Around once a day a new tab opens in the background and automatically starts downloading some probably scam software disguised as a "flash player". I tried to fix it doing the things recommended online, but could not find the cause or prevent it from happening again.
It started or better I started noticing it, when I started using Safari after I upgraded my current installation to Mojave when it came out. Before I used Chrome.
Here what happened and what I tried:
- I checked my extensions. The only extensions I have in safari are: 1password, buffer, getpocket and todoist which are all as far as I know very reputable companies.
- I downloaded and ran malwarebytes which found nothing
- I made a full scan with Avast Business Antivirus* which found nothing
- I have no custom profiles installed, as there is no
Profilestab in my
- I am still using Chrome and did not experience anything similar.
It could be a malicious website or a malicious ad on a website. I did not check every time, but when I checked I only had tabs open to pages like stackoverflow, aws.com, jira and my server.
What else can I check?
This is one of the pages that is opened. Don't visit the page if you don't know what you are doing...
* this is my old company notebook that I got when I left my old company.
Here is the contents of the library folders TJ Luoma recommended checking out.
ls ~/Library/LaunchAgents com.adobe.AAM.Updater-1.0.plist com.adobe.GC.Invoker-1.0.plist com.dropbox.DropboxMacUpdate.agent.plist com.valvesoftware.steamclean.plist net.tunnelblick.tunnelblick.LaunchAtLogin.plist org.virtualbox.vboxwebsrv.plist ls /Library/LaunchAgents/ com.adobe.AAM.Updater-1.0.plist com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist com.adobe.AdobeCreativeCloud.plist com.adobe.GC.AGM.plist com.adobe.GC.Invoker-1.0.plist com.avast.userinit.plist com.cisco.anyconnect.gui.plist com.google.keystone.agent.plist com.googlecode.munki.ManagedSoftwareCenter.plist com.googlecode.munki.MunkiStatus.plist com.googlecode.munki.managedsoftwareupdate-loginwindow.plist com.malwarebytes.mbam.frontend.agent.plist com.nvidia.CUDASoftwareUpdate.plist jp.co.canon.CUPSSFP.BG.plist org.macosforge.xquartz.startx.plist ls /Library/LaunchDaemons/ com.adobe.ARMDC.Communicator.plist com.adobe.ARMDC.SMJobBlessHelper.plist com.adobe.adobeupdatedaemon.plist com.adobe.agsservice.plist com.avast.init.plist com.avast.uninstall.plist com.avast.update.plist com.cisco.anyconnect.vpnagentd.plist com.google.keystone.daemon.plist com.googlecode.munki.logouthelper.plist com.googlecode.munki.managedsoftwareupdate-check.plist com.googlecode.munki.managedsoftwareupdate-install.plist com.googlecode.munki.managedsoftwareupdate-manualcheck.plist com.grahamgilbert.crypt.plist com.malwarebytes.mbam.rtprotection.daemon.plist com.malwarebytes.mbam.settings.daemon.plist com.zenmate.charon-xpc.plist net.tunnelblick.tunnelblick.tunnelblickd.plist org.macosforge.xquartz.privileged_startx.plist org.virtualbox.startup.plist
All seem legit to me.
com.grahamgilbert.crypt.plist is from a tool the former IT department used to enforce encryption on the machines. (github link)
based on Geoff's question I also checked the "Automation" pane in "Security and Privacy" prefpane and the Safari pop-up settings, but both look innocent. The 10.101.101.23 is my local server running jupyter notebook.
"Unfortunately" there were no further pop ups. Maybe it were a series of malicious ads on one of the seemingly reputable sites I was using.
"Automation" pane in "Security and Privacy" prefpane
Shiftkey held down? (Please note that this will close all of your open tabs—I know you said you didn't think any of them was causing the issue, but it might be a good idea to rule them out entirely.)