UKC

I seem to have some kind of strange virus on my browser, putting unwanted links under certain words, that then open pop-up ads. It started on UKC last night, but it is now happening on some other websites. Also, on different browsers.

For example, at the top of the UKC forums page where it says

My Forums shows new or updated topics etc

the word shows has a double underlined link added. This opens something called idownplay.com.

Also, a lot of numbers are turned into links that lead to twenga.com

Sometimes all instances of the word 'all' are also turned into links.

Obviously something quiet serious, that needs a virus checker/cleaner - snag with those it that many of them, like MacKeeper, are scams that actually put viruses onto your computer! Can anyone recommend a trustworthy one for the Mac?

In reply to Gordon Stainforth:

On Windows it is a piece of software that can be removed using add/remove programs. Have a look in similar function on Mac to see if that works.

In reply to Gordon Stainforth:

I think it's called adware.

Look in your plug ins on your browsers and disable any that look a bit suspicious. Then look in control panel add remove programs and look for anything suspicious there too and delete.

Sorry a bit vague.

cheers

Gaz

In reply to Gazlynn:

I'm using Google Chrome. All I can find is 'Extensions' and there's nothing suspicious there - just Google Translate. Or are the Plug-ins somewhere else?

In reply to Gordon Stainforth:

I would then check your programs in control panel and look there.


cheers

Gaz

In reply to Gazlynn:

Thanks. Yes, I went through all the programs and deleted some recent oddities. and then in 'library' found several files with the dreaded word 'vsearch' - Googling had told me that these are often source of the prob - then restarted computer ... and all seems to be well now. Fingers crossed. It was getting v worrying because it was worsening almost by the minute, and computer getting slower and slower. Now right up to speed again.

I'd still like to know if anyone can recommend a trustworthy virus checker/cleaner.

In reply to Gordon Stainforth:

Doesn't matter what antivi you use, they won't pick up malware which is what your problem was.

Download malwarebytes and let it scan a couple of times. Don't set it to scan automatically or to start on reboot, you don't need it running constantly, just use it if you find a problem (like this one).

If you really want antivirus, just go with Microsoft Security Essentials, it's lightweight and does the job fairly well. But again it won't help you at all with problems like this.

In reply to Removed User:

Thanks, that's really helpful. I'll download that malwarebytes thing for any future problems. Have learned quite a lot this afternoon about malware...

In reply to Gordon Stainforth:

As far as I know Malwarebytes is only for Windows, like you, I'd be interested to hear of a Mac version, "just in case"

In reply to Gordon Stainforth:

Glad you've fixed it

Also worth noting to be really cautious when downloading stuff from the net that you don't accidentally tick or leave something un-ticked which is normally how these things end up on your pc.

cheers

Gaz

In reply to Gordon Stainforth:

Gordon, don't start deleting files out of your Library folder without knowing exactly what you're deleting. It can cripple your installation of OS X. In fact I would recommend reinstalling the OS now you've tampered with these files as there is no telling what damage you may have caused (on the plus side, this should sort out your adware problem). If you don't have a full backup of your files and apps, make one right now!

In reply to Gordon Stainforth:

Try
http://www.avg.com/content/AVG2013R2/gb-en/for-mac

In reply to Orgsm:

To be honest his problem is probably a dodgy Chrome extension. "Proper" malware does exist on Macs, but is extremely rare compared to Windows malware. In twenty years of using Macs every day I have never once seen any kind of malware on any of my computers.

In reply to Only a hill:

The only files I removed from the library were:

com.vsearch.agent.plist
com.vsearch.daemon.plist
com.vsearch.helper.plist

because I read on the internet that anything that has 'vsearch' in it is very dodgy.

There were also 3 mysterious new applications that had all today’s date on them:
Automator
NetServices
and
ProApps

which I've removed. I've left everything in the trash, in case the OS plays up in any way, but it seems fine.

In reply to Doug:


No, the good news is that there is a Mac version.

In reply to Doug:

... and the bad news is that it seems to be made by MacKeeper, which is famously dodgy.

In reply to Orgsm:

Please don't use AVG, OP. It's just awful. Use literally anything except for AVG, even Norton is a better choice - which should give you some idea of how awful AVG is.

In reply to Gordon Stainforth:

Automator is the OS X scripting program, odd that it has today's date on it. ProApp is an Apple suite of programmes - see http://en.wikipedia.org/wiki/Proapp to check if you have any of the programmes mentioned.

As far as Automator goes, try and start it via Spotlight.

You might have seen this http://www.thesafemac.com/mac-adware-menace-continues/#more-1448 about vsearch.

In reply to Gordon Stainforth:

Ok, in that case you should be safe ... as a matter of general principle, though, it's a good idea to leave Library and System alone unless you're 100% certain. It's normally straightforward to recover from a mashed installation of OS X these days, but it can be annoying and it will take some time.

As another user has stated, Automator is part of OS X. I have no idea what the other two apps are.

Hope you manage to fix the problem!