Popup ads in new tab in Safari and Chrome

Question

Level 1

4 points

Popup ads in new tab in Safari and Chrome

Hi.

I use Safari and Chrome basically everyday, and have adblocker extensions on both. And ONLY those extensions. Not a single other.

Now about a week ago, both my browsers started opening ads in new windows, often from Unibet, and so on. In chrome, the basic search engine was also changed along with the homepage. I changed it back, but it changes back.

I started adding the URLS from the ads into "blocked sites" in chrome, but it seems to never run out of ads pages, so I went into heavy google mode. But I didn't get too far I've been searching files through finder, "go to folder" with a bunch of strings someone suggested to search for, and stared at my activity monitor for an hour, basically googling half of everything in there. But anything I found that seems reliable online is a few years old - and thus (because I know that much) - is probably not relevant anymore - so I dare not stop or delete things. Nothing seemed to be a perfect match with files or folders that the great web tell me could be adware.

Does anyone have some up to date troubleshooting tips for me? Files to search for, or activities to look for in the activity monitor? Or perhaps a good adware cleaner program, that isn't all the pricy? (maybe even free??:O). Or all of the above.

I'm running High Sierra 10.13.6 on a MacBook Pro (late 2011).

(But I've put in an SSD, so it's running like a charm! )

Any input appreciated.

/robert

MacBook Pro, iOS 10.3

Posted on Oct 19, 2018 3:56 PM

Reply

Answer 1

Cåts

Level 5

4,584 points

Oct 19, 2018 4:55 PM in response to Phayn

Run this. You can trust it.

https://etrecheck.com

follow the instructions after it’s done and shows your report.

it will show you if you have adware and malware and you can get rid of them yourself. It’s a great program. I’ve used it many times. It’s very user friendly.

here is the bio of the person who created it.

etresoft

https://discussions.apple.com/profile/etresoft/profile

Reply

Answer 2

Eric Root

Level 10

685,191 points

Oct 20, 2018 7:22 AM in response to Phayn

It shows me a list of unassigned files, and says "library/LaunchAgent" is the location, but I have no folder with this name in my Library.

Go to Finder and select your user/home folder. With that Finder window as the front window, either select Finder/View/Show View options or go command - J. When the View options opens, check ’Show Library Folder’. That should make your user library folder visible in your user/home folder. Select Library/LaunchAgent.

Time Machine Basics

Time Machine Basics (2)

Time Machine FAQ

Reply

Answer 3

Cåts

Level 5

4,584 points

Oct 19, 2018 4:09 PM in response to Phayn

are you referring to those pop ups that show up saying something like “ congratulations! You won etc,etc.etc “ ?

if so, that is a problem with the website itself. There is no way to block those.

Ad Blocker Extensions block ads from showing on your page. They do NOT block pop ups like the one I described Above.

With an ad Blocker ( I use Ad Block Plus) if you navigate to a website, you won’t see ads that display. To see what I mean, disable your ad blocker a webpage of your choosing.

look at the page without the ad blocker enabled.

then, enable it and go view the same webpage again. You will seethat there are white areas where the ads would be.

please screenshot what you are seeing and post it back here so I can help more if needed.

Reply

Answer 4

Phayn Author

Level 1

4 points

Oct 19, 2018 4:34 PM in response to Lizzy_christo

Unfortunately, that function doesn't help. I have it enabled.
This very clearly started happened at a distinct time, about a week ago, with both browsers. From googling it, I feel pretty confident I have adware on my Mac. Which takes me back to my original question: does anyone have any troubleshooting tips on how to remove that adware? :/

Reply

Answer 5

Phayn Author

Level 1

4 points

Oct 19, 2018 4:39 PM in response to Cåts

I might have gotten that type of ad once, but it's not the most common one, no.
And it's not a specific website. I can open up chrome, and simply be on the google search home page (not having gone anywhere, or search for anything, and suddenly a new tab opens with an ad. Same with both browsers.
It can happen while I am checking my gmail, or when I'm on facebook. Or, as said, when I'm "nowhere". As long as the browser is open. Based on this, and the googling I have done, I'm pretty sure it is adware. So if I may direct you to my initial question; do you have any tips on how to remove this?

Reply

Answer 6

Phayn Author

Level 1

4 points

Oct 19, 2018 4:45 PM in response to Phayn

Clarification:
Ads can open up in a new tab even though I am not viewing any website. Simply as long as any of the browsers are open (from the startup page), ads keep popping up - opening up in new tabs - with a minute or two intervals. Seems completely unafdected by my actual usage of the browsers.
Secondly, I am fairly confident it is adware. I realize I could have stated this clearer. I am hoping for some good tipds on how to find and remove adware. (Unless you recognize what I'm escribing as something else, of course..)

Reply

Answer 7

Phayn Author

Level 1

4 points

Oct 19, 2018 4:59 PM in response to Cåts

That was very helpful! Thanks. I ran the diagnostic, and it tells me I have adware. But it also refers to where that adware is located on my Mac!
It also tells me I dont have a time machine backup (knew that already of course 😝), and that a game I sometime play causes a hard shutdown/crash. Which it does. So it seems the diagnostic is very thorough, if not anything else. I am in Norway, and I am half asleep now, but I will run with this report tomorrow, and see what I can do. It's definitely enough to have me troubleshooting for hours tomorrow, and if I can't figure it out myself, I will just buy the solution from Etresoft.

Thanks again.

