Around once a day a new tab opens in the background and automatically starts downloading some probably scam software disguised as a "flash player". I tried to fix it doing the things recommended online, but could not find the cause or prevent it from happening again.
It started or better I started noticing it, when I started using Safari after I upgraded my current installation to Mojave when it came out. Before I used Chrome.
Here what happened and what I tried:
- I checked my extensions. The only extensions I have in safari are: 1password, buffer, getpocket and todoist which are all as far as I know very reputable companies.
- I downloaded and ran malwarebytes which found nothing
- I made a full scan with Avast Business Antivirus* which found nothing
- I have no custom profiles installed, as there is no
Profilestab in my
- I am still using Chrome and did not experience anything similar.
It could be a malicious website or a malicious ad on a website. I did not check every time, but when I checked I only had tabs open to pages like stackoverflow, aws.com, jira and my server.
What else can I check?
This is one of the pages that is opened. Don't visit the page if you don't know what you are doing...
* this is my old company notebook that I got when I left my old company.
Here is the contents of the library folders TJ Luoma recommended checking out.
ls ~/Library/LaunchAgents com.adobe.AAM.Updater-1.0.plist com.adobe.GC.Invoker-1.0.plist com.dropbox.DropboxMacUpdate.agent.plist com.valvesoftware.steamclean.plist net.tunnelblick.tunnelblick.LaunchAtLogin.plist org.virtualbox.vboxwebsrv.plist ls /Library/LaunchAgents/ com.adobe.AAM.Updater-1.0.plist com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist com.adobe.AdobeCreativeCloud.plist com.adobe.GC.AGM.plist com.adobe.GC.Invoker-1.0.plist com.avast.userinit.plist com.cisco.anyconnect.gui.plist com.google.keystone.agent.plist com.googlecode.munki.ManagedSoftwareCenter.plist com.googlecode.munki.MunkiStatus.plist com.googlecode.munki.managedsoftwareupdate-loginwindow.plist com.malwarebytes.mbam.frontend.agent.plist com.nvidia.CUDASoftwareUpdate.plist jp.co.canon.CUPSSFP.BG.plist org.macosforge.xquartz.startx.plist ls /Library/LaunchDaemons/ com.adobe.ARMDC.Communicator.plist com.adobe.ARMDC.SMJobBlessHelper.plist com.adobe.adobeupdatedaemon.plist com.adobe.agsservice.plist com.avast.init.plist com.avast.uninstall.plist com.avast.update.plist com.cisco.anyconnect.vpnagentd.plist com.google.keystone.daemon.plist com.googlecode.munki.logouthelper.plist com.googlecode.munki.managedsoftwareupdate-check.plist com.googlecode.munki.managedsoftwareupdate-install.plist com.googlecode.munki.managedsoftwareupdate-manualcheck.plist com.grahamgilbert.crypt.plist com.malwarebytes.mbam.rtprotection.daemon.plist com.malwarebytes.mbam.settings.daemon.plist com.zenmate.charon-xpc.plist net.tunnelblick.tunnelblick.tunnelblickd.plist org.macosforge.xquartz.privileged_startx.plist org.virtualbox.startup.plist
All seem legit to me.
com.grahamgilbert.crypt.plist is from a tool the former IT department used to enforce encryption on the machines. (github link)
based on Geoff's question I also checked the "Automation" pane in "Security and Privacy" prefpane and the Safari pop-up settings, but both look innocent. The 10.101.101.23 is my local server running jupyter notebook.
"Unfortunately" there were no further pop ups. Maybe it were a series of malicious ads on one of the seemingly reputable sites I was using.