Weird pop-up

Discussion in 'OS X El Capitan (10.11)' started by alvaroaaa, Dec 14, 2015.

  1. alvaroaaa macrumors newbie

    Joined:
    Dec 14, 2015
    #1
    Good evening everyone.

    I recently bought a Macbook Air about a month ago, and I have been using it for work and study stuff mainly (so basically Office and Safari, nothing else). I haven't even downloaded any software or anything like that.

    Last week a weird pop-up started to appear, and after doing a little bit of research it appears to be a virus??? And it seems very weird since I haven't done anything "dangerous" with this computer, and it is new! I have deleted History and Cache, but apparently it keeps coming once or twice a day.

    I've uploaded a print screen of the pop up.

    Could you please help me?

    Thanks!
     

    Attached Files:

  2. xgman macrumors 601

    xgman

    Joined:
    Aug 6, 2007
    #2
    If it was me, I'd search for "adfarm" with easyfind (free) and delete any items with that name on your computer, and also check your startup page in Safari or any other browser you use.
     
  3. fisherking macrumors 603

    fisherking

    Joined:
    Jul 16, 2010
    Location:
    ny somewhere
    #3
    what xgman said. & close safari first. some items may not be 'deletable' from the easyfind window; in that case, open the enclosing folder (it will show on the bottom of the easyfind window), find the offending items, then delete (you may need to input your mac password). when you're done, reboot...
     
  4. alvaroaaa thread starter macrumors newbie

    Joined:
    Dec 14, 2015
    #4
    Thank you for your replies fisher king and xgman.

    I just searched for 'adfarm' and 'mediaplex' using EasyFind, and I looked in every folder (Applications, Library, Systems and Users) with no success... I'm attaching a print screen.

    What do you think is wrong?

    Thanks again!
     

    Attached Files:

  5. fisherking macrumors 603

    fisherking

    Joined:
    Jul 16, 2010
    Location:
    ny somewhere
    #5
    you're only searching your "Users" folder; change that to your hard drive (ie "Macintosh HD"). then you'll find those things...
     
  6. alvaroaaa thread starter macrumors newbie

    Joined:
    Dec 14, 2015
    #6
    That's true fisherking, thanks! I just searched again and I found these files (attached). Should I delete them all?

    Sorry for asking so many questions! But this is my first Mac.

    Thanks again!
     

    Attached Files:

  7. fisherking macrumors 603

    fisherking

    Joined:
    Jul 16, 2010
    Location:
    ny somewhere
    #7
    there may be more stuff...but the adhosts.plist is the ONLY thing i'd delete there. you may want to check out this: http://www.adwaremedic.com/index.php

    but FIRST: check system preferences (under the apple menu), users and groups>login items. anything there besides itunes? if there's anything with 'adware' or 'mediaplex', remove it. also, check easyfind for 'mediaplex'.

    always be very careful about deleting files thru easyfind...
     
  8. alvaroaaa thread starter macrumors newbie

    Joined:
    Dec 14, 2015
    #8
    Good to know! Thankfully I didn't delete anything.

    I just checked again and there's nothing if I look for "mediaplex" and, moreover, there's nothing if I only check Files (the print screen I sent before is "file contents") for "adfarm" as well. Strange?

    Also, there's only iTunes in "Login Items". So, I guess it is looking normal, right? Why do you think the Pop-up is appearing?

    Thanks!!
     
  9. howiest macrumors regular

    howiest

    Joined:
    Aug 16, 2015
    Location:
    Left Coast
  10. xgman macrumors 601

    xgman

    Joined:
    Aug 6, 2007
    #10
    You should search for "files and folders", not "file content" in easy find and the I'd delete anything it finds that clearly has adfarm in it. I actually don't use safari. I prefer Firefox or Chrome for browsing control. Also clear the safari internet cache (google how) and maybe even clear the cookies. Onyx utility might be helpful there. It's free.
     

Share This Page