0

I'm new to macOS and Safari, while surfing, occasionally when I click on white page (empty screen, no links, etc) a new tab to a strange url opens, it redirects multiple times, then forwards to safemac.co.

I think it's an adware.. How to get rid of this?

Just happened again, redirected to this url: http://securemacfix.com/landings/197/?affid=mzb_349.40938911.1480466987.1111.mzb&utm_source=prpllr&utm_medium=cpm&utm_campaign=mk_prpllr_wl_rmnt_ww&utm_term=&utm_content=&userDefiner=mzb_2952&alert=10&trt=29_3121511156&tid_ext=814559

1

It seems because of Awesome Screenshot Extension I have installed on Google Chrome Here says it's a malware.

I installed Malwarebytes Anti-Malware on macOS and scanned system, it found Adware.Awesome Screenshot then removed it. Everything seems Ok after a restart...

0

It most definitely looks like malware. It is offered as an example of "scareware" on this blog post on blog.malwarebytes.com:

Scareware

Some of the worst malvertising campaigns push scareware pages insinuating your Mac is severely damaged or infected and urging you to download a program to fix it. Windows users were familiar with those highly despicable techniques ten years ago (RogueAV or FakeAV). These are typically the works of greedy affiliates trying to drive the most leads they can in order to collect large commissions off various PUPs.

  • safemac.co
  • macleaner.work
  • 52.206.67.55
  • ...

They offer a malware removal tool that in my experience works wonders on Windows and takes for ever to scan on macOS.

You can manually search for changes made by some hijackers in Google Chrome:

Go to chrome://settings/

  • Look for the configuration under "On startup"

    1. If "Open a specific page or set of pages" is selected, look what pages are selected and replace them with the ones of your preference.
  • Look for changes on the search settings:

    1. Check that the search engine selected is the one you prefer.
    2. Click on "Manage Search Engines" to delete any search engine that looks suspicious.
  • Go to chrome://extensions and remove any extensions that you don't recognize. You can reinstall extensions from the Chrome Web Store if you need anything back. Look for comments and ratings of the extensions before installing.

  • Restart Chrome.

If the problem remains unsolved, open Chrome Settings and look at the bottom of the page for the "Show advanced settings..." link, that will change the following settings to the default:

  • Default search engine, which is changed back to Google. Learn how to set your default search engine.
  • Homepage and tabs. Learn how to set your Chrome homepage and set default startup tabs.
  • The new tab page. Learn how to set the page that a new tab opens to.
  • Tabs you have pinned. Learn how to pin tabs.
  • Content settings, like letting a site show you pop-ups or use your microphone. - - Learn how to change your content settings.
  • Cookies and site data, like items in an online shopping cart. Learn more about cookies and site data.
  • Extensions and themes. Learn more about extensions and themes.

Only the settings for the Chrome profile you're signed in to will be reset. Your new settings will apply across all computers or devices where you’re signed in to your active profile.

Unfortunately, sometimes not even this is able to remove the malware, and you have to look for apps, files residing on your profile folder on Chrome, or a good removal tool to get rid of it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .