Mac Adware problem.

ZENER

Never thought I'd be posting about a problem like this but here goes.

I have a customers 13" MBP with 10.6.8 installed. Any site visited in Safari causes 2 to 3 ads to scroll up from the bottom of the page and several ads that may be part of the page get overlaid with different ads.

There was talk of the Yontoo malware/adware threat but I can't see any evidence of it on this machine. The only thing that stops the popups is disabling Javascript. Disabling Java doesn't have any effect.

Anyone have a similar issue ?

Ken

Nemeses

What happens in safe mode?

ZENER

Safe mode doesn't seem to have any effect at all. Still getting the ads.

Edit: This problem is only in Safari 5.1.9 which is installed. Firefox is fine.

Ken

Nemeses

Sounds like a bad extension or something running along with Safari then.

Try relocating /library/internet plugins - just in case its a bad plugin..

Also, Try a new user account - This will isolate it down to either being a system wide issue or just user account specific.

Sad Professor

What about Chrome? Firefox uses its own proxy settings, separate from the system settings. Check the proxy settings in Network preferences. The DNS as well while you are at it.

If Chrome is fine then this is most likely an extension issue. Start by looking in Safari preferences > Extensions and disabling everything.

ZENER

I tried Safe Mode - ads still appear.
Created a new user account - no ads.
Tried Firefox - no ads.
Checked all the extensions - nothing unusual there.
Ran Onyx to clear all caches - no effect.

Seems only the original user account with Safari is affected unless Javascript is disabled.
DNS is set to 8.8.8.8 .

I removed a lot of suspect items and there are less ads appearing, down to just one popup which rises from the bottom of the window with words from the page it appears over and a link to various AV packages and speed test sites which then lead to offering to scan my computer for malware.

No unusual processes running either and no messages in console relating to the ads.

Edit: Just installed Chrome - no ad popups. So it's restricted to Safari on the original user (Administrator) account.
Proxy settings are default - nothing unusual there.

Ironically the user has Avast AV installed !?

Ken

ZENER

Ok some progress. I moved the users /library/safari folder to the desktop and restarted Safari and the ads are gone. To confirm I moved just the Extensions folder back and the ads returned. There were only three files in there :

adblock.safariextz
Extensions.plist
Flash Player.safariextz

I returned the adblock file - no ads.

Reinstalled flashplayer from the adobe website and still no ads ! but the Flash Player.safariextz did not reappear in that folder, should it ?

Anyway the ads are gone so all good !! So it must have been one of these two files :

Extensions.plist
Flash Player.safariextz


Ken

muggyog

Well look what we have here.

Seems safariextz is the new malware opportunity. Plenty of malicious potential inside.

Nemeses

Was just about to say:
Adobe Flash Player will NOT appear as an extension in Safari.

Seems like some Crapware installed on this machine.


Glad to hear its resolved!

Liameter

Make sure the customer is no longer running as "admin" so he can't accidentally install it again.