Welcome to the MacNN Forums.

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

You are here: MacNN Forums > Software - Troubleshooting and Discussion > macOS > Pop Up Ad Virus

Pop Up Ad Virus
Thread Tools
Ralph Tomaccio
Junior Member
Join Date: Nov 1999
Location: Slatersville RI
Status: Offline
Reply With Quote
Sep 4, 2019, 06:48 PM
 
Apparently, I have managed to get a pop up ad virus in Safari. Almost every time I click on a legitimate link in one window or go to a new web site, a new window opens either with some ad, a warning that Flash player is corrupt or needs updating, or "Your system is corrupted with 3 viruses". Very annoying.

I am using a mid-2010 iMac running the latest OS allowed - version 10.13.6. No jokes, please. I'm 73 and my computer needs are minimal. It is serving me just fine for now, except for this issue.

Here's what I've tried so far:
1. Checked Safari Preferences/Security to make sure "block pop up windows" is selected
2. Ran Disk Utility
3. Ran Onyx
4. Reinstalled the OS

My question: Is there any way to get rid of this virus without having to spend money to do so? Any other suggestions?

If not, what is a reasonably priced good piece of software that you recommend?

Your help is most appreciated. TIA

Ralph
     
reader50
Administrator
Join Date: Jun 2000
Location: California
Status: Online
Reply With Quote
Sep 4, 2019, 06:53 PM
 
Check Safari Extensions for something undesirable. (Safari Prefs -> Extensions (tab) )

You may have been tricked into installing one at some point. Also check your "home page" setting, to see if it leads to an ad-serve page.
     
Ralph Tomaccio  (op)
Junior Member
Join Date: Nov 1999
Location: Slatersville RI
Status: Offline
Reply With Quote
Sep 4, 2019, 07:05 PM
 
Good suggestions. As for undesirable extensions, there are only two: Amazon Assistant and Honey.

Home page was checked as well and it's what should be there. Just recently, when I start Safari, my Home Page isn't loading. I've tried deleting it and resetting it to no avail. This started after I reinstalled the OS.
     
reader50
Administrator
Join Date: Jun 2000
Location: California
Status: Online
Reply With Quote
Sep 4, 2019, 07:33 PM
 
Disable both extensions, relaunch Safari, see if that fixes it. If it does, narrow down which one. My guess would be Honey. If memory serves, it's a find-the-best-price plugin. Which would require checking outside servers.

You can also try another browser (Firefox, Chrome, Opera, iCab, Omniweb) to confirm the problem is limited to Safari.
     
andi*pandi
Moderator
Join Date: Jun 2000
Location: inside 128, north of 90
Status: Offline
Reply With Quote
Sep 4, 2019, 08:15 PM
 
I have amazon assistant and know lots of people use Honey. If they were bad surely the internet would be abuzz?

Clearing cache and history wouldn't hurt.
Sophos antivirus is free, IIRC.
     
Ralph Tomaccio  (op)
Junior Member
Join Date: Nov 1999
Location: Slatersville RI
Status: Offline
Reply With Quote
Sep 5, 2019, 09:43 AM
 
Originally Posted by reader50 View Post
Disable both extensions, relaunch Safari, see if that fixes it. If it does, narrow down which one. My guess would be Honey. If memory serves, it's a find-the-best-price plugin. Which would require checking outside servers.

You can also try another browser (Firefox, Chrome, Opera, iCab, Omniweb) to confirm the problem is limited to Safari.
Uninstalled both extensions, restarted the computer and found that the problem was still there.

My wife uses Firefox on this same computer and isn't having the problem.
     
Ralph Tomaccio  (op)
Junior Member
Join Date: Nov 1999
Location: Slatersville RI
Status: Offline
Reply With Quote
Sep 5, 2019, 09:44 AM
 
I just tried Malwarebytes and, crossing my fingers, it seems to have gotten rid of the problem. Let's hope it remains that way.

Thank you all for your suggestions. They are greatly appreciated. I will keep this thread in mind should my issue returns.
     
reader50
Administrator
Join Date: Jun 2000
Location: California
Status: Online
Reply With Quote
Sep 5, 2019, 01:25 PM
 
What did Malwarebytes find? Did you save its log?

I haven't heard of this problem before. Knowing the cause would be helpful to the next person.
     
Ralph Tomaccio  (op)
Junior Member
Join Date: Nov 1999
Location: Slatersville RI
Status: Offline
Reply With Quote
Sep 5, 2019, 05:57 PM
 
I didn't save the log - BUT - I didn't delete it either.

Below are the results of the Malwarebytes scan. It doesn't allow changing window size to include all the results, nor does it allow doing a print-out, at least in the free version, so I did a bottom and top half screen shot.

If you see something that should be restored, please let me know. Likewise, should you be able to identify the culprits, please advise.



     
reader50
Administrator
Join Date: Jun 2000
Location: California
Status: Online
Reply With Quote
Sep 5, 2019, 06:10 PM
 
I don't know any of those off-hand. The dangerous ones are the files in:
/Users/Ralph/Library/LaunchAgents/

.plist files in ~/Library/LaunchAgents/ launch apps when you log into your account.
No examples are shown, but .plist files in /Library/LaunchAgents/ (or LaunchDaemons) launch apps or services when you boot up.

Another place to check is System Prefs -> Users & Groups (formerly Accounts) -> (your user name) -> Login Items
     
andi*pandi
Moderator
Join Date: Jun 2000
Location: inside 128, north of 90
Status: Offline
Reply With Quote
Sep 5, 2019, 08:27 PM
 
Hmm, sounds like MacShiny is one of the culprits... a fake "cleaner" app like MacKeeper!
https://www.symantec.com/security-ce...010215-2400-99
     
Ralph Tomaccio  (op)
Junior Member
Join Date: Nov 1999
Location: Slatersville RI
Status: Offline
Reply With Quote
Sep 5, 2019, 09:45 PM
 
Thanks for your additional input, guys!
     
   
Thread Tools
 
Forum Links
Forum Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Top
Privacy Policy
All times are GMT -4. The time now is 01:51 PM.
All contents of these forums © 1995-2017 MacNN. All rights reserved.
Branding + Design: www.gesamtbild.com
vBulletin v.3.8.8 © 2000-2017, Jelsoft Enterprises Ltd.,