Unable to block pop-up tabs on Safari

Question

Level 1

4 points

Unable to block pop-up tabs on Safari

Hello,

Here's my situation: I've been using Safari as my main browser for years now, and since I enable the "No pop-up windows" option, and downloaded 2 adblockers plugins, I very seldom had any issues with pop-up ads. Until yesterday. I was searching for solutions for some problem with an external harddrive, and I guess I might have gone on some sketchy website, because since last night I've been having regular pop-up tabs opening randomly. Their content varies: sometimes it's an ad page for a website I'm currently looking at, sometimes it's just one of those fake "Your Apple device has been compromised" warning, or some other kind of random ad for an anti-virus. I'm not sure why it's doing that. I went back in my Safari Settings, and the pop-up windows are blocked. I uninstalled and reinstalled AdBlock and Adblock Plus, and they seem to be running okay. I don't know what's going on, maybe I caught some malware? These random tabs open randomly every 5 to 10 minutes.

I'm on a MacBook Air with High Sierra, if that's of any help.

Thanks in advance!

Louis

Posted on Sep 15, 2018 10:28 AM

Reply

Answer 1

Top-ranking reply

Eric Root

Level 10

685,293 points

Sep 17, 2018 3:15 AM in response to Loopynoo

Adware:

Launchd: ~/Library/LaunchAgents/com.applicationstats.AppStats.plist

Reason: Adware name match

Executable: ~/Library/Application Support/Spigot/AppStats --protect

Launchd: ~/Library/LaunchAgents/com.appart.AppArt.plist

Reason: Adware pattern match

Executable: ~/Library/Application Support/AppPolicy/AppArt -i -c 808263 -isn D425504D-2184-441C-9825-BE15AB6A7629

Launchd: ~/Library/LaunchAgents/macsearch.plist

Reason: Adware name match

Executable: ~/Library/Application Support/Agent/macsearch DistributerName=sfmctar2 ChannelId=999 DeviceId=466081d8-df4b-527b-b1c9-6adf699c91e4 Country=FR BarcodeId=52143999 Date=2018-09-12

Safari Extension: Searchme

Reason: Adware name match

Safari Extension: eBay Shopping Assistant

Reason: Adware name match

You have adware installed.

Run EtreCheck again.

In the Sidebar, click the Security button.

Locate and remove entries under Adware and Unsigned files.

Click the “Remove” button.

I would also uninstall CleanMyMac 3 & 4 using the Developer's uninstall instructions. They can destroy normal computer operation.

Reply

Answer 2

Eric Root

Level 10

685,293 points

Sep 15, 2018 5:32 PM in response to Loopynoo

You are welcome.

Safari/Preferences/Advanced - enable the Develop menu, then go there and Empty Caches. Quit/reopen Safari and test. Then try Safari/History/Show History and delete all history items. Quit/reopen Safari and test. You can also try try Safari/Clear History…. The down side is it clears all cookies. Doing this may cause some sites to no longer recognize your computer as one that has visited the web site. Go to Finder and select your user/home folder. With that Finder window as the front window, either select Finder/View/Show View options or go command - J. When the View options opens, check ’Show Library Folder’. That should make your user library folder visible in your user/home folder. Select Library/Caches/com.apple.Safari/Cache.db and move it to the trash.

Go to Safari Preferences/Extensions and turn all extensions off. Test. If okay, turn the extensions on one by one until you figure out what extension is causing the problem.

If that doesn't work, try running this program in your normal user account , then copy and paste the output in a reply. The program was created by etresoft, a frequent contributor. Please use copy and paste as screen shots can be hard to read. On the screen with Options, please open Options and check the bottom 2 boxes before running. Click “Share Report” button in the toolbar, select “Copy Report” and then paste into a reply. This will show what is running on your computer. No personal information is shown.

Etrecheck – System Information

Reply

Answer 3

Loopynoo Author

Level 1

4 points

Sep 16, 2018 12:05 PM in response to Eric Root

Hello,

Sorry for the delayed answer: I tried what you suggested but pop-ups keep coming up.

