Welcome to the MacNN Forums.

Pootie Tang · Mar 22, 2015, 03:08 PM

Hey folks, last night I was browsing in Safari when I noticed that two of my personal sites had links for "macshop" hanging out on the pages. I thought my hosting company was doing something without telling me, until I saw that other sites were showing the same macshop crap.

Specific words were highlighted on these pages and when the cursor was over them, they linked to ads that were related to that word. I wound up on ad and product pages merely from clicking a link that had nothing to do with the page I was diverted to.

Safari only suffers from this. I've since downloaded Opera and Google Chrome, and they've behaved normally (except a video on one of my sites won't play on either browser due to the lack of some unnamed plug-in).

Help?!?

turtle777 · Mar 22, 2015, 03:27 PM

Sounds like cookies that drive ads.

When you switched to new browsers, there was no history / cookies for ads to fall back on,

-t

Pootie Tang · Mar 22, 2015, 07:29 PM

Nope, that's not it. I installed those browsers as a result of the problems with Safari.

turtle777 · Mar 22, 2015, 10:32 PM

I'm not sure I understand your problem, especially since you used the word "virus", which really doesn't make much sense in this context.

What are "personal sites" ?
Can you post a link ?
Did you create these websites, and you host them ?
What tools did you use to create them?

-t

Pootie Tang · Mar 23, 2015, 02:50 AM

Hey Turtle, thanks for trying to help. Let me see if I cannot explain more clearly what's going on.

To be as simple and as direct as I can, my copy of Safari, as of Saturday evening, appears to have been taken over by some kind of adware thing. I am not sure what else to call it. I've never seen anything like this before. No other part of my machine's affected. All of my other programs, including other web browsers, are running as normal.

What do I mean by adware or virus? Well, I am not sure what else to call it when on every page Safari opens, personal or not, there are multiple text blocks saying "macshop" placed in the white areas of a given page. Key words, like "flight" or "Vegas", are highlighted (bolded and italicized) with a little advertising green triangle icon next to it. When I place my cursor near these blocks of altered text, a pop-up of an ad appears, giving me the option to go to a page providing some kind of service or product related to that word. On one of my sites, I have the word "flight". It is actually the name of a company I worked for. It has nothing to do with travel and the text is a simple, regular font face. Now, it is changed in color, bolded and italicized and linked to some kind of travel service. I see this now on any and every page I go to, not just one I put up myself.

Does my description make any sense? But wait, there's more.

I can fill out a form or click on a link, and I will be directed to a completely unrelated page for a product or service sponsored by none other than "Macshop". I can leave the page and resume what I originally intended to do, but with difficulty. While all this nonsense is going on, the page's side scroller keeps flickering and changing length.

Does this help at all? Thanks.

turtle777 · Mar 23, 2015, 07:48 AM

Check your Safari extensions.

See here: https://discussions.apple.com/thread/6859188

-t

Spheric Harlot · Mar 23, 2015, 09:05 AM

You have inadvertently downloaded and installed the "MacShop" malware program.

Here is how to get rid of it:

Remove "Ads by MacShop" virus from Apple Mac OS X

turtle777 · Mar 23, 2015, 10:05 PM

Bingo. I still do t get why they call it a "virus".

Malware is the correct term.

-t

Pootie Tang · Mar 24, 2015, 04:56 AM

Hey... thanks to you all for chiming in. The extension deletion seems to have solved it. Some idiotic plug-in named 'shoopimac' has been deleted, along with another one, and my Safari is now behaving normally.

Thanks all.

Charles Martin · Mar 25, 2015, 01:30 AM

For future reference: this was not at any point a virus. There aren't any viruses for the Mac, there are just people (and, sadly, many media sites) that think any sort of malware is a "virus" in the same way that any facial tissue, regardless of brand, is a "Kleenex."

What you had was adware. I'm glad you found out how to remove it yourself, but the free (donationware) Adware Medic could also have done the job for you (and this goes for anyone reading this who is experiencing ad-related malware).

climacs · Mar 25, 2015, 09:45 AM

I had something like this recently, except it was 'macvx'. Same solution. Not a huge deal.

Spheric Harlot · Mar 25, 2015, 10:03 AM

HEADS UP:

My girlfriend had a similar bit of crapware on her machine.

That one included a StartupItem that would reinstall it after every reboot.