ads contextweb

[radical78]

 

Hi

I ran several times Malwarebytes, didn't find anything.

My issue is that both of my browsers: Chrome & Safari keeps showing popups every time I surf on the web and some ads on the over the site. (I attached some screenshots)

Also in the lower corner keeps loading some site: ads.contextweb.com  and "loading" from other sites.

This is driving me nuts. I hope you can help me with this.

Thanks,

JP

ps. I deleted all my Chrome extensions.

 

Malwarebytes Anti-Malware 1.2.4.584 system report - October 12, 2016 at 5:25:03 PM CST

Mac OS X version Version 10.12 (Build 16A323)

System uptime: 0d 09:52:16

 

Safari extensions

-----------------------

 

Chrome extensions

-----------------------

JP

    Default

        Name: Google Drive

        Path: /Users/JP/Library/Application Support/Google/Chrome/Default/Extensions/apdfllckaahabafndbhieahigkjlhalf

        Modified: 2016-10-02 20:55:06 +0000

 

        Name: YouTube

        Path: /Users/JP/Library/Application Support/Google/Chrome/Default/Extensions/blpcfgokakmgnkcojhhkbfbldkacnbeo

        Modified: 2016-10-02 20:55:06 +0000

 

        Name: Chrome Web Store Payments

        Path: /Users/JP/Library/Application Support/Google/Chrome/Default/Extensions/nmmhkkegccagdldgiimedpiccmgmieda

        Modified: 2016-10-02 20:54:40 +0000

 

        Name: Gmail

        Path: /Users/JP/Library/Application Support/Google/Chrome/Default/Extensions/pjkljhegncpnkpknbcohdijeoejaedia

        Modified: 2016-10-02 20:55:06 +0000

 

        Name: Chrome Media Router

        Path: /Users/JP/Library/Application Support/Google/Chrome/Default/Extensions/pkedcjkdefgpdelpbcmbmeomcjbeemfm

        Modified: 2016-10-02 20:54:43 +0000

 

 

Firefox extensions

-----------------------

 

Login items

-----------------------

iTunesHelper

 

System startup items

-----------------------

 

User launch agents

-----------------------

/Users/JP/Library/LaunchAgents/.DS_Store

/Users/JP/Library/LaunchAgents/com.apple.CSConfigDotMacCert-MY@EMAIL.COM-SharedServices.Agent.plist

/Users/JP/Library/LaunchAgents/com.google.keystone.agent.plist

 

System launch agents

-----------------------

/Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist

/Library/LaunchAgents/com.adobe.AdobeCreativeCloud.plist

 

System launch daemons

-----------------------

/Library/LaunchDaemons/com.adobe.adobeupdatedaemon.plist

/Library/LaunchDaemons/com.adobe.agsservice.plist

/Library/LaunchDaemons/com.adobe.fpsaud.plist

/Library/LaunchDaemons/com.adobe.SwitchBoard.plist

/Library/LaunchDaemons/com.bombich.ccchelper.plist

/Library/LaunchDaemons/com.malwarebytes.HelperTool.plist

/Library/LaunchDaemons/com.microsoft.office.licensingV2.helper.plist

 

Kernel extensions

-----------------------

/Library/Extensions/ACS6x.kext

/Library/Extensions/ArcMSR.kext

/Library/Extensions/ATTOCelerityFC8.kext

/Library/Extensions/ATTOExpressSASHBA2.kext

/Library/Extensions/ATTOExpressSASRAID2.kext

/Library/Extensions/CalDigitHDProDrv.kext

/Library/Extensions/HighPointIOP.kext

/Library/Extensions/HighPointRR.kext

/Library/Extensions/hp_io_enabler_compound.kext

/Library/Extensions/PromiseSTEX.kext

/Library/Extensions/SoftRAID.kext

/Library/Extensions/TelestreamAudio.kext

 

launchd.conf contents

-----------------------

 

 

Hosts file

-----------------------

##

# Host Database

#

# localhost is used to configure the loopback interface

# when the system is booting.  Do not change this entry.

##

127.0.0.1 localhost

255.255.255.255 broadcasthost

::1             localhost 

fe80::1%lo0 localhost

 

 

Scan log

-----------------------

2016-09-23 16:44:47 :  

2016-09-23 16:44:47 : ----- Scan Started -----

2016-09-23 16:44:47 : Scanning with signatures version 120 (2016-9-19)