I ran Etrecheck, here is the report (I didn't see any Options screen, but I hope this will be ok):

EtreCheck version: 4.3.6 (4D041)

Report generated: 2018-09-16 20:58:32

Download EtreCheck from https://etrecheck.com

Runtime: 4:29

Performance: Good

Problem:No problem - just checking

Major Issues:

Anything that appears on this list needs immediate attention.

Adware- Adware detected.

Unsigned files- There are unsigned software installed that could be adware and should be reviewed.

Minor Issues:

These issues do not need immediate attention but they may indicate future problems.

High battery cycle count- Your battery may be losing capacity.

Apps with heavy CPU usage- There have been numerous cases of apps with heavy CPU usage.

Clean up- There are orphan files that could be removed.

32-bit Apps- This machine has 32-bits apps that may have problems in the future.

Abnormal shutdown- Your machine shut down abnormally.

Hardware Information:

MacBook Air (13-inch, Mid 2013)

MacBook Air Model: MacBookAir6,2

1 1.3 GHz Intel Core i5 (i5-4250U) CPU: 2-core

4 GB RAM - Not upgradeable

BANK 0/DIMM0 - 2 GB DDR3 1600 ok

BANK 1/DIMM0 - 2 GB DDR3 1600 ok

Battery: Health = Replace Soon - Cycle count = 1151

Video Information:

Intel HD Graphics 5000 - VRAM: 1536 MB

Color LCD 1440 x 900

Drives:

disk0 - APPLE SSD SD0128F 121.33 GB (Solid State - TRIM: Yes)

Internal PCI 5.0 GT/s x2 Serial ATA

disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk0s2 121.12 GB

disk1s1 - Macintosh HD (APFS) 121.12 GB (95.97 GB used)

disk1s2 - Preboot (APFS) [APFS Preboot] 121.12 GB (21 MB used)

disk1s3 - Recovery (APFS) [Recovery] 121.12 GB (519 MB used)

disk1s4 - VM (APFS) [APFS VM] 121.12 GB (2.15 GB used)

Mounted Volumes:

disk1s1 - Macintosh HD 121.12 GB (22.34 GB free)

APFS

Mount point: /

Encrypted

disk1s4 - VM [APFS VM] 121.12 GB (22.34 GB free)

APFS

Mount point: /private/var/vm

Network:

Interface en0: Wi-Fi

802.11 a/b/g/n/ac

One IPv4 address

2 IPv6 addresses

Interface bridge0: Thunderbolt Bridge

Interface en2: Bluetooth PAN

iCloud Quota: 4.94 GB available

System Software:

macOS High Sierra 10.13.6 (17G65)

Time since boot: About an hour

System Load: 1.66 (1 min ago) 2.15 (5 min ago) 2.21 (15 min ago)

Security:

System	Status
Gatekeeper	Mac App Store and identified developers
System Integrity Protection	Enabled

Adware:

Launchd: ~/Library/LaunchAgents/com.applicationstats.AppStats.plist

Reason: Adware name match

Executable: ~/Library/Application Support/Spigot/AppStats --protect

Launchd: ~/Library/LaunchAgents/com.appart.AppArt.plist

Reason: Adware pattern match

Executable: ~/Library/Application Support/AppPolicy/AppArt -i -c 808263 -isn D425504D-2184-441C-9825-BE15AB6A7629

Launchd: ~/Library/LaunchAgents/macsearch.plist

Reason: Adware name match

Executable: ~/Library/Application Support/Agent/macsearch DistributerName=sfmctar2 ChannelId=999 DeviceId=466081d8-df4b-527b-b1c9-6adf699c91e4 Country=FR BarcodeId=52143999 Date=2018-09-12

Safari Extension: Searchme

Reason: Adware name match

Safari Extension: eBay Shopping Assistant

Reason: Adware name match

Unsigned Files:

