| [Loaded] | com.oracle.java.Helper-Tool.plist (? e3fefdd2 - installed 2018-02-19) |
| [Loaded] | com.adobe.ARMDC.Communicator.plist (Adobe Systems, Inc. - installed 2018-02-15) |
| [Loaded] | com.google.keystone.daemon.plist (Google, Inc. - installed 2018-03-07) |
| [Loaded] | com.microsoft.office.licensingV2.helper.plist (Microsoft Corporation - installed 2017-06-10) |
User Launch Agents:
| [Running] | com.spotify.webhelper.plist (Spotify - installed 2018-06-14) |
| [Other] | spid-uninstall.plist (? 0 - installed 2018-04-12) |
| [Other] | com.Scaridae.uq.plist (? 0 - installed 2018-06-14) |
User Login Items:
Spotify Application (Spotify - installed 2018-02-08)
(/Applications/Spotify.app)
iTunesHelper Application (Apple - installed 2018-06-11)
(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)
AdobeResourceSynchronizer Application (Adobe Systems, Inc. - installed 2018-05-16)
(/Applications/Adobe Acrobat Reader DC.app/Contents/Helpers/AdobeResourceSynchronizer.app)
Internet Plug-ins:
FlashPlayer-10.6: 30.0.0.113 (installed 2018-06-14)
QuickTime Plugin: 7.7.3 (installed 2018-06-11)
AdobePDFViewerNPAPI: 17.012.20098 (installed 2018-05-16)
AdobePDFViewer: 18.011.20040 (installed 2018-05-16)
Flash Player: 30.0.0.113 (installed 2018-06-14)
o1dbrowserplugin: 5.41.3.0 (installed 2017-12-05)
googletalkbrowserplugin: 5.41.3.0 (installed 2015-12-11)
JavaAppletPlugin: Java 8 Update 161 build 12 (installed 2018-02-19)
3rd Party Preference Panes:
Flash Player (installed 2018-06-01)
Java (installed 2018-02-19)
Time Machine:
Time Machine Not Configured!
Top Processes by CPU:
| Process (count) | Source | % of CPU | Location |
| WindowServer | Apple | 6 | |
| kernel_task | Apple | 2 | |
| coreaudiod | Apple | 2 | |
| launchd | Apple | 1 | |
| Spotify | Spotify | 0 |
Top Processes by Memory:
| Process (count) | Source | RAM usage | Location |
| kernel_task | Apple | 1.09 GB | |
| Google Chrome Helper (9) | Google, Inc. | 1.02 GB | |
| Messages | Apple | 224 MB | |
| mdworker (7) | Apple | 205 MB | |
| Spotify Helper (3) | Spotify | 202 MB |
Top Processes by Network Use:
| Process | Source | Input | Output | Location |
| mDNSResponder | Apple | 7 MB | 1 MB | |
| Spotify | Spotify | 2 MB | 944 KB | |
| apsd | Apple | 669 KB | 403 KB | |
| netbiosd | Apple | 37 KB | 24 KB | |
| SystemUIServer | Apple | 0 B | 4 KB |
Top Processes by Energy Use:
| Process (count) | Source | Energy (0-100) | Location |
| WindowServer | Apple | 5 | |
| coreaudiod | Apple | 2 | |
| Google Chrome Helper (9) | Google, Inc. | 1 | |
| Spotify | Spotify | 1 | |
| Messages | Apple | 1 |
Virtual Memory Information:
| Available RAM | 1.92 GB |
| Free RAM | 66 MB |
| Used RAM | 6.08 GB |
| Cached files | 1.85 GB |
| Swap Used | 220 MB |
Software Installs (past 30 days):
| Name | Version | Install Date |
| Microsoft AutoUpdate | 3.18.18041000 | 2018-06-11 |
| Microsoft Excel for Mac | 16.13.18052304 | 2018-06-11 |
| Microsoft Word for Mac | 16.13.18052304 | 2018-06-11 |
| Microsoft OneNote for Mac | 16.13.18052304 | 2018-06-11 |
| Microsoft Outlook for Mac | 16.13.18052304 | 2018-06-11 |
| Microsoft PowerPoint for Mac | 16.13.18052304 | 2018-06-11 |
| iTunes | 12.7.5 | 2018-06-11 |
| Adobe Flash Player | 30.0.0.113 | 2018-06-14 |
| Avast Security | 13.9 | 2018-06-14 |
| Malwarebytes for Mac | 1.0 | 2018-06-14 |
