An open community 
of Macintosh users,
for Macintosh users.

FineTunedMac Dashboard widget now available! Download Here

Topic Options
#28694 - 04/23/14 02:11 AM popups
suzie Offline


Registered: 04/23/14
Hi,

I have been having some serious problems with popups on my mac. It all started happening after I downloaded a movie from pirate bay.com. I didn't realise it was such a dangerous site until now. I recently downloaded CCleaner, and it worked for a day and now the popups are back. They come up all the time on all sorts of sites. Just wondering if anyone knows how I can get to the root of the problem? and if thats even possible?

Thank you, any help would be appreciated.

Top
#28703 - 04/23/14 02:58 PM Re: popups [Re: suzie]
tacit Offline


Registered: 08/03/09
Loc: Portland, Oregon, USA
More information would be helpful. When do you see the popups? Do you see them when you're browsing the Web? What Web browser do you use?
_________________________
Photo gallery, all about me, and more: www.xeromag.com/franklin.html

Top
#28705 - 04/23/14 06:40 PM Re: popups [Re: tacit]
suzie Offline


Registered: 04/23/14
I see the pop ups all the time. Most of them are advertisements, others say "you have won something." Yes I see them when I am browsing the web. I use safari, I tried to see if they would appear using chrome, and they still do.

Top
#28708 - 04/24/14 02:43 AM Re: popups [Re: suzie]
tacit Offline


Registered: 08/03/09
Loc: Portland, Oregon, USA
In Chrome, click on the Chrome menu next to the Apple menu and choose the Preferences command. In the Preferences window, click Extensions. What extensions do you see listed there?
_________________________
Photo gallery, all about me, and more: www.xeromag.com/franklin.html

Top
#28712 - 04/24/14 04:06 AM Re: popups [Re: tacit]
suzie Offline


Registered: 04/23/14
I see google docs 0.5

Top
#28719 - 04/24/14 03:15 PM Re: popups [Re: suzie]
tacit Offline


Registered: 08/03/09
Loc: Portland, Oregon, USA
Nothing else? Hmm. That's odd. From the sound of things, you might be infected with the Genieo malware (that link describes how to see and remove it if you are), but it should show up as a browser extension in Safari.

Another possibility is you've been infected with DNSchanger. If you go to System Preferences, click Network, click on however you access the Internet, and click Advanced, and click DNS, what do you see listed for DNS Servers?

When you downloaded this movie, can you describe step by step what happened next? Did you see a dialog telling you that you had to install movie player software? Did you see something asking you to type your administrator password?
_________________________
Photo gallery, all about me, and more: www.xeromag.com/franklin.html

Top
#28723 - 04/26/14 01:58 AM Re: popups [Re: tacit]
suzie Offline


Registered: 04/23/14
In DNS servers I see 61.9.242.33 and 61.9.226.33

Hmm trying to remember, I remember I had to download something called utorrent to get the movie. I don't remember anything about a administrator password.

Thanks for helping me. I will try using the 'how to remove Genieo malware' link you sent me, and let you know how I go.


Edited by suzie (04/26/14 01:58 AM)

Top
#28811 - 04/28/14 10:54 PM Re: popups [Re: suzie]
artie505 Online


Registered: 08/04/09
uTorrent appears to be a reputable app, but considering its source, it may have been compromised; have you searched your Mac for any and all traces of it and removed them?
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#28813 - 04/29/14 01:26 AM Re: popups [Re: tacit]
artie505 Online


Registered: 08/04/09
This is interesting...perhaps significant:

This Google result reports a recent post to the uTorrent Forums, and this screenshot tells that the post has apparently been taken down.

(PUP.Optional.OpenCandy is a PC thing, but who knows what else is out there?)

Edit: For OS X, see Rookie error: how do I reverse ĀµTorrent installing ad/malware?. (Recent) Again, the linked uTorrent Forum post has apparently been taken down.
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#28814 - 04/29/14 03:46 AM Re: popups [Re: suzie]
artie505 Online


Registered: 08/04/09
Sorry, suzie, I clicked on the wrong link; my last post was intended for you.
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top

Moderator:  alternaut, dianne, dkmarsh