Post by: Larry on October 22, 2016, 06:02:44 AM
I dumped Firefox ....... reinstalled and still there
Any ideas?
Post by: Xairbusdriver on October 22, 2016, 11:39:02 AM
I'm pretty sure it is just an application. You might look in all its menus to see if it has an "Un-install" item, a few apps provide that. If it a simple 'drag-and-drop-it-into-your-Applications-folder' kind of app, just drag it to the trash and then empty the trash. That may leave behind a few very small files on your hard drive, but it's usually not worth your time to search for things like a small plist file just to delete them.
If it shows up as an extension or 'add-on' in FireFox, use the FF Tools->Add-ons menu and look in the "Extensions", "Plugins", or "Services" labels on the page it brings up.
- If it's in the extensions list, there should be a "Disable" and possibly a "Preferences" button for each item. Try the "Disable" button.
If it is a "Plugin", look for a pop up list with "Ask to Activate", "Always Activate" and "Never Activate". Try the "Never Activate" button. You may need to Quit and re-open FireFox to get it to take effect.
Post by: Paddy on October 22, 2016, 09:21:38 PM
Anyway - back to the task at hand:
A description of EasyPDFcombine from a couple of different sites (neither of which I will provide links to, since they're all hawking removal tools and God only knows what THOSE contain!):
Once installed, Easypdfcombine adds a toolbar to your browsers. This toolbar contains such buttons as EasyPDFCombine, Share Files, Convert Files, Language Tools, and others. The application also modifies your browser settings including your home page, new tab, and default search engine. These settings are replaced with home.tb.ask.com and Ask Search. Your new search engine provides you with relevant search results, however, they also include sponsored content. Various adverts will appear on other pages that you open as well. Some of these ads will be fake. If you wish to eliminate all of these changes including the unreliable advertisements, you will have to get rid of Easypdfcombine.
Once infiltrated, EasyPDFCombine records Internet Protocol (IP) addresses (to determine geographic location), website URLs visited, pages viewed, search queries entered into search engines, and other similar information. This data may seem insignificant, however, it can contain personally identifiable details that the developers of EasyPDFCombine with third parties. It is highly probable that it will then be misused to generate revenue. Therefore, the presence of an information-tracking app such as EasyPDFCombine on your system can lead to serious privacy issues or even identity theft. Furthermore, EasyPDFCombine stealthily assigns the new tab URL, default search engine, and homepage browser settings to home.tb.ask.com. Furthermore, EasyPDFCombine prevents users from rolling back these changes by automatically reassigning the aforementioned settings when attempts are made to change them. Therefore, users are continually redirected to home.tb.ask.com, significantly diminishing their web browsing experience.
How to get rid of it:
In Firefox:
Mozilla Firefox
1. Type Command+Shift+A.
2. On the Extensions and Plugin search for the EasyPDFCombine add-on and other suspicious add-ons and remove them if located.
Done.
And if you have Chrome, check to make sure it's not there as well:
1. Click on the Customize icon (3 bar icon) next to the address bar and navigate to More tools > Extensions.
2. Search for the EasyPDFCombine extension and other suspicious extensions and remove them individually by clicking the trashcan icon next to them.
And check Safari->Preferences->Extensions to make sure it's not there as well.
Post by: Xairbusdriver on October 22, 2016, 10:01:51 PM
Post by: Paddy on October 23, 2016, 09:33:23 AM
QUOTE(Xairbusdriver @ Oct 22 2016, 11:01 PM) <{POST_SNAPBACK}>
So my instructions were fine. I just hope the lesson was learned. As I said, there's no need to install an app that claims to do what can already be done on a Mac. Especially when they are "free". Know where your apps come from, before installing them.
Yup - though it may have installed itself in other browsers too, so hence the other places to look in my instructions.
Even when you know where your apps are coming from - like Java - you can't just blindly click, click, click to install. I almost got caught yesterday with the Java update - I was in a hurry and almost didn't notice it. I was so startled I just hit "cancel" - realizing as I did that I should have unchecked the checkbox instead.
It would appear that Oracle has decided to monetize Java any way it can, which is pretty scummy, in my books.
Post by: Xairbusdriver on October 23, 2016, 09:51:51 AM
QUOTE
it may have installed itself in other browsers too, so hence the other places to look
Who can we trust?! 
I saw that Java 'invitation' last week, myself! I've never been 'enticed' by anything relating to a "yahoo" so I saw the text immediately. However, I was also immediately alarmed that I'd started down a road slightly different than the one I thought!!
Then I looked a bit closer and saw the 'ticked' box. 
I wonder how much Yahoo paid Oracle for that? Seems a bit disingenuous by both parties. OTOH, Oracle can use the cash, even if from a sinking ship! Maybe Oracle 'bought' some labor or office chairs from the company previously known a darling of the Internet? 
Post by: Larry on November 04, 2016, 05:11:28 PM
Kind
Larry