2016-09-23 16:44:53 : *** Scan time: 0d 00:00:06 ***

2016-09-23 16:44:53 : ------ Scan Ended ------

2016-09-24 11:15:57 :  

2016-09-24 11:15:57 : ----- Scan Started -----

2016-09-24 11:15:57 : Scanning with signatures version 120 (2016-9-19)

2016-09-24 11:16:05 : *** Scan time: 0d 00:00:07 ***

2016-09-24 11:16:05 : ------ Scan Ended ------

2016-09-25 13:33:40 :  

2016-09-25 13:33:40 : ----- Scan Started -----

2016-09-25 13:33:40 : Scanning with signatures version 120 (2016-9-19)

2016-09-25 13:33:50 : *** Scan time: 0d 00:00:10 ***

2016-09-25 13:33:50 : ------ Scan Ended ------

2016-10-01 20:43:26 :  

2016-10-01 20:43:26 : ----- Scan Started -----

2016-10-01 20:43:26 : Scanning with signatures version 127 (2016-9-30)

2016-10-01 20:43:34 : *** Scan time: 0d 00:00:07 ***

2016-10-01 20:43:34 : ------ Scan Ended ------

2016-10-07 23:45:21 :  

2016-10-07 23:45:21 : ----- Scan Started -----

2016-10-07 23:45:21 : Scanning with signatures version 130 (2016-10-7)

2016-10-07 23:45:28 : *** Scan time: 0d 00:00:06 ***

2016-10-07 23:45:28 : ------ Scan Ended ------

2016-10-12 07:59:08 :  

2016-10-12 07:59:08 : ----- Scan Started -----

2016-10-12 07:59:08 : Scanning with signatures version 131 (2016-10-10)

2016-10-12 07:59:15 : *** Scan time: 0d 00:00:06 ***

2016-10-12 07:59:15 : ------ Scan Ended ------

2016-10-12 17:07:40 :  

2016-10-12 17:07:40 : ----- Scan Started -----

2016-10-12 17:07:40 : Scanning with signatures version 131 (2016-10-10)

2016-10-12 17:07:46 : *** Scan time: 0d 00:00:06 ***

2016-10-12 17:07:46 : ------ Scan Ended ------

 

 

[treed]

Your system is actually pretty clean. I don't see anything installed that I'd consider suspicious.

Try to pay attention to what site you're on when you see those pop-ups. If it's always from one site, or a small handful of specific sites, it's probably the specific site(s) in question that are the problem.

If it turns out you're seeing this everywhere, it's probably an issue with your network hardware. See:

http://www.thesafemac.com/tech-support-scam-pop-ups/

[radical78]

Hi Treed,

I have mgid ads, I don't have an specific site. Nowadays all the sites have ads, but it's frustrating when I need to do something it pop up some ad or fill the site.

Basically you're telling me that I need to reinstall my OS X from scratch?

"it's probably an issue with your network hardware", what are you talking about?

Thanks,

[treed]

I didn't say that you need to reinstall OS X from scratch. In fact, given what I see in your system snapshot, I'd say that would do you absolutely no good at all.

What you're describing plus what your system snapshot says tells me that the issue is either completely normal for whatever sites you're visiting or it's a network problem. For more information about the possibility of a network problem, see the following link. (It looks like I gave you the wrong one last time.)

https://support.malwarebytes.org/customer/portal/articles/2049288-?b_id=9511

[radical78]

I got the idea of reinstall OS X from scratch from the first link you sent me.

I will try to check and do something with my network. I'll let you know.

Thanks.

[treed]

Ah, looking back at that first message I sent, I see I gave you the wrong link!

Let me know if you need any further help.

[radical78]

Hi Treed

I upgrade my router firmware (Cisco Linksys E3000) but still with the problem.

It's adskeeper.co.uk how do I get rid of that?

Any help?

Thanks in advance.

[treed]

Restart in recovery mode, by holding down command-R at startup. This should boot into a mode where there will be a single window with four options. Click the one labeled "Get Help Online". This will open a clean copy of Safari, running on a clean system.

Do you see the same problem in Safari while in recovery mode, if you browse as you normally do?

[radical78]

Hi Treed,

Forgot to update my case.

I restarted my MacBook in Recovery Mode and same issue.

Still getting ads from adkeeper.co.uk

I forgot to mention that www.googletagservices.com also is loading ads.

Thanks in advance.

[treed]

If you're seeing the problem in recovery mode, that clinches it... it's definitely not a problem with your computer. It's either site-specific or it's a problem with your network hardware.