0

EDIT: I don't think this is 100% a duplicate, so if you've recently (around May 9th 2017) been seeing popups telling you to download Flash, I'd read on before following the link.

It appears my Mac has recently (last 2 days) been infected by some sort of malware. I've looked through some similar-looking questions, but I don't know the suspicious PID, and was hoping someone here could put me in the right direction or point me towards resources that might help.

The symptoms are weirdly visible: When I'm poking around on Google Chrome, every now and then (maybe every 20 or so tab openings), a big popup will show up. Usually it tells me to update my Flash Player. Once I've seen a sex-related popup. Typical spammy stuff. Here's an image of an example:

POPUP

Here's the actual URL of the popup. Probably unwise to follow the link unless you really know what you're doing: http://www.macndmg.com/NSb0vIfy/upm/f/?ClickId=w59AHLHEOTU8TP9518NUPPEE&PubID=1195625w59AHLHEOTU8TP9518NUPPEE

I've downloaded and run AVG, which has found nothing, and also doesn't seem to notice anything suspicious if it's open while the popup runs. I haven't tried to see if Safari/Firefox produce the same issues, because I'm not sure it would help find the issue.

I've also deleted the past few weeks in my ~/Library/Cache. In my applications, I see nothing weird updated in the last few weeks. I don't have separate Adobe Flash, because I have Creative Cloud.

Any suggestions about 1) How to find this, 2) What I should be concerned about, and 3) What information/passwords I should change, or what steps I should take to secure my information?

Thanks! Please let me know what additional information I can provide to help figure this out. This is kind of freaking me out.

-----EDIT/UPDATE/SOLUTION-----

I understand why this question is, in broad strokes, considered a duplicate, but given that it's a particular problem that seems to be occurring identically to many people (I've personally met two people who were affected by it in the last week, and several have posted here), as well as because it seems to have a clear and specific shared cause for several of these people, I wanted to post my answer (which seems blocked for this "protected" post):

This (at least for those who have the same issue) appears not to be a virus or malware that's saved on one's computer. It seems to be a problem with a Chrome extension, specifically the Unseen extension, which has recently been updated to cause pop-ups which ask you to install Flash. For most people, this problem has started in the last week or two.

I discovered this by uninstalling Chrome and reinstalling it, without signing back in. Signed out (without my extensions), no popups occurred. Signing back in brought back the popups. I then followed Malwarebytes's suggestion, and disabled one extension at a time. Unseen was the clear culprit, as it was the only extension the removal of which stopped the popups. Moreover, a ton of recent reviews on the Unseen extension's page corroborate that this extension is causing an identical issue for many people.

Because AVG and Malwarebytes found nothing on my computer, and because this extension issue seems to try to get you to install a virus, my assumption is that there's no virus involved (if you don't download it), and that uninstalling the extension fixes the problem.

Obviously security experts here may disagree with that procedure/suggestion. But I wanted to throw my experience out there to inform the decisions of those with the same problem.

Sasha
  • 109
  • 2

0 Answers0