adware on mac - help

[jsh1970]

good morning,

my mom's mac seems to be infected with some kind of adware. she gets these random popups for viagra (the viagra ad is always the same) and also pornographic material. i had her install and run a couple of free antivirus program (ClamXav and iAntivirus) and neither of those programs found anything. i've had her "reset" safari and restart the computer, but that didn't make it go away. she also deleted her microsoft messenger application.

a red exclamation mark is now appearing up at the top right of her screen - next to the the time machine icon. when she clicks it, a window appears underneath it and gives different options:

scan now
clean up
control center
system info
settings
about
register

when she does the "scan now" option, the red exclamation mark blinks and it says virus found: spyware, safari webpage backdoor, safari sync, trojanfpurpdatepf

does anyone have any idea what is going on? i've been using macs for many years and have never seen anything like this. she just uses the computer for email.

if anyone has any suggestions it would be greatly appreciated. thank you.

 

[miles01110]

Looks like she installed or ran some bogus process without thinking about it. If you can't localize the problem readily, an OS reinstall is probably your best option.

 

[jsh1970]

Looks like she installed or ran some bogus process without thinking about it. If you can't localize the problem readily, an OS reinstall is probably your best option.

ok - thank you for the message. would that involve reformatting the hard drive, or can we just use the back up disc to overwrite the operating system? thank you.

 

[Dustman]

...

OR click "about", find out what the name of the bogus program is, and delete it. if you can't find it spotlight should find it for you if you type it in there. Since it's adware on a Mac i'd guess its not all that elaborate or hard to get rid of.

 

[miles01110]

ok - thank you for the message. would that involve reformatting the hard drive, or can we just use the back up disc to overwrite the operating system? thank you.

You'd want to boot from your system restore discs (the grey ones that come with your Mac) or a retail disc (with the picture of the cat on it). It will walk you through the setup for the reinstall.

Before you do it, you may want to make a list of any other programs you may have installed on your machine and make backups of any documents you want. Reinstalling the operating system will wipe those out.

 

[jsh1970]

...

OR click "about", find out what the name of the bogus program is, and delete it. if you can't find it spotlight should find it for you if you type it in there. Since it's adware on a Mac i'd guess its not all that elaborate or hard to get rid of.

when she clicks "about" it basically brings up an ad for a "mac protector" program. it seems that this red exclamation mark might be part of the adware program.

 

[GGJstudios]

when she clicks "about" it basically brings up an ad for a "mac protector" program. it seems that this red exclamation mark might be part of the adware program.

There has never been a virus in the wild that affects Mac OS X since it was released 10 years ago. The handful of trojans that exist can be easily avoided with some education and common sense and care in what software you install:

Mac Virus/Malware Info​

The first section of that link deals specifically with the MacDefender/MacSecurity/MacProtector issue. I encourage you to read it. Also read the section "Why am I being redirected to other sites?".

 

[jsh1970]

thanks guys for the responses. i'm in ohio and my mom is in tennessee, so i'm limited as to how much i can help her right now. i'll be there next month and i'll likely just reinstall os x.

 

[GGJstudios]

thanks guys for the responses. i'm in ohio and my mom is in tennessee, so i'm limited as to how much i can help her right now. i'll be there next month and i'll likely just reinstall os x.

You can help her remotely, using TeamViewer.

 

[jsh1970]

You can help her remotely, using TeamViewer.

that's pretty sweet - i never knew about that. thank you!

 

[jsh1970]

used team viewer to look at my mom's hard drive. i found a .txt file that had the malicious code, as well as the "macprotector" file in the applications folder. deleted both and no more problems. thanks to everyone for the help on that.

 

[GGJstudios]

used team viewer to look at my mom's hard drive. i found a .txt file that had the malicious code, as well as the "macprotector" file in the applications folder. deleted both and no more problems. thanks to everyone for the help on that.

.txt files don't have malicious code, since .txt files can't execute. If she actually installed it, there's possibly more remnants of it left behind. The only effective method for complete app removal is manual deletion:

Best way to FULLY DELETE a program​

 

[jsh1970]

.txt files don't have malicious code, since .txt files can't execute. If she actually installed it, there's possibly more remnants of it left behind. The only effective method for complete app removal is manual deletion:

Best way to FULLY DELETE a program​

fortunately she didn't install the program. after deleting the .txt file and application file and restarting the computer, that red exclamation mark was gone and no more popups. hopefully that will be the end of it.

that's good to know about manual deletion, though.