I have an Macook Pro 2017 model. operating on OS High Sierra Version 10.13.6 and whenever I click on just about everything in safari it opens a new tab with an ad on it.
sometimes the ads are Mackeeper or video hosting sites but they are just so annoying! I'm wondering weather I downloaded a virus or something...
how do I get rid of this?
Please help!
MacBook Pro TouchBar and Touch ID, macOS High Sierra (10.13.6)
Force Quit Safari ( command + option + esc keys).Then restart Safari holding the Shift key. If you still have problems Empty Caches (Safari menu > Preferences > Privacy > Remove all website data. (This will also remove history if you do not want to remove History open Safari Preferences > Advanced and check mark “Show Develop Menu” then choose “Empty Caches” from Develop Menu ).
Then go to Safari Preferences > Extensions and check there. If there is an extension delete it.
If the problem persists then download and run Malwarebytes. Malwarebytes was developed by one of our own colleagues here in ASC and is about the most proven anti-malware software for Mac.
Force Quit Safari ( command + option + esc keys).Then restart Safari holding the Shift key. If you still have problems Empty Caches (Safari menu > Preferences > Privacy > Remove all website data. (This will also remove history if you do not want to remove History open Safari Preferences > Advanced and check mark “Show Develop Menu” then choose “Empty Caches” from Develop Menu ).
Then go to Safari Preferences > Extensions and check there. If there is an extension delete it.
If the problem persists then download and run Malwarebytes. Malwarebytes was developed by one of our own colleagues here in ASC and is about the most proven anti-malware software for Mac.
If the above doesn't work, try running this program in your normal user account, then copy and paste the output in a reply. The program was created by etresoft, a frequent contributor. Please use copy and paste as screen shots can be hard to read. Click “Share Report” button in the toolbar, select “Copy Report” and then paste into a reply. This will show what is running on your computer. No personal information is shown. You can run the report for free at least once, but if you run it several times, at some point it will ask you to pay a license fee.
EtreCheck version: 4.3.6 (4D041)
Report generated: 2018-07-25 23:24:16
Download EtreCheck from https://etrecheck.com
Runtime: 3:33
Performance: Good
Problem: Other problem
Description:
Safari opening up adware sites spontaneously
Major Issues:
Anything that appears on this list needs immediate attention.
Unsigned files- There are unsigned software installed that could be adware and should be reviewed.
Minor Issues:
These issues do not need immediate attention but they may indicate future problems.
32-bit Apps- This machine has 32-bits apps that may have problems in the future.
Hardware Information:
MacBook Pro (13-inch, 2016, Four Thunderbolt 3 ports)
MacBook Pro Model: MacBookPro13,2
1 2.9 GHz Intel Core i5 (i5-6267U) CPU: 2-core
8 GB RAM - Not upgradeable
BANK 0/DIMM0 - 4 GB LPDDR3 2133 ok
BANK 1/DIMM0 - 4 GB LPDDR3 2133 ok
Battery: Health = Normal - Cycle count = 124
Video Information:
Intel Iris Graphics 550 - VRAM: 1536 MB
Color LCD
Drives:
disk0 - APPLE SSD AP0256J 251.00 GB (Solid State - TRIM: Yes)
Internal PCI-Express 8.0 GT/s x4 NVM Express
disk0s1 - EFI [EFI] 315 MB
disk0s2 250.04 GB
disk1s1 - Macintosh HD (APFS) 250.04 GB (179.54 GB used)
disk1s2 - Preboot (APFS) [APFS Preboot] 250.04 GB (53 MB used)
disk1s3 - Recovery (APFS) [Recovery] 250.04 GB (1.03 GB used)
disk1s4 - VM (APFS) [APFS VM] 250.04 GB (1.07 GB used)
Mounted Volumes:
disk1s1 - Macintosh HD 250.04 GB (68.21 GB free)
APFS
Mount point: /
disk1s4 - VM [APFS VM] 250.04 GB (68.21 GB free)
APFS
Mount point: /private/var/vm
Network:
Interface lpss-serial1: LPSS Serial Adapter (1)
Interface lpss-serial2: LPSS Serial Adapter (2)
Interface en6: Apple USB Ethernet Adapter
Interface en8: iPhone
Interface en0: Wi-Fi
802.11 a/b/g/n/ac
One IPv4 address
Interface en7: Bluetooth PAN
Interface bridge0: Thunderbolt Bridge
iCloud Quota: 1.89 TB available
