How to control pop-up ads and ad-injection software (adware)
Pop-up ads are advertisements that open over or under your browser window, in another tab, or as a graphic element within the current window. To control pop-ups, you can update your software and adjust Safari settings. In some cases, you might need to remove adware.
Like phishing email, some pop-ups pretend to be from Apple or another trusted company to trick you into giving personal information. If you're concerned about a pop-up, follow the steps below or contact Apple.
Close pop-up ads
Start by closing any pop-ups that are open.
- If a pop-up on your Mac includes a "Don't show more alerts from this webpage" checkbox, select the checkbox before closing the pop-up.
- If you see a Block Alerts button after dismissing a pop-up on your iPhone, iPad, or iPod touch, tap the button to stop showing alerts from that webpage.
If a pop-up won't close:
- On your Mac, force Safari to close. The next time you open Safari, hold down the Shift key while Safari opens. This prevents Safari from automatically reopening any windows.
- On your iPhone, iPad, or iPod touch, force Safari to close. To prevent Safari from automatically reopening any windows, go to Settings > Safari, then tap Clear History and Website Data. This also removes your browser history and cookies.
Update your software
Keep your Mac software and iOS software up to date. Some software updates, such as OS X Yosemite v10.10.4, include improvements that help control pop-ups.
Check Safari settings and extensions
On your Mac, choose Preferences from the Safari menu, then follow these steps:
- Click the Security icon and select “Block pop-up windows" to stop some types of pop-ups.
- Check your homepage and search-engine settings. Ad-injection software sometimes changes these settings.
- Click the General icon and make sure that the Homepage field is empty or contains the website you want.
- Click the Search icon and make sure that the search engine setting shows your preferred search engine. In some versions of Safari, this setting is in the General pane.
- Click the Extensions icon. If you don't want a Safari Extension or don't know what it does, select the extension from the list and click Uninstall. These extensions are known to cause pop-up ads:
- Amazon Shopping Assistant by Spigot Inc.
- Cinema-Plus Pro or variations such as Cinema + HD, Cinema + Plus, and Cinema Ploos
- Ebay Shopping Assistant by Spigot Inc.
- FlashMall
- GoPhoto.It
- Omnibar
- Searchme by Spigot, Inc
- Slick Savings by Spigot Inc.
- Shopy Mate
On your iPhone, iPad, or iPod touch, you can adjust similar settings in Safari.
Check for adware on your Mac
The remainder of this article describes how to find and remove certain well-known ad-injection software (adware) from your Mac. Adware is advertising-supported software that can come from third-party download sites. The software you download from such sites can include both the software that you want and the adware.
These steps require quitting Safari. To view this article outside of Safari, you can save it as a PDF and open it in Preview.
Quit Safari, then use this "Go to Folder" method to find and remove each item listed in the sections below, one item at a time:
- Select an entire line in the lists below, starting with
/System/Library/Frameworks/v.framework, for example. - Choose Edit > Copy.
- Open a Finder window, then choose View > As Columns.
- Choose Go > Go to Folder.
- Choose Edit > Paste to paste the line you copied into the text field.
- Press Return.
- If the item is on your Mac, a window opens with the item you searched for already selected. Drag only that item to the Trash. If you're asked to enter a password, enter your administrator password.
- If the item isn't on your Mac, you'll see a message that the folder can't be found. Continue to the next item in the list.
Remove Downlite, VSearch, Conduit, Trovi, MyBrand, Search Protect, Buca Apps
Use Go to Folder to find and remove each of these items:
/System/Library/Frameworks/v.framework/System/Library/Frameworks/VSearch.framework/Library/PrivilegedHelperTools/Jack/Library/InputManagers/CTLoader//Library/Application Support/Conduit/~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin~/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin/Applications/SearchProtect.app/Applications/WebTools.app/Applications/cinemapro1-2.app~/Applications/cinemapro1-2.app
After you remove the items above, restart your Mac. Then choose Finder > Empty Trash to permanently remove them.
The next time you open Safari, hold down the Shift key while Safari opens. This prevents Safari from automatically reopening any windows.
Remove Genieo, InstallMac
- Open Activity Monitor, which is in the Utilities folder of your Applications folder.
