Please help a tech dummy remove malware from her Mac!

December 20, 2014 12:01 PM

My husband somehow got malware installed using safari. The malware is a popup that will not go away and looks like this. We have a mac running OS X. What do we do? Truly, we are tech dummies and need instructions a 6 year old could follow.
posted by waterisfinite to Computers & Internet (8 answers total)

Response by poster: I'm posting this from Firefox, which still works fine.
posted by waterisfinite at 12:01 PM on December 20, 2014

It's possible this is just a simple Safari Extension. Go to Safari Preferences, click the Extensions Tab, and select and remove from the list on the left any extensions you didn't install deliberately.

You also may want to forward that screenshot to whomever at NetDNA (now called MaxCDN) handles abuse; the browser error message has revealed the website that is hosting that scam page, and it's on NetDNA's CDN (Content Delivery Network). Try starting here.
posted by Sunburnt at 12:13 PM on December 20, 2014 [1 favorite]

Best answer: You can download Adware Medic with Firefox (assuming there isn’t something in your hosts file that is blocking the download—in which case do it from another computer and bring it over on a flash drive) and run it. It will clean up most infestations on a Mac. It’s a good little app, made by the person who runs The Safe Mac (which is pretty much the clearinghouse for details on the few pieces of Mac malware that are floating around out there).
posted by bcwinters at 12:31 PM on December 20, 2014

In the preferences for Safari menu you can choose to disable or remove Browser Extensions, that looks like what this little beaut is.
posted by nickggully at 12:57 PM on December 20, 2014

Best answer: It's more likely that this is a malicious pop-up that is being reloaded by Safari, rather than a malicious Safari Extension or other adware. If you relaunch Safari, the last page will reopen. To prevent this from happening, you can try holding down the Shift key while opening Safari. This will prevent the windows opened in the last session of Safari from reopening.

If that doesn't work, try the following steps:

1. Is Safari running right now? If not, go to step 4.
2. Force-quit Safari by pressing the Command, Option, and Esc keys simultaneously. Hold the keys down until the Force Quit window appears.
3. Select Safari in the Force Quit window. Click the Force Quit button. Wait for Safari to exit.
4. Disable your network connection. Depending on how you connect to the Internet , the easiest way to do this might be to just turn off Wi-Fi or unplug your Ethernet cable.
5. Open Safari normally.
6. Safari will try to reload the malicious webpage, but without a connection, it won't be able to.
7. Enter a new site into the address field at the top of the browser window in order to navigate away from that page by entering a different URL. Entering "www.apple.com" would be fine. Try to load the new site (hit Return or click the little reload icon).
8. Select Preferences from the Safari menu. Click the General tab. Make sure the Homepage is set to something reasonable, or is blank.
9. Quit Safari and re-enable your network connection.

posted by RichardP at 1:18 PM on December 20, 2014

Response by poster: Thanks, all. I seem to have gotten this under control, but would not have done without your help. Gawd, I love this place.
posted by waterisfinite at 1:23 PM on December 20, 2014

Don't download or install anything. A specially avoid Mac Keeper....

Reboot the mac in "Safe Mode" by restarting the Mac while holding down the shift key.
The open Safari and reset the browser.
posted by Mac-Expert at 8:29 PM on December 20, 2014

Also please for the love of god get adblock (ghostery is good too...anti-spyware/tracking) It's 2014, not 1990. Safari> Safari Extensions... (oh look adbock is #1) I have them both as buttons in my menu bar so I can pause them on the rare occasions that I need to.
posted by sexyrobot at 3:54 PM on December 21, 2014