System Software:
macOS High Sierra 10.13.6 (17G65)
Time since boot: About an hour
System Load: 1.06 (1 min ago) 1.54 (5 min ago) 1.66 (15 min ago)
Security:
| System | Status |
|---|---|
| Gatekeeper | Mac App Store and identified developers |
| System Integrity Protection | Enabled |
Unsigned Files:
Launchd: /Library/LaunchAgents/com.oracle.java.Java-Updater.plist
Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater -bgcheck
Details: Exact match found in the whitelist - probably OK
Launchd: ~/Library/LaunchAgents/com.Kiowa_alloisomer.plist
Executable: ~/Library/opalesque/esoszYce/Kiowa_alloisomer
Details: Domain name invalid - possibly adware
Launchd: ~/Library/LaunchAgents/com.Hildebrand.kx.plist
Executable: ~/Library/Hildebrand.kx/Hildebrand.kx.app/Contents/MacOS/Hildebrand.kx
Launchd: /Library/LaunchDaemons/com.mingjie.mjrecorder.agent.plist
Executable: /Library/Audio/Plug-Ins/HAL/MJRecorderDevice.driver/Contents/MacOS/MJRecorder-a gent
Details: Exact match found in the whitelist - probably OK
Launchd: /Library/LaunchAgents/com.boatmaster.ae.plist
Executable: /Library/boatmaster.ae/boatmaster.ae.app/Contents/MacOS/boatmaster.ae
Launchd: ~/Library/LaunchAgents/com.blancard.plist
Executable: ~/Library/UpdateMac/blancard/blancard
Launchd: /Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist
Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Helper-Tool
Details: Exact match found in the whitelist - probably OK
32-bit Applications:
4 32-bit apps
System Launch Agents:
| [Not Loaded] | 6 Apple tasks |
| [Loaded] | 167 Apple tasks |
| [Running] | 120 Apple tasks |
| [Other] | One Apple task |
System Launch Daemons:
| [Not Loaded] | 37 Apple tasks |
| [Loaded] | 176 Apple tasks |
| [Running] | 122 Apple tasks |
Launch Agents:
| [Loaded] | com.microsoft.update.agent.plist (Microsoft Corporation - installed 2018-07-12) |
| [Not Loaded] | com.teamviewer.teamviewer_desktop.plist (TeamViewer GmbH - installed 2017-08-02) |
| [Not Loaded] | com.teamviewer.teamviewer.plist (TeamViewer GmbH - installed 2017-08-02) |
| [Loaded] | com.oracle.java.Java-Updater.plist (? ed29c6d - installed 2018-07-07) |
| [Other] | com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a2 3d420d.plist (Adobe Systems, Inc. - installed 2018-02-17) |
| [Loaded] | com.boatmaster.ae.plist (? 3deb160f - installed 2018-05-23) |
Launch Daemons:
| [Loaded] | com.adobe.ARMDC.SMJobBlessHelper.plist (Adobe Systems, Inc. - installed 2018-02-17) |
| [Loaded] | com.microsoft.autoupdate.helper.plist (Microsoft Corporation - installed 2018-07-12) |
| [Not Loaded] | com.teamviewer.teamviewer_service.plist (TeamViewer GmbH - installed 2017-08-02) |
| [Loaded] | com.apple.installer.osmessagetracing.plist (Apple - installed 2018-07-04) |
| [Loaded] | com.teamviewer.Helper.plist (TeamViewer GmbH - installed 2017-03-14) |
| [Loaded] | com.adobe.fpsaud.plist (Adobe Systems, Inc. - installed 2018-06-26) |
| [Loaded] | com.oracle.java.Helper-Tool.plist (? e3fefdd2 - installed 2018-07-07) |
| [Loaded] | com.adobe.ARMDC.Communicator.plist (Adobe Systems, Inc. - installed 2018-02-17) |
| [Loaded] | com.mingjie.mjrecorder.agent.plist (? 8ce67b23 - installed 2018-02-06) |
| [Loaded] | com.microsoft.office.licensingV2.helper.plist (Microsoft Corporation - installed 2017-01-07) |
User Launch Agents:
| [Loaded] | com.google.keystone.agent.plist (Google, Inc. - installed 2018-07-18) |
| [Loaded] | com.Hildebrand.kx.plist (? 0 - installed 2018-05-25) |
| [Loaded] | com.logmein.GoToMeeting.G2MUpdate.plist (Citrix Online LLC - installed 2017-09-21) |
| [Loaded] | com.citrixonline.GoToMeeting.G2MUpdate.plist (Citrix Online LLC - installed 2017-09-21) |
| [Loaded] | com.Kiowa_alloisomer.plist (? 0 - installed 2018-05-25) |
| [Loaded] | com.blancard.plist (? 0 - installed 2018-05-25) |
User Login Items:
AdobeResourceSynchronizer Application (Adobe Systems, Inc. - installed 2018-07-12)
(/Applications/Adobe Acrobat Reader DC.app/Contents/Helpers/AdobeResourceSynchronizer.app)
iTunesHelper Application (Apple - installed 2018-07-10)
(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)