Launchd: /Library/LaunchAgents/com.9hgfA.plist

Executable: /Library/5vNl4/o21Kw

Details: Domain name invalid - possibly adware

Launchd: /Library/LaunchDaemons/com.MacDevDaemon.plist

Executable: /Library/MacDevDaemon/MacDevDaemon.app/Contents/MacOS/MacDevDaemon

Details: Domain name invalid - possibly adware

Launchd: ~/Library/LaunchAgents/com.chamar.plist

Executable: ~/Library/UpdateMac/chamar/chamar

Launchd: ~/Library/LaunchAgents/com.flether.uv.plist

Executable: ~/Library/flether.uv/flether.uv.app/Contents/MacOS/flether.uv

Launchd: ~/Library/LaunchAgents/com.4MsSV.plist

Executable: ~/Library/9dihD/D4Ehu

Details: Domain name invalid - possibly adware

Launchd: ~/Library/LaunchAgents/com.MacDev.plist

Executable: ~/Library/MacDev/MacDev.app/Contents/MacOS/MacDev

Details: Domain name invalid - possibly adware

Launchd: ~/Library/LaunchAgents/com.TYSOU.plist

Executable: ~/Library/search.amp/ZDVFx

Launchd: /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

Executable: /Library/PrivilegedHelperTools/com.microsoft.office.licensing.helper

Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.WW3bF.plist

Executable: ~/Library/search.amp/CQrfC

Details: Domain name invalid - possibly adware

Launchd: ~/Library/LaunchAgents/com.anthesis-trappingly.plist

Executable: ~/Library/lacunule-nebulosity/WLGtOGLI/anthesis-trappingly

Details: Domain name invalid - possibly adware

Launchd: ~/Library/LaunchAgents/com.9hZmg.plist

Executable: ~/Library/HDA68/6wWqM

Details: Domain name invalid - possibly adware

32-bit Applications:

26 32-bit apps

System Launch Agents:

[Not Loaded]	8 Apple tasks
[Loaded]	170 Apple tasks
[Running]	114 Apple tasks
[Other]	2 Apple tasks

System Launch Daemons:

[Not Loaded]	37 Apple tasks
[Loaded]	182 Apple tasks
[Running]	117 Apple tasks
[Other]	One Apple task

Launch Agents:

[Loaded]	com.microsoft.update.agent.plist (Microsoft Corporation - installed 2018-09-15)
[Loaded]	com.9hgfA.plist (? 88aebcfe - installed 2018-09-12)

Launch Daemons:

[Loaded]	com.microsoft.OneDriveUpdaterDaemon.plist (Microsoft Corporation - installed 2018-09-15)
[Loaded]	com.microsoft.autoupdate.helper.plist (Microsoft Corporation - installed 2018-09-15)
[Running]	me.hide.vpnhelper.plist (EVENTURE LTD. - installed 2018-09-12)
[Loaded]	com.adobe.fpsaud.plist (Adobe Systems, Inc. - installed 2018-08-27)
[Loaded]	com.microsoft.office.licensing.helper.plist (? 6d8cb30e - installed 2013-08-12)
[Loaded]	com.macpaw.CleanMyMac3.Agent.plist (MacPaw Inc. - installed 2018-06-02)
[Loaded]	com.macpaw.CleanMyMac4.Agent.plist (MacPaw Inc. - installed 2018-09-14)
[Loaded]	com.MacDevDaemon.plist (? 98f344a5 - installed 2018-09-12)
[Loaded]	com.ea.origin.ESHelper.plist (? e69d1fe1 - installed 2016-08-06)
[Loaded]	com.microsoft.office.licensingV2.helper.plist (Microsoft Corporation - installed 2018-09-10)

User Launch Agents:

