An open community 
of Macintosh users,
for Macintosh users.

FineTunedMac Dashboard widget now available! Download Here

Previous Thread
Next Thread
Print Thread
popups
#28694 04/23/14 09:11 AM
Joined: Apr 2014
suzie Offline OP
OP Offline

Joined: Apr 2014
Hi,

I have been having some serious problems with popups on my mac. It all started happening after I downloaded a movie from pirate bay.com. I didn't realise it was such a dangerous site until now. I recently downloaded CCleaner, and it worked for a day and now the popups are back. They come up all the time on all sorts of sites. Just wondering if anyone knows how I can get to the root of the problem? and if thats even possible?

Thank you, any help would be appreciated.

Re: popups
suzie #28703 04/23/14 09:58 PM
Joined: Aug 2009
Likes: 1
Offline

Joined: Aug 2009
Likes: 1
More information would be helpful. When do you see the popups? Do you see them when you're browsing the Web? What Web browser do you use?


Photo gallery, all about me, and more: www.xeromag.com/franklin.html
Re: popups
tacit #28705 04/24/14 01:40 AM
Joined: Apr 2014
suzie Offline OP
OP Offline

Joined: Apr 2014
I see the pop ups all the time. Most of them are advertisements, others say "you have won something." Yes I see them when I am browsing the web. I use safari, I tried to see if they would appear using chrome, and they still do.

Re: popups
suzie #28708 04/24/14 09:43 AM
Joined: Aug 2009
Likes: 1
Offline

Joined: Aug 2009
Likes: 1
In Chrome, click on the Chrome menu next to the Apple menu and choose the Preferences command. In the Preferences window, click Extensions. What extensions do you see listed there?


Photo gallery, all about me, and more: www.xeromag.com/franklin.html
Re: popups
tacit #28712 04/24/14 11:06 AM
Joined: Apr 2014
suzie Offline OP
OP Offline

Joined: Apr 2014
I see google docs 0.5

Re: popups
suzie #28719 04/24/14 10:15 PM
Joined: Aug 2009
Likes: 1
Offline

Joined: Aug 2009
Likes: 1
Nothing else? Hmm. That's odd. From the sound of things, you might be infected with the Genieo malware (that link describes how to see and remove it if you are), but it should show up as a browser extension in Safari.

Another possibility is you've been infected with DNSchanger. If you go to System Preferences, click Network, click on however you access the Internet, and click Advanced, and click DNS, what do you see listed for DNS Servers?

When you downloaded this movie, can you describe step by step what happened next? Did you see a dialog telling you that you had to install movie player software? Did you see something asking you to type your administrator password?


Photo gallery, all about me, and more: www.xeromag.com/franklin.html
Re: popups
tacit #28723 04/26/14 08:58 AM
Joined: Apr 2014
suzie Offline OP
OP Offline

Joined: Apr 2014
In DNS servers I see 61.9.242.33 and 61.9.226.33

Hmm trying to remember, I remember I had to download something called utorrent to get the movie. I don't remember anything about a administrator password.

Thanks for helping me. I will try using the 'how to remove Genieo malware' link you sent me, and let you know how I go.

Last edited by suzie; 04/26/14 08:58 AM.
Re: popups
suzie #28811 04/29/14 05:54 AM
Joined: Aug 2009
Likes: 15
Online

Joined: Aug 2009
Likes: 15
uTorrent appears to be a reputable app, but considering its source, it may have been compromised; have you searched your Mac for any and all traces of it and removed them?


The new Great Equalizer is the SEND button.

In Memory of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire
Re: popups
tacit #28813 04/29/14 08:26 AM
Joined: Aug 2009
Likes: 15
Online

Joined: Aug 2009
Likes: 15
This is interesting...perhaps significant:

This Google result reports a recent post to the uTorrent Forums, and this screenshot tells that the post has apparently been taken down.

(PUP.Optional.OpenCandy is a PC thing, but who knows what else is out there?)

Edit: For OS X, see Rookie error: how do I reverse µTorrent installing ad/malware?. (Recent) Again, the linked uTorrent Forum post has apparently been taken down.


The new Great Equalizer is the SEND button.

In Memory of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire
Re: popups
suzie #28814 04/29/14 10:46 AM
Joined: Aug 2009
Likes: 15
Online

Joined: Aug 2009
Likes: 15
Sorry, suzie, I clicked on the wrong link; my last post was intended for you.


The new Great Equalizer is the SEND button.

In Memory of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Moderated by  cyn 

Link Copied to Clipboard
Powered by UBB.threads™ PHP Forum Software 7.7.4
(Release build 20200307)
Responsive Width:

PHP: 7.4.33 Page Time: 0.020s Queries: 34 (0.015s) Memory: 0.6155 MB (Peak: 0.6997 MB) Data Comp: Zlib Server Time: 2024-03-29 14:59:38 UTC
Valid HTML 5 and Valid CSS