SoundTouchHelper Application (? - installed 2017-08-11)
(/Applications/SoundTouch/SoundTouch.app/Contents/MacOS/SoundTouchHelper/SoundTo uchHelper.app)
SoundTouch Music Server Application (? - installed 2017-08-11)
(/Applications/SoundTouch/SoundTouch.app/Contents/MacOS/SoundTouchMusicServer/So undTouch Music Server.app)
Internet Plug-ins:
WebClient: (installed 2017-04-16)
QuickTime Plugin: (installed 2018-07-19)
AdobePDFViewerNPAPI: (installed 2018-07-12)
AdobePDFViewer: (installed 2018-07-12)
Flash Player: (installed 2018-07-11)
FlashPlayer-10.6: (installed 2018-07-11)
Unity Web Player: (installed 2017-08-20)
JavaAppletPlugin: (installed 2018-07-25)
3rd Party Preference Panes:
Flash Player (installed 2018-06-26)
Java (installed 2018-07-25)
Time Machine:
Skip System Files: No
Mobile backups:
Auto backup: Yes
Volumes being backed up:
Macintosh HD: Disk size: 250.04 GB - Disk used: 181.83 GB
Destinations:
T***********e [Network] (Last used)
Total size: 2.00 TB
Total number of backups: 20
Oldest backup: 2018-02-26 10:04:36
Last backup: 2018-07-24 00:07:02
Top Processes by CPU:
| Process (count) | Source | % of CPU | Location |
| WindowServer | Apple | 11 | |
| System Events | Apple | 6 | |
| osascript (3) | ? | 3 | /usr/bin |
| kernel_task | Apple | 3 | |
| launchservicesd | Apple | 1 |
Top Processes by Memory:
| Process (count) | Source | RAM usage | Location |
| kernel_task | Apple | 807 MB | |
| com.apple.WebKit.WebContent (3) | Apple | 268 MB | |
| Apple | 224 MB | ||
| Dock | Apple | 148 MB | |
| WindowServer | Apple | 130 MB |
Top Processes by Network Use:
| Process | Source | Input | Output | Location |
| Apple | 2 MB | 96 KB | ||
| mDNSResponder | Apple | 942 KB | 175 KB | |
| biometrickitd | Apple | 80 KB | 123 KB | |
| apsd | Apple | 33 KB | 50 KB | |
| netbiosd | Apple | 23 KB | 6 KB |
Top Processes by Energy Use:
| Process (count) | Source | Energy (0-100) | Location |
| WindowServer | Apple | 5 | |
| System Events | Apple | 3 | |
| launchservicesd | Apple | 1 | |
| loginwindow | Apple | 1 | |
| osascript (3) | ? | 0 | /usr/bin |
Virtual Memory Information:
| Available RAM | 2.91 GB |
| Free RAM | 24 MB |
| Used RAM | 5.09 GB |
| Cached files | 2.88 GB |
| Swap Used | 0 B |
Software Installs (past 30 days):
| Name | Version | Install Date |
| iTunes | 12.8 | 2018-07-10 |
| Adobe Flash Player | 30.0.0.134 | 2018-07-11 |
| Adobe Acrobat Reader DC (18.011.20055) | 18.011.20055 | 2018-07-12 |
| Microsoft AutoUpdate | 4.1.18070503 | 2018-07-12 |
| Microsoft Outlook for Mac | 16.15.18070902 | 2018-07-14 |
| Microsoft PowerPoint for Mac | 16.15.18070902 | 2018-07-14 |
| Microsoft OneNote for Mac | 16.15.18070902 | 2018-07-14 |
| Microsoft Excel for Mac | 16.15.18070902 | 2018-07-14 |
| Microsoft Word for Mac | 16.15.18070902 | 2018-07-14 |
| 0.3.33 | 2018-07-16 | |
| Gatekeeper Configuration Data | 148 | 2018-07-18 |
| Java 8 Update 181 | 1.0 | 2018-07-25 |
Diagnostics Information (past 7 days):
2018-07-22 22:50:10 Business Card Composer 5.app Crash (3 times)
/Applications/Business Card Composer 5.app
Crashing on exception: NSMutableRLEArray objectAtIndex:effectiveRange:: Out of bounds |
End of report
Many sites are getting a kickback for hosting MacKeeper and other crapware on their sites. Some of these are simply JavaScript roll-overs triggered by your pointing device, or automatically launched by the site after it loads. I don't return to a site if it is covered in these “traps.”
After I click a website link, I have developed a habit of parking the mouse pointer on the Safari title bar to avoid having one of these advertisements appear under a random mouse location on the browser. Then I avoid passing the mouse pointer over the obvious banner adds, and anything else that has green or blue lines under text. Even these can be JavaScript triggers.
Macjack has already covered procedures for clearing Safari cache, history, and Malwarebytes.
Tried your option, its coming back!
If you return to the site that generates it then you'll get it again.
Thanks a ton macJack, Malwareytes has solved the issue!
You're welcome. Glad it's sorted.
Mackeeper Ad coming up repeatedly in Safari