[Running]	com.applicationstats.AppStats.plist (Adware - installed 2016-12-29)
[Loaded]	com.google.keystone.agent.plist (Google, Inc. - installed 2018-07-18)
[Loaded]	com.chamar.plist (? 0 - installed 2018-09-14)
[Loaded]	com.flether.uv.plist (? 0 - installed 2018-09-14)
[Loaded]	com.dropbox.DropboxMacUpdate.agent.plist (Dropbox, Inc. - installed 2018-08-23)
[Running]	com.WW3bF.plist (? 0 - installed 2018-09-14)
[Running]	com.macpaw.CleanMyMac4.Updater.plist (MacPaw Inc. - installed 2018-09-14)
[Loaded]	com.anthesis-trappingly.plist (? 0 - installed 2018-09-14)
[Loaded]	com.MacDev.plist (? 0 - installed 2018-09-12)
[Not Loaded]	com.macpaw.CleanMyMac3.Scheduler.plist (? 0 - installed 2018-06-02)
[Running]	com.iobit.MacBoosterMini.plist (Apperience Corporation - installed 2015-01-31)
[Loaded]	com.skype.skype.shareagent.plist (Skype Communications S.a.r.l - installed 2017-10-27)
[Running]	com.TYSOU.plist (? 0 - installed 2018-09-14)
[Running]	com.appart.AppArt.plist (Adware - installed 2016-09-06)
[Loaded]	macsearch.plist (Adware - installed 2018-09-12)
[Loaded]	com.9hZmg.plist (? 0 - installed 2018-09-14)
[Loaded]	com.macpaw.CleanMyMac4.HealthMonitor.plist (MacPaw Inc. - installed 2018-09-14)
[Loaded]	com.4MsSV.plist (? 0 - installed 2018-09-14)

User Login Items:

iTunesHelper Application (Apple - installed 2018-07-11)

(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

hide.me VPN Application (EVENTURE LTD. - installed 2018-09-12)

(/Applications/hide.me VPN.app)

Skype Entreprise Application (Skype Communications S.a.r.l - installed 2018-09-15)

(/Applications/Skype for Business.app)

Internet Plug-ins:

FlashPlayer-10.6: (installed 2018-09-11)

QuickTime Plugin: (installed 2018-08-18)

Flash Player: (installed 2018-09-11)

SharePointBrowserPlugin: (installed 2017-09-13)

PepperFlashPlayer: (installed 2018-09-12)

Unity Web Player: (installed 2016-05-27)

MeetingJoinPlugin: (installed 2018-08-29)

Safari Extensions:

Adblock Plus.safariextz - Eyeo GmbH - https://adblockplus.org/(installed 2018-09-15)

Searchme.safariextz - Adware (installed 2015-10-15)

Ebay Shopping Assistant.safariextz - Adware (installed 2015-10-15)

3rd Party Preference Panes:

Flash Player (installed 2018-08-27)

MusicManager (installed 2018-06-02)

Time Machine:

Skip System Files: No

Mobile backups: Yes

Auto backup: Yes

Volumes being backed up:

Macintosh HD: Disk size: 121.12 GB - Disk used: 98.78 GB

Destinations:

L********************E [Local] (Last used)

Total size: 999.83 GB

Total number of backups: 1

Oldest backup: 2018-09-15 01:48:41

Last backup: 2018-09-15 01:48:41

Top Processes by CPU:

Process (count)	Source	% of CPU	Location
osascript (4)	?	51	/usr/bin
WindowServer	Apple	9
com.apple.WebKit.WebContent (3)	Apple	8
kernel_task	Apple	3
coreaudiod	Apple	2

Top Processes by Memory:

Process (count)	Source	RAM usage	Location
com.apple.WebKit.WebContent (3)	Apple	611 MB
kernel_task	Apple	596 MB
Safari	Apple	239 MB
mdworker (6)	Apple	89 MB
chamar	?	79 MB	~/Library/UpdateMac/chamar

Top Processes by Network Use:

Process	Source	Input	Output	Location
com.apple.WebKit.Networking	Apple	9 MB	210 KB
mDNSResponder	Apple	81 KB	42 KB
apsd	Apple	6 KB	17 KB
netbiosd	Apple	12 KB	3 KB
chamar	?	2 KB	6 KB	~/Library/UpdateMac/chamar

Top Processes by Energy Use:

