Sentry Page Protection
Member Login Member Login
Member Login
Welcome, (First Name)!
Forgot? Show
Log In
Enter Member Area
My Profile Not a member? Sign up. Log Out

Handy Hints and Tips for your Mac

103 - Fixing a Mac web browser that has been hijacked by ads

Picture
Well, yesterday really was a day that was all about dealing with adware on both Windows and Mac computers, with 3 different people needing iTandCoffee help with this problem.

Yesterday morning, I published on this blog some information about how to deal with such a problem on a Windows computer.  

(See What do you do when your Windows computer's web browser is hijacked by Ads.)

If you have a Mac computer, here is how to deal with this same problem, as it has quite a different set of steps to Windows.  And it doesn't involve spending any money to download any 'cleanup' software,  In fact, these 'cleanup' apps can often introduction their own problems, so should be avoided like the plague!

It is relatively quick and easy to get rid of the adware manually, once you know where to look and what to look for.  Save away this article just in case it happens again in future!

First, remove any web browser 'extensions' that have installed themselves ...

Picture
My extensions list - none of which are Adware!
This the same step as applies for Windows computers. Below are the instructions for Safari on your Mac: 
  • Open Safari
  • Select Preferences from the Safari menu (at top left). 
  • Click on the Extensions icon in the toolbar. 
  • Disable any Extensions that you did not deliberately install yourself - you will see an 'Enable' checkbox in the top section of each Extension, so untick any that look suspicious.
  • If in doubt, disable all of them and then, once the problem disappears, try re-enabling one by one to see if the problem re-appears.

Now remove any other problem files lurking in your Mac's libraries

Disabling extensions is usually not enough, as these little blighters will also have installed some other items elsewhere - hidden away where you would not normally see them.  Unlike Windows, these are not found in your Programs and Features list, the equivalent of which is your Applications folder in Mac's Finder.

You will need to hunt out and eradicate these few extra files.  The four Finder locations you will need to look at are ...
  • ~/Library/Launchagents
  • ~/Library/Launchdaemons
  • /Library/Launchagents
  • /Library/Launchdaemons
  • /Library/Application Support/

Open Finder and, from the Finder menubar, choose Go -> Go to Folder, then type in one of the above locations and click Go.  (You can also copy and paste the paths shown in the list above, the save on typing.)

Usually, you will quite easily notice some items in that selected location that don't belong.  

Yesterday, the culprits were named after the planets - pluto, jupiter, venus.  Genio has been another common one that I have encountered.

Often the 'Date Added' for the files will be a vital clue in determining the nasties - assuming you know when the problem started.  

When you find the suspicious files, move them to the trash.

Here is what Apple says in a Support article about what to look for:
Look for a files named com.*.agent.plist. The asterisk (*) could be any word, including "Apple." Example: com.midnight.agent.plist. Move the file to the Trash.

Go to the /Library/LaunchDaemons/ folder and look for a file named com.*.daemon.plist and a file named com.*.helper.plist. The asterisk (*) could be any word, but it will be the same word used in the LaunchAgents folder, above. Example: com.midnight.daemon.plist and com.midnight.helper.plist. Move the files to the Trash.

Go to the /Library/Application Support/ folder and look for a file name that is the same word used in the LaunchAgents and LaunchDaemons folders, above. Example: midnight. Move the file to the Trash.
Picture
My Library (minus any Adware at the moment!)
Once you have 'rooted out' all these unwanted files, restart your Mac.

Go back into your Web Browser, and check that the problem has now been resolved.  Do a few Google searches, and make sure you are no longer being 'hijacked' and taken to some other search engine or site.

Then, to remove those nasties from your computer for good, remember to empty your Trash.

Need further help?

If this doesn't seem to solve your problem (or if you have any difficulty with these instructions), iTandCoffee can help.  Call 1300 885 420.