Reply

Answer 8

Eric Root

Level 10

685,191 points

Oct 20, 2018 9:33 AM in response to Phayn

If you post the report in a reply, someone here may be able to suggest something. Please use copy and paste as screen shots can be hard to read. Click “Share Report” button in the toolbar, select “Copy Report” and then paste into a reply. This will show what is running on your computer. No personal information is shown.

For the adware the report shows, run EtreCheck again.

In the Sidebar, click the Security button.

Locate and remove entries under Adware and Unsigned files.

Click the “Remove” button.

Reply

Answer 9

Cåts

Level 5

4,584 points

Oct 19, 2018 5:33 PM in response to Phayn

I’m so glad it helped you! It is very thorough. Yes, it tells you where the adware is and you can remove it yourself.

Definitely run it tomorrow and then you can get rid of the adware. It won’t take ling. that’s why it’s so awesome. After you remove the things that need removing, run it again to see the adware is gone.

reply tomorrow and let me know what else you found...hopefully you only find a good nights sleep.

Norge? Det er kult! god natt!

Reply

Answer 10

Phayn Author

Level 1

4 points

Oct 20, 2018 3:26 AM in response to Cåts

I am going to assume you google-translated that into Norwegian, so I will skip the comment/reply back with Norwegian, for your leisure 😉
So I've dug into my report from EtreCheck. I have successfully removed adware, which in my second diagnostic, shows to now be gone. Woop woop!

But, I did experience one popup ad as before - now 30 min ago (after the second diagnostic), but so far just the one, but I assume I'm not 100% in the clear. I still have 2 "major issues" - one being the lack of backup, and one being "unassigned files". It says these could be adware, too, so I'd like to remove these. My main problem now, is that I can't find the location/folder for these files :S It shows me a list of unassigned files, and says "library/LaunchAgent" is the location, but I have no folder with this name in my Library. I've also tried the ****+cmnd+G function in finder, and put in the individual file location strings from the etrecheck report, which only takes me to the Library, with the main folder overview (and with no folder called "LaunchAgents").

Do you have any suggestions?
I am posting my etrecheck report here for good measures. (Happy reading?:S)

EtreCheck version: 5.0.6 (5A017)

Report generated: 2018-10-20 12:10:15

Download EtreCheck from https://etrecheck.com

Runtime: 2:22

Performance: Excellent

Problem: Other problem

Description:

Random and frequent popup ads in Safari and Chrome (opening in new tabs), completely unrelated to browser usage. As long as browser is open - and even when not viewing any website - popup ads will appear.

Major Issues:

Anything that appears on this list needs immediate attention.

No Time Machine backup - Time Machine backup not found.

Unsigned files - There are unsigned software files installed that could be adware and should be reviewed.

Minor Issues:

These issues do not need immediate attention but they may indicate future problems.

Upgradeable RAM - This machine has upgradeable RAM that would help its performance.

High battery cycle count - Your battery may be losing capacity.

Apps with heavy CPU usage - There have been numerous cases of apps with heavy CPU usage.

Clean up - There are orphan files that could be removed.

Vintage hardware - This machine may be considered vintage.

32-bit Apps - This machine has 32-bits apps that may have problems in the future.

Abnormal shutdown - Your machine shut down abnormally.

Hardware Information:

MacBook Pro (15-inch, Late 2011) - Vintage!

MacBook Pro Model: MacBookPro8,2

1 2,2 GHz Intel Core i7 (i7-2675QM) CPU: 4-core

4 GB RAM - Upgradeable

BANK 0/DIMM0 - 2 GB DDR3 1333 ok

BANK 1/DIMM0 - 2 GB DDR3 1333 ok

Battery: Health = Replace Soon - Cycle count = 1137

Video Information:

Intel HD Graphics 3000 - VRAM: 384 MB

AMD Radeon HD 6750M - VRAM: 512 MB

Color LCD 1920 x 1080

BenQ GL2450H 1920 x 1080

Drives:

disk0 - Samsung SSD 850 EVO 500GB 500.11 GB (Solid State - TRIM: No)

Internal SATA 6 Gigabit Serial ATA

disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk0s2 [APFS Container] 499.90 GB

disk1 [APFS Virtual drive] 499.90 GB (Shared by 4 volumes)

disk1s1 - SSD (APFS) (Shared - 40.64 GB used)

disk1s2 - Preboot (APFS) [APFS Preboot] (Shared - 21 MB used)

disk1s3 - Recovery (APFS) [Recovery] (Shared - 519 MB used)

disk1s4 - VM (APFS) [APFS VM] (Shared - 3.22 GB used)

Mounted Volumes:

disk1s1 - SSD 499.90 GB (455.34 GB free)

APFS

Mount point: /

disk1s4 - VM [APFS VM] (Shared - 3.22 GB used)

APFS

Mount point: /private/var/vm

Network:

Interface en0: Ethernet

Proxies: HTTP, HTTPS

Interface en4: iPhone

Proxies: HTTP, HTTPS

Interface fw0: FireWire

Interface en1: Wi-Fi

802.11 a/b/g/n

Proxies: HTTP, HTTPS

Interface en3: Bluetooth PAN

Proxies: HTTP, HTTPS

Interface bridge0: Thunderbolt Bridge

Proxies: HTTP, HTTPS

iCloud Quota: 4.59 GB available

System Software:

macOS High Sierra 10.13.6 (17G65)

Time since boot: About 11 hours

Security:

System	Status
Gatekeeper	Enabled
System Integrity Protection	Enabled

Unsigned Files:

Launchd: ~/Library/LaunchAgents/com.Lezghian-frondiform.plist

Executable: ~/Library/splasher-auspicy/BFQwkSii/sujYuTsM/ioShxCnB/Lezghian-frondiform