Process (count)	Source	Energy (0-100)	Location
com.apple.WebKit.WebContent (3)	Apple	30
Safari	Apple	5
suggestd	Apple	3
com.apple.WebKit.Networking	Apple	3
WindowServer	Apple	1

Virtual Memory Information:

Available RAM	840 MB
Free RAM	37 MB
Used RAM	3.18 GB
Cached files	803 MB
Swap Used	349 MB

Software Installs (past 30 days):

Name	Version	Install Date
GIPHY CAPTURE	4.1	2018-08-23
Microsoft AutoUpdate	4.3.18090901	2018-08-31
Gatekeeper Configuration Data	154	2018-09-05
Adobe Flash Player	31.0.0.108	2018-09-11
Betternet VPN	1.0.9	2018-09-12
hide.me VPN for macOS	4	2018-09-12
Adobe Pepper Flash Player	31.0.0.108	2018-09-12
Microsoft Outlook for Mac	16.17.18090901	2018-09-12
Microsoft PowerPoint for Mac	16.17.18090901	2018-09-12
Microsoft Excel for Mac	16.17.18090901	2018-09-12
Microsoft OneNote for Mac	16.17.18090901	2018-09-12
Microsoft Word for Mac	16.17.18090901	2018-09-12
AdBlock	1.9.1	2018-09-14
Microsoft Office pour Mac	16.17.18090901	2018-09-15
Skype Entreprise	16.21.65	2018-09-15

Clean up:

~/Library/LaunchAgents/com.macpaw.CleanMyMac3.Scheduler.plist

'/Users/***/Library/Application Support/CleanMyMac 3/CleanMyMac 3 Scheduler.app'

Executable not found

Diagnostics Information (past 7 days):

2018-09-16 19:03:11 Last Shutdown Cause: 3 - Hard shutdown

2018-09-16 18:29:31 chamar Crash

/Users/***/Library/UpdateMac/*/chamar

2018-09-15 20:51:48 com.apple.WebKit.WebContent CPU (3 times)

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.Web Kit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent

2018-09-15 19:24:55 AdBlock.app Crash

/Applications/AdBlock.app

2018-09-15 18:39:08 com.apple.WebKit.Networking CPU (2 times)

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.Web Kit.Networking.xpc/Contents/MacOS/com.apple.WebKit.Networking

2018-09-15 00:43:55 installd CPU

/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/inst alld

2018-09-12 15:11:21 VPN Plus.app Crash

/Applications/VPN Plus.app

*** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: 'data parameter is nil'

terminating with uncaught exception of type NSException

abort() called

2018-09-12 15:02:45 Firefox.app Crash (2 times)

/Applications/Firefox.app

End of report

Reply

Answer 4

Eric Root

Level 10

685,293 points

Sep 15, 2018 10:48 AM in response to Loopynoo

Safari – Popup takes over

Safari – Popup takes over (2)

Popup remover – Scam Zapper

Safari popups that won't go away

If the pop-up reloads, force quit Safari (command - option/alt - esc) and reopen with the shift key held down. If that doesn't work, disconnect from the Internet, go to Safari/History and delete the website. Quit and reopen with the shift key held down. Then reconnect to the Internet.

Safari -Tech support scam pop-ups

Reply

Answer 5

Loopynoo Author

Level 1

4 points

Sep 15, 2018 1:06 PM in response to Eric Root

Hello,

Thank you for your answer, but I'm not sure to understand: the process you suggested, must I do it every time a pop-up shows up? I'm getting them pretty much every 5 minutes, so I'm not really looking to close them as they come, but rather to eliminate the problem of them coming up at all.
Pardon me if I may have misunderstood a part of your explanation, I'm just not sure I'm getting it.

Thank you,

Louis

Reply

Answer 6

Loopynoo Author

Level 1

4 points

Sep 15, 2018 1:09 PM in response to Eric Root

Hello again,

I should add that the pop-ups I'm getting so far are not the kind that jams my whole browser, they're just random tabs that open for now reason and that I have to close every time. Sometimes the page that tries to open does not even load, it just opens an loading error message from Safari.

Hope that helps

Louis

Reply