| MRTConfigData | 1.35 | 2018-06-20 |
| Gatekeeper Configuration Data | 142 | 2018-06-20 |
Clean up:
/Library/LaunchAgents/6H4HRTU5E3.com.avast.passwords.Agent.plist
/Library/Application Support/Avast Passwords/components/AppLifecycleAgent.bundle/Contents/MacOS/AppLifecycleAgent
Executable not found
~/Library/LaunchAgents/com.Scaridae.uq.plist
/Users/***/Library/Scaridae.uq/Scaridae.uq.app/Contents/MacOS/Scaridae.uq
Executable not found
Diagnostics Information (past 7 days):
2018-06-21 17:27:03 Microsoft Word.app CPU
/Applications/Microsoft Word.app
End of report
So I posted the report for you in a separate response. This is fascinating. I see the report found this file: Launchd: ~/Library/LaunchAgents/spid-uninstall.plist
But I don't actually see it when I look into the LaunchAgents folder. Is that the source of the issue? And if so, how do I find it and remove it? I also deleted avast and it's associated .plist files.
Go to Finder and select your user/home folder. With that Finder window as the front window, either select Finder/View/Show View options or go command - J. When the View options opens, check ’Show Library Folder’. That should make your user library folder visible in your user/home folder. Select Library. Then go to Launch Agents.
Also go to the hard drive level Library Launch Agents and Launch Daemons folder. There is an Avast file in each folder.
Followed your instructions, deleted suspicious files, restarted computer, still have same problem. Going a little crazy. Re-ran etrecheck....
EtreCheck version:4.3.2 (4D034)
Report generated:2018-06-23 19:16:16
Download EtreCheck from https://etrecheck.com
Runtime:3:40
Performance:Good
Problem:Other problem
Description:
Trying to get rid of playsearchnow
Major Issues:
Anything that appears on this list needs immediate attention.
No Time Machine backup- Time Machine backup not found.
Minor Issues:
These issues do not need immediate attention but they may indicate future problems.
Unsigned files- There is unsigned software installed. They appear to be legitimate but should be reviewed.
32-bit Apps- This machine has 32-bits apps that may have problems in the future.
Hardware Information:
iMac (21.5-inch, Late 2012)
iMac Model: iMac13,1
1 2.9 GHz Intel Core i5 (i5-3470S) CPU: 4-core
8 GB RAM -Upgradeable
BANK 0/DIMM0 - 4 GB DDR3 1600 ok
BANK 1/DIMM0 - 4 GB DDR3 1600 ok
Video Information:
NVIDIA GeForce GT 650M - VRAM: 512 MB
iMac 1920 x 1080
Drives:
disk0 - APPLE HDD HTS541010A9E662 1.00 TB (Mechanical)
Internal SATA 3 Gigabit Serial ATA
disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB
disk0s2 - Macintosh HD (Journaled HFS+) 999.35 GB
disk0s3 - Recovery HD (Journaled HFS+) [Recovery] 650 MB
Mounted Volumes:
disk0s2 - Macintosh HD 999.35 GB (938.38 GB free)
Journaled HFS+
Mount point: /
Network:
Interface en0: Ethernet
Interface en5: iPhone
Interface en1: Wi-Fi
802.11 a/b/g/n
One IPv4 address
2 IPv6 addresses
Interface en2: Bluetooth PAN
Interface bridge0: Thunderbolt Bridge
iCloud Quota: 1.38 GB available
System Software:
macOS High Sierra 10.13.5 (17F77)
Time since boot: About 2 hours
System Load: 3.41 (1 min ago) 2.76 (5 min ago) 1.50 (15 min ago)
Security:
| System | Status |
|---|---|
| Gatekeeper | Mac App Store and identified developers |
| System Integrity Protection | Enabled |
