Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

l0renz

macrumors 6502
Original poster
Aug 13, 2012
289
9
Hi all
Recently I downloaded a disk image file from the internet which had some consequences.
It installed MacKeeper and a HelperBar safari extension. Those are the files I could find. However, when I read articles on the internet, some words from that article are highlighted, to point out it's a link.
Those links are something scam like, if you click on it they demand your phone number so you can download more content about the article. (see screenshots) It even does it in this thread (see third screenshot) I don't think malware is the right word but I can't find a better one.
Anyways, this is caused by that same .dmg file. Where could the cause be hiding, if it isn't in the application folder or in the safari extensions section? Adblocking the thing doesn't help either. I downloaded 'Malwarebytes without any results.

I thank you in advance

Lorenz

UPDATE

I was able to block the ad with adblock. Though this is not a solution because it also removes the linked word (the word is part of the article). Any help still welcome.

UPDATE 2.0

I got rid of the problem by simply restoring a backup from right before downloading the dmg file.
Take away message: don't download video players which claim they have the ability to play .wmv files. In this case the video player Movist, if I remember correctly.
 

Attachments

  • Screen Shot 2016-06-15 at 10.44.12.png
    Screen Shot 2016-06-15 at 10.44.12.png
    851 KB · Views: 231
  • Screen Shot 2016-06-15 at 10.57.57.png
    Screen Shot 2016-06-15 at 10.57.57.png
    616.1 KB · Views: 240
  • Screen Shot 2016-06-15 at 11.01.17.png
    Screen Shot 2016-06-15 at 11.01.17.png
    911.8 KB · Views: 223
Last edited by a moderator:
  • Like
Reactions: grahamperrin

keysofanxiety

macrumors G3
Nov 23, 2011
9,539
25,302
Hi all
Recently I downloaded a disk image file from the internet which had some consequences.
It installed MacKeeper and a HelperBar safari extension. Those are the files I could find. However, when I read articles on the internet, some words from that article are highlighted, to point out it's a link.
Those links are something scam like, if you click on it they demand your phone number so you can download more content about the article. (see screenshots) It even does it in this thread (see third screenshot) I don't think malware is the right word but I can't find a better one.
Anyways, this is caused by that same .dmg file. Where could the cause be hiding, if it isn't in the application folder or in the safari extensions section? Adblocking the thing doesn't help either.

I thank you in advance

Lorenz

Download and run MalwareBytes for Mac. It will take about 2 minutes to sort out the issues. :)
 
  • Like
Reactions: grahamperrin

JohnDS

macrumors 65816
Oct 25, 2015
1,183
249
Exactly what do you mean when you say MalwareBytes didn't work? -- You were unable to download it? You were unable to install it? You could install it, but it didn't run? It ran but reported no malware?
 
  • Like
Reactions: g-7 and mikecwest

grahamperrin

macrumors 601
Jun 8, 2007
4,942
648
Thanks @keysofanxiety, I had no idea that the product was available for OS X. https://www.malwarebytes.org/antimalware/mac/

(Side note: a couple of weeks ago the product for Windows didn't catch, on a colleague's Windows 7 notebook, a PUA that was subsequently caught by Microsoft Windows Defender. Still, I treat it as a utility of choice where malware and/or PUAs are suspected with Windows.)
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.