Jump to content

treed

Staff
  • Content count

    846
  • Joined

  • Last visited

5 Followers

About treed

  • Rank
    Thomas

Recent Profile Visitors

9,608 profile views
  1. If this was a license that was originally purchased a while ago, it's a Windows-specific key that won't work on Mac or Android. You'd need to contact customer support about your options: https://support.malwarebytes.com/community/consumer/pages/contact-us
  2. If you have a copy of that PlaySearchNow extension, we would love to see it. Can you post it over on this forum? https://forums.malwarebytes.com/forum/193-newest-mac-threats/ Also, if you have a copy of that ~/Library/Application Support/guid/ folder, that would be good. Are you seeing something like a launch agent or daemon that is loading a process inside that folder? One note: fortunately, Safari extensions really can't make any changes on the file system, so uninstalling it can't result in any new files being created.
  3. treed

    How do I read a report file?

    There is not currently a method for saving the report data, or seeing logs of what has been done in the past beyond what is displayed in the Reports tab.
  4. treed

    Malwarebytes vs ClamXav

    One note: Malwarebytes for Mac 3.4, which was just released last week and is still being rolled out at a metered pace, now has scheduled scanning.
  5. treed

    Searchfeedtech.com

    It seems odd that you would have the same behavior on both Mac and Windows. It's exceedingly unlikely that you would have accidentally installed the same adware on both machines at the same time. Most likely what has happened is that the settings were changed on one machine and that was synced back to the other via Chrome sync. Since you've fixed it on Windows, I'd recommend resetting Chrome sync. First, make sure Chrome is not running on the Mac. Next, go here: https://chrome.google.com/sync Click the Reset Sync button at the bottom of that page. Make sure that your home page setting in Windows is set the way that you want, as that's what will be synced to your Google account. You may want to change the setting, then change it back again, just to make absolutely sure that Chrome sync has recorded your current home page setting Then re-open Chrome on the Mac. See if it picks up the new settings.
  6. That's as it should be. The other thing that could be happening is that macOS may think that the clicks on the Allow button are "simulated." Such clicks are not allowed. Some things that can cause macOS to think the click is simulated are: Clicking the button via screen sharing Certain peripherals - such as some docks or third-party mice/tablets/etc - being connected to the machine Certain software - such as mouse drivers - being installed on the computer Make sure you're trying to click the button directly on the computer, rather than remotely, using an Apple mouse or a very simple wired mouse without any fancy features. Disconnect any other peripherals. If even that doesn't work, try restarting in safe mode: https://support.apple.com/kb/HT1455 Be sure to read the information in the section titled "How to tell if your Mac is started in safe mode" on that page, and follow those steps to ensure that you're actually in safe mode. If you aren't, try again. Once in safe mode, install Malwarebytes for Mac again from the beginning, and try to click the Allow button.
  7. Can you run a test for me? Open the Terminal app, which is found in the Utilities folder in the Applications folder, then paste the following command into the Terminal window: ls -alO /Library/StagedExtensions/ Press return to execute it, then copy and paste the results here. What you should get should look like this: thomas$ ls -alO /Library/StagedExtensions/ total 0 drwxr-xr-x@ 5 root wheel restricted 160 Sep 30 2017 . drwxr-xr-x+ 69 root wheel sunlnk 2208 Apr 24 19:52 .. drwxr-xr-x 3 root wheel restricted 96 Jul 4 10:45 Applications drwxr-xr-x 4 root wheel restricted 128 Jul 31 11:02 Library drwxr-xr-x 3 root wheel restricted 96 Sep 30 2017 System
  8. Okay, that appears to be the problem. It looks like your StagedExtensions folder has been tampered with and left in an unusable state. There is a known issue with macOS that will cause failure to activate an extension in such a case, until this problem is fixed. The quickest way to fix the problem would be to restart in recovery mode (hold down command-R at startup), then enter the Terminal once in recovery mode, and enter the following command: chflags -R restricted /Volumes/*/Library/StagedExtensions If your hard drive is encrypted with FileVault, however, you will first need to mount it using Disk Utility, which will require you to provide the encryption password to unlock the drive. I know those instructions may be daunting, so if you're not sure that you can follow them, there is an easier - but more time-consuming - method. Follow the directions here to reinstall the system, skipping the step for erasing the hard drive: https://support.apple.com/HT204904 This will install a fresh system on top of your current system, and should repair that StagedExtensions folder. Before doing either of these things, you should be sure to have good backups, just in case something goes wrong. Out of curiosity, do you know who might have tampered with that folder? It would have been someone with physical access to the computer. Did you, or someone else you know, follow instructions you found online to delete items from that folder, or was your machine serviced by a tech at some point recently? [Edited to add -R to the chflags command]
  9. treed

    New threat! Weknow.ac

    Sounds like you may also now be running into a Safari bug, where the home page can be changed but the change doesn't stick, that can happen after the home page setting is changed by adware. There's a weird - but effective - workaround for this bug: * In Safari, choose Preferences from the Safari menu. * In the window that opens, click the General icon (if necessary) * Enter your desired home page in the "Homepage" field, but DO NOT press return! * At the top of the window, click any of the other icons (eg, Tabs, AutoFill, etc). * You may see a prompt asking for confirmation for changing the home page. If so, confirm. * Switch back to the General page and check to make sure the home page has been changed.
  10. Can you run a test for me? Open the Terminal app, which is found in the Utilities folder in the Applications folder, then paste the following command into the Terminal window: ls -alO /Library/StagedExtensions/ Press return to execute it, then copy and paste the results here. What you should get should look like this: thomas$ ls -alO /Library/StagedExtensions/ total 0 drwxr-xr-x@ 5 root wheel restricted 160 Sep 30 2017 . drwxr-xr-x+ 69 root wheel sunlnk 2208 Apr 24 19:52 .. drwxr-xr-x 3 root wheel restricted 96 Jul 4 10:45 Applications drwxr-xr-x 4 root wheel restricted 128 Jul 31 11:02 Library drwxr-xr-x 3 root wheel restricted 96 Sep 30 2017 System
  11. Can you clarify exactly what you're trying to do and what the results are?
  12. treed

    New threat! Weknow.ac

    This is caused by a variant of Crossrider described here: https://blog.malwarebytes.com/threat-analysis/2018/04/new-crossrider-variant-installs-configuration-profiles-on-macs/ The secret is to remove that config profile, according to the instructions in the article. This is easy to do manually, but less so to do automatically on the user's behalf. There appear to be no official APIs provided by Apple for removing those profiles, so we're evaluating how to do so securely and without causing possible issues (like deleting other legitimate profiles).
  13. I've reported that link to our researchers. In the future, if you see links like these that have not been blocked, please let us know by posting them on the forum David Lipman referred to. You can copy links in iOS by tapping and holding on the link until a Copy item appears. Be careful, though, if you have a newer phone not to actually press, as that will invoke 3D touch and load a preview of the page.
  14. Please be aware that Malwarebytes for Mac is currently not fully compatible with betas of macOS Mojave. Attempts to install Malwarebytes, or to install an update offered by the Malwarebytes app, on Mojave will fail. We are working on this, but please keep in mind that running a beta version of macOS comes with risks, and that not all apps will be fully compatible. Fortunately, we have seen no signs of problems other than installation and some display issues on Mojave (particularly involving dark mode). However, we cannot guarantee that there are no other issues, and you may not be so lucky with other apps. If you are running macOS betas on anything other than an expendable test machine, you should be sure to maintain a good set of backups!
×

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.