Unsigned Files:
Launchd: /Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist
Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Helper-Tool
Details: Exact match found in the whitelist - probably OK
Launchd: /Library/LaunchAgents/com.oracle.java.Java-Updater.plist
Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater -bgcheck
Details: Exact match found in the whitelist - probably OK
32-bit Applications:
3 32-bit apps
Kernel Extensions:
/Library/Extensions
[Loaded] MB_MBAM_Protection.kext (Malwarebytes Corporation, 3.3 - SDK 10.13)
System Launch Agents:
| [Not Loaded] | 9 Apple tasks |
| [Loaded] | 182 Apple tasks |
| [Running] | 101 Apple tasks |
| [Other] | One Apple task |
System Launch Daemons:
| [Not Loaded] | 37 Apple tasks |
| [Loaded] | 191 Apple tasks |
| [Running] | 106 Apple tasks |
| [Other] | One Apple task |
Launch Agents:
| [Loaded] | com.microsoft.update.agent.plist (Microsoft Corporation - installed 2018-06-11) |
| [Loaded] | com.google.keystone.agent.plist (Google, Inc. - installed 2018-02-03) |
| [Loaded] | com.oracle.java.Java-Updater.plist (? 6f7e3645 - installed 2018-02-19) |
| [Other] | com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a2 3d420d.plist (Adobe Systems, Inc. - installed 2018-02-15) |
| [Running] | com.malwarebytes.mbam.frontend.agent.plist (Malwarebytes Corporation - installed 2018-05-22) |
Launch Daemons:
| [Loaded] | com.adobe.ARMDC.SMJobBlessHelper.plist (Adobe Systems, Inc. - installed 2018-02-15) |
| [Running] | com.malwarebytes.mbam.settings.daemon.plist (Malwarebytes Corporation - installed 2018-05-22) |
| [Loaded] | com.microsoft.autoupdate.helper.plist (Microsoft Corporation - installed 2018-06-11) |
| [Running] | com.malwarebytes.mbam.rtprotection.daemon.plist (Malwarebytes Corporation - installed 2018-05-22) |
| [Loaded] | com.adobe.fpsaud.plist (Adobe Systems, Inc. - installed 2018-06-01) |
| [Loaded] | com.oracle.java.Helper-Tool.plist (? e3fefdd2 - installed 2018-02-19) |
| [Loaded] | com.adobe.ARMDC.Communicator.plist (Adobe Systems, Inc. - installed 2018-02-15) |
| [Loaded] | com.google.keystone.daemon.plist (Google, Inc. - installed 2018-03-07) |
| [Loaded] | com.microsoft.office.licensingV2.helper.plist (Microsoft Corporation - installed 2017-06-10) |
User Launch Agents:
| [Running] | com.spotify.webhelper.plist (Spotify - installed 2018-06-23) |
User Login Items:
Spotify Application (Spotify - installed 2018-02-08)
(/Applications/Spotify.app)
iTunesHelper Application (Apple - installed 2018-06-11)
(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)
AdobeResourceSynchronizer Application (Adobe Systems, Inc. - installed 2018-05-16)
(/Applications/Adobe Acrobat Reader DC.app/Contents/Helpers/AdobeResourceSynchronizer.app)
Internet Plug-ins:
FlashPlayer-10.6: 30.0.0.113 (installed 2018-06-14)
QuickTime Plugin: 7.7.3 (installed 2018-06-11)
AdobePDFViewerNPAPI: 17.012.20098 (installed 2018-05-16)
AdobePDFViewer: 18.011.20040 (installed 2018-05-16)
Flash Player: 30.0.0.113 (installed 2018-06-14)
o1dbrowserplugin: 5.41.3.0 (installed 2017-12-05)
googletalkbrowserplugin: 5.41.3.0 (installed 2015-12-11)
JavaAppletPlugin: Java 8 Update 161 build 12 (installed 2018-02-19)
3rd Party Preference Panes:
Flash Player (installed 2018-06-01)
Java (installed 2018-02-19)
Time Machine:
Time Machine Not Configured!
