2

I've a MacBook Pro and Mavericks. My browsers are blocked by ramsonware. It asks 100 $/Euro and says that your computer is blocked by the Italian cops and constantly redirects you to a fake page.

Arma dei Carabinieri - Attenzione! Il Suo computer personale è stato bloccato per motivi dit sicurezza per le seguenti ragioni. Tutte le attività di questo computer sono stati registrati. Tutti i file sono crittografiti.

I've tried to remove it resetting Safari and Chrome, but the virus is still alive.

What should I do to remove this thing?

6
  • did you clear all browser history ?
    – Ruskes
    Jul 18, 2014 at 19:13
  • 3
    Could you take a screenshot of the particular ransomware that has infected your Mac? That will help identify which one it is and how to remove it. Or even just tell the exact wording of the ransom demand. Jul 18, 2014 at 19:15
  • @Buscar Could you expand on how clearing the browser history would help?
    – grg
    Jul 18, 2014 at 20:00
  • Here a picture: malwaretips.com/blogs/wp-content/uploads/2014/01/…
    – g_rmz
    Jul 19, 2014 at 7:38
  • I do not know the actual file name but if you use the "mdfind -name .js" in terminal it will show you all .js files. Look for one located in Safari or Chrome browsers folders.
    – Ruskes
    Jul 19, 2014 at 10:16

2 Answers 2

3

Here is a link for removing ransomware on a Mac.

it's pretty easy: http://www.thesafemac.com/fbi-ransomware-virus-rampant/

From the post:

There have been many reports among Mac users recently of being “infected” with an FBI ransomware “virus,” telling them that their computer has been seized and that they have to pay money to get it unlocked. Fortunately, from the reports I’ve been getting, there is no indication that this is actually Mac malware of any kind. It’s simply an obnoxious browser pop-up, displayed via JavaScript, in an attempt to fool people into paying.

I have yet to see this behavior first-hand, but it’s undoubtedly being caused by JavaScript that has been injected into legit sites, either through malicious ads or by hacking the site. Keep in mind that the old wisdom that you’re fine if you avoid “bad” sites is no longer particularly good. Most malware these days is distributed through legit sites, so any site could potentially fall victim.

force quit Safari

The question, then, is what to do if you see this pop-up. If you cannot close the window or the browser, then you will need to force the browser to quit. Press command-option-esc to display the force quit window. In that window, make sure your web browser is selected, then click the Force Quit button. Once the browser quits, you can close the force quit window.

Depending on your browser and/or system settings, your browser may try to reload the pages that were open the last time it quit. This could cause the problem to recur immediately, as soon as you open your browser again. In Safari, you can avoid this by holding down the shift key while opening the app.

Once you have your browser open again, you should be fine. You could clear your cookies and browser cache if you like, but that really won’t be particularly useful. Contrary to popular belief, this will not cure such problems or prevent them from occurring.

3
  • Ok but how i remove the .js file from my computer? I dont' want to believe that there is no way to find the file that cause the pop-up to show up and delete it from the system...
    – g_rmz
    Jul 19, 2014 at 7:41
  • If @Buscar's solution is not working for you (they look helpful) there is a handy search app called EasyFind itunes.apple.com/us/app/easyfind/id411673888?mt=12
    – Nohl
    Jul 20, 2014 at 18:41
  • I've found myself a solution! :)
    – g_rmz
    Jul 23, 2014 at 7:03
1

I've solved my problem deleting all the files related to Chrome/Firefox with AppCleaner and restoring Safari. Also i've changed my DNS settings using the ones from Google (8.8.8.8 and 8.8.4.4).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .