Weird pop-up

[alvaroaaa]

Good evening everyone.

I recently bought a Macbook Air about a month ago, and I have been using it for work and study stuff mainly (so basically Office and Safari, nothing else). I haven't even downloaded any software or anything like that.

Last week a weird pop-up started to appear, and after doing a little bit of research it appears to be a virus??? And it seems very weird since I haven't done anything "dangerous" with this computer, and it is new! I have deleted History and Cache, but apparently it keeps coming once or twice a day.

I've uploaded a print screen of the pop up.

Could you please help me?

Thanks!

 

[xgman]

If it was me, I'd search for "adfarm" with easyfind (free) and delete any items with that name on your computer, and also check your startup page in Safari or any other browser you use.

 

[fisherking]

what xgman said. & close safari first. some items may not be 'deletable' from the easyfind window; in that case, open the enclosing folder (it will show on the bottom of the easyfind window), find the offending items, then delete (you may need to input your mac password). when you're done, reboot...

 

[alvaroaaa]

Thank you for your replies fisher king and xgman.

I just searched for 'adfarm' and 'mediaplex' using EasyFind, and I looked in every folder (Applications, Library, Systems and Users) with no success... I'm attaching a print screen.

What do you think is wrong?

Thanks again!

 

[fisherking]

you're only searching your "Users" folder; change that to your hard drive (ie "Macintosh HD"). then you'll find those things...

 

[alvaroaaa]

That's true fisherking, thanks! I just searched again and I found these files (attached). Should I delete them all?

Sorry for asking so many questions! But this is my first Mac.

Thanks again!

 

[fisherking]

there may be more stuff...but the adhosts.plist is the ONLY thing i'd delete there. you may want to check out this: http://www.adwaremedic.com/index.php

but FIRST: check system preferences (under the apple menu), users and groups>login items. anything there besides itunes? if there's anything with 'adware' or 'mediaplex', remove it. also, check easyfind for 'mediaplex'.

always be very careful about deleting files thru easyfind...

 

[alvaroaaa]

Good to know! Thankfully I didn't delete anything.

I just checked again and there's nothing if I look for "mediaplex" and, moreover, there's nothing if I only check Files (the print screen I sent before is "file contents") for "adfarm" as well. Strange?

Also, there's only iTunes in "Login Items". So, I guess it is looking normal, right? Why do you think the Pop-up is appearing?

Thanks!!

 

[howiest]

Make sure you run Malwarebytes Anti-Malware.

 

[xgman]

You should search for "files and folders", not "file content" in easy find and the I'd delete anything it finds that clearly has adfarm in it. I actually don't use safari. I prefer Firefox or Chrome for browsing control. Also clear the safari internet cache (google how) and maybe even clear the cookies. Onyx utility might be helpful there. It's free.