Top Processes by CPU:
| Process (count) | Source | % of CPU | Location |
| mdworker (20) | Apple | 10 | |
| WindowServer | Apple | 4 | |
| kernel_task | Apple | 3 | |
| com.apple.WebKit.Networking | Apple | 2 | |
| trustd (4) | Apple | 1 |
Top Processes by Memory:
| Process (count) | Source | RAM usage | Location |
| kernel_task | Apple | 777 MB | |
| mdworker (20) | Apple | 349 MB | |
| Spotify Helper (3) | Spotify | 313 MB | |
| Spotify | Spotify | 116 MB | |
| Safari | Apple | 106 MB |
Top Processes by Network Use:
| Process | Source | Input | Output | Location |
| Spotify | Spotify | 1 MB | 183 KB | |
| apsd | Apple | 149 KB | 60 KB | |
| mDNSResponder | Apple | 25 KB | 15 KB | |
| netbiosd | Apple | 1 KB | 776 B | |
| SystemUIServer | Apple | 0 B | 64 B |
Top Processes by Energy Use:
| Process (count) | Source | Energy (0-100) | Location |
| WindowServer | Apple | 2 | |
| securityd | Apple | 1 | |
| Spotify | Spotify | 0 | |
| identityservicesd | Apple | 0 | |
| suggestd | Apple | 0 |
Virtual Memory Information:
| Available RAM | 4.26 GB |
| Free RAM | 1.07 GB |
| Used RAM | 3.74 GB |
| Cached files | 3.19 GB |
| Swap Used | 0 B |
Software Installs (past 30 days):
| Name | Version | Install Date |
| Microsoft AutoUpdate | 3.18.18041000 | 2018-06-11 |
| Microsoft Excel for Mac | 16.13.18052304 | 2018-06-11 |
| Microsoft Word for Mac | 16.13.18052304 | 2018-06-11 |
| Microsoft OneNote for Mac | 16.13.18052304 | 2018-06-11 |
| Microsoft Outlook for Mac | 16.13.18052304 | 2018-06-11 |
| Microsoft PowerPoint for Mac | 16.13.18052304 | 2018-06-11 |
| iTunes | 12.7.5 | 2018-06-11 |
| Adobe Flash Player | 30.0.0.113 | 2018-06-14 |
| Avast Security | 13.9 | 2018-06-14 |
| Malwarebytes for Mac | 1.0 | 2018-06-14 |
| MRTConfigData | 1.35 | 2018-06-20 |
| Gatekeeper Configuration Data | 142 | 2018-06-20 |
Diagnostics Information (past 7 days):
2018-06-21 17:27:03 Microsoft Word.app CPU
/Applications/Microsoft Word.app
End of report
I did everything you said, still didn't work. Then I followed instructions from http://www.besttechtips.org/remove-playsearchnow-mac-windows/ and it worked, although those instructions hadn't worked before I followed your instructions. Some combination of your instructions and those worked miracles. THANK YOU SO MUCH.
Use the manual method or Malwarebytes.
https://malwarefixes.com/remove-play-search-now-mac-os-x-and-safari-guide/
https://www.precisesecurity.com/adware/remove-play-search-now-macintosh
I've tried both the manual method and running Malwarebytes. The problem persists.
Did you find/removal all the files listed in the manual removal? Have you restarted the computer since removing?
I've already tried the tips on that help page; didn't work. 😟
You are welcome.
How do I uninstall playsearchnow from safari?