- In the Activity Monitor window, click the CPU tab, then click Process Name at the top of that column to sort the list alphabetically.
- If you see a process named Genieo or InstallMac, select it and click the Force Quit button (x) in the upper-left corner of the window. Then complete the other steps in this section.
- If you don't see either process, Genieo or InstallMac is probably not installed on your Mac. You can optionally skip the other steps in this section.
Quit Activity Monitor, then use Go to Folder to find and remove
/private/etc/launchd.conf.
Restart your Mac
Use Go to Folder to find and remove each of these items:
/Applications/Genieo/Applications/InstallMac/Applications/Uninstall Genieo/Applications/Uninstall IM Completer.app/usr/lib/libgenkit.dylib/usr/lib/libgenkitsa.dylib/usr/lib/libimckit.dylib/usr/lib/libimckitsa.dylib/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client~/Library/Application Support/Genieo/~/Library/Application Support/com.genieoinnovation.Installer/
Restart your Mac
Now find and remove
/Library/Frameworks/GenieoExtra.framework.
Restart your Mac
Choose Finder > Empty Trash to permanently remove the items.
The next time you open Safari, hold down the Shift key while Safari opens. This prevents Safari from automatically reopening any windows.
Optionally remove other adware files
You don't need to remove these files to disable the adware. If you do remove them, first remove the other files listed above. Use the same Go to Folder method to find and remove each item.
/Library/LaunchAgents/com.genieo.completer.update.plist/Library/LaunchAgents/com.genieo.engine.plist/Library/LaunchAgents/com.genieoinnovation.macextension.client.plist/Library/LaunchAgents/com.genieoinnovation.macextension.plist/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist/Library/LaunchDaemons/Jack.plist~/Conduit/~/Trovi/~/Library/Application Support/webHelperApp/~/Library/Caches/com.Conduit.takeOverSearchAssetsMac~/Library/Caches/com.VSearch.bulk.installer~/Library/Caches/com.VSearch.VSinstaller~/Library/cinemapro1-2/~/Library/LaunchAgents/com.genieo.completer.download.plist~/Library/LaunchAgents/com.genieo.completer.ltvbit.plist~/Library/LaunchAgents/com.genieo.completer.update.plist~/Library/LaunchAgents/com.webhelper.plist~/Library/LaunchAgents/com.webtools.uninstaller.plist~/Library/LaunchAgents/com.webtools.update.agent.plist~/Library/LaunchAgents/Safari Security~/Library/LaunchAgents/UpdateDownloder~/Library/LaunchAgents/WebServerSocketApp~/Library/Preferences/com.genieo.global.settings.plist.lockfile~/Library/Preferences/com.geneio.settings.plist.lockfile~/Library/Preferences/com.geneio.global.settings.plist~/Library/Saved Application State/com.genieo.RemoveGenieoMac.savedState~/Library/Saved Application State/com.VSearch.bulk.installer.savedstate~/Library/WebTools/
Some files have names that can vary. Follow these steps to remove them.
- From
/Library/LaunchAgents/, removecom.*.agent.plist. The asterisk (*) is any word. Example:com.midnight.agent.plist. - From
/Library/LaunchDaemons/, removecom.*.daemon.plistandcom.*.helper.plist. The asterisk is the same word used in the LaunchAgents folder, above. Example:com.midnight.daemon.plist. - From
/Library/Application Support/, remove the file that is the same word used in the LaunchAgents and LaunchDaemons folders, above. Example:midnight. - From
/Library/LaunchAgents/, remove the following files. The asterisk is some form of the name of a Safari adware extension, such asshopy-mateorcinemapro1-2. Example:com.shopy-mate.daemon.plist.com.*.daemon.plist*_enabler.plist*_enabler.sh*_updater.plist*_updater.sh*.ver
- From
/Library/LaunchAgents/, remove the following files. The asterisk is any four numbers. Example:com.crossrider.wss1234.agent.plist.com.crossrider.wss*.agent.plistcom.extensions.updater*.agent.plist
Restart your Mac, then choose Finder > Empty Trash to permanently remove the items.
Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Risks are inherent in the use of the Internet. Contact the vendor for additional information. Other company and product names may be trademarks of their respective owners.
No comments:
Post a Comment