Post by: daryl66 on February 14, 2017, 12:58:59 PM
Post by: jchuzi on February 14, 2017, 01:44:02 PM
Post by: daryl66 on February 14, 2017, 01:53:10 PM
QUOTE(jchuzi @ Feb 14 2017, 02:44 PM) <{POST_SNAPBACK}>
Your mistake was to click on that link. Do you have a Time Machine backup that you can use to revert to the previous state?
YUP Asleep at the wheel. Total agreement. I so not use time machine, however I have a SuperDuper back up that is only a few days old so if all else fails.
Post by: jchuzi on February 14, 2017, 03:10:28 PM
Post by: Xairbusdriver on February 14, 2017, 04:20:51 PM
Don't forget to check your Safari prefs->Security where you can click the "Plug-in Settings button and disable Flash in the list of items on the left-hand side of the window that pops up.
You might also want to completely <un-install Flash> until you get things sorted out. Couple of Safari extensions, Click2Flash and Ghostery do a pretty good job of blocking/allowing Flash, also. If you have to view Flash you might want to try Chrome, where it runs in a 'sandbox' and provides a bit more protection from bad (as if there was 'good') Flash software.
Post by: jchuzi on February 14, 2017, 04:30:52 PM
Post by: daryl66 on February 14, 2017, 06:32:15 PM
QUOTE(jchuzi @ Feb 14 2017, 05:30 PM) <{POST_SNAPBACK}>
I don't think that Flash is involved in this. The "update" button that daryl cites was probably a ruse to get him to download malware that had nothing to do with Flash. I have seen that sort of popup myself and, when checking for a Flash update via either Adobe or the Flash pref pane, I have seen that my version of Flash did not need updating.
Both replies applicable I think. More than safari involved. Screwy things going on in Mail & Firefox also. I found a couple of solutions to remove the malware but they all involved "Terminal" which literally scares me to death. SOOOO, I am currently in the process of erasing the drive and copying the super duper back up to it. It's about a week old so lost data will be minimal ( hopefully)
Different subject: This malware seemed to have also installed an application "BLUR" which seems to some kind of password manager. I couldnot find it. Not in the application folder, does not show up anywhere with search light or using the finder search. I did find a web page but the info is minimal. Curious
Daryl
Post by: Xairbusdriver on February 14, 2017, 07:38:54 PM
The concept is OK (hides your insecurely transmitted password/financial/personal data). But it may be encrypting your data, sending it to their server, and decrypting it and forwarding it from there. In that case, it's still sending your data unencrypted at least part way. OTOH, it could be a VPN, but then it is processing any data you are sending, so you'll have to blindly trust them not to abuse it and it is still is being sent, unencrypted to the insecure site. Instead of trusting them, just don't send that kind of info unless the site is using httpS.I'm a bit confused about your losing data. I assume you know when you clicked the sneaky button. Any Time Machine backup prior to that date/time should be safe. OTOH, why is your SD backup so far out of date? Aren't you running it at the end of the day when you know there is nothing screwed up?
Post by: daryl66 on February 14, 2017, 09:24:34 PM
QUOTE(Xairbusdriver @ Feb 14 2017, 08:38 PM) <{POST_SNAPBACK}>
Found a couple of old apps at the iOS app store that affect images. Also a couple that run on the Mac. It could be the Blur password manager from a software company claiming to be in Boston called Ab[ i ]ne. Haven't researched them, but I'm never impressed with any software company that doesn't keep their Copyright year up-to-date; theirs still says "2015"! :wallbash
I'm a bit confused about your losing data. I assume you know when you clicked the sneaky button. Any Time Machine backup prior to that date/time should be safe. OTOH, why is your SD backup so far out of date? Aren't you running it at the end of the day when you know there is nothing screwed up?
I'm a bit confused about your losing data. I assume you know when you clicked the sneaky button. Any Time Machine backup prior to that date/time should be safe. OTOH, why is your SD backup so far out of date? Aren't you running it at the end of the day when you know there is nothing screwed up?
OK. SuperDuper did it's thing every thing appears to be good
Yea that is them Abne it is now gone
Re SD: As the years go by, my computer use declines, additionally no desktop machines, Therefore no permanent
external hd so back-up happens periodically instead of continuously. Read haphazardly, usually about once a week
Daryl
Post by: daryl66 on March 23, 2017, 11:18:21 PM
QUOTE(jchuzi @ Feb 14 2017, 05:30 PM) <{POST_SNAPBACK}>
I don't think that Flash is involved in this. The "update" button that daryl cites was probably a ruse to get him to download malware that had nothing to do with Flash. I have seen that sort of popup myself and, when checking for a Flash update via either Adobe or the Flash pref pane, I have seen that my version of Flash did not need updating.
The saga continues (kinda): After completely erasing the hd and reinstalling from a back-up everything was just lovely for a while. About a week ago The "update" notification appeared again, and now I am getting it about twice a day. (fool me once shame on you, fool me twice shame on me). I know now to ignore it but I cannot seem to find out what is triggering it. Happens when browsing with either Safari (10.0.3) or Firefox. (52.0.1). The support forums I have visited appear to be somewhat dated on this subject and nothing on OSX 10.3 about how to kill it.
HELP !!!!!!!!
Daryl
Post by: jchuzi on March 24, 2017, 06:40:02 AM
Post by: daryl66 on March 24, 2017, 12:09:43 PM
QUOTE(jchuzi @ Mar 24 2017, 06:40 AM) <{POST_SNAPBACK}>
Does this happen when you are in a particular website? If so, please post a link so that we can confirm it. Also: Do you have ad-blocking and/or popup-blocking extensions installed and working?
No it seems to be very random and Yes I have Add Blocking Plus and Ghostery installed.
[attachment=3380:Untitled.jpeg]
Post by: Xairbusdriver on March 24, 2017, 03:47:54 PM
You can always go the Adobe's site and download the update. Each time it is updated, you have the option to allow it to update automatically or ask. I don't allow much of anything to update itself automatically, certainly never Flash.
What does your Safari->Prefs->Security->Internet plug-ins: look like when you click the "Plug-in Settings..." button? I'm thinking you have told Safari (ay least) to "ask" in the Adobe Flash Player item. A screen shot would be handy.
So far, I don't think there has been any Mac OS actually "infected" by anything other than malware that required the user to enable it.
Post by: daryl66 on March 24, 2017, 05:02:36 PM
QUOTE(Xairbusdriver @ Mar 24 2017, 03:47 PM) <{POST_SNAPBACK}>
Looks like the standard Flash Player dialog to me.
So far, I don't think there has been any Mac OS actually "infected" by anything other than malware that required the user to enable it.
So far, I don't think there has been any Mac OS actually "infected" by anything other than malware that required the user to enable it.
WELLLLLLL unfortunately this is the dialog box that I DUMBLY in fact double DIMBLY fell for a couple of months back which installed a whole bunch of garbage and lots of crud. I finally scrubbed the hd and I reinstalled it from a SD back-up. My guess is the malware was hidden on the back-up someplace as the pop-up went away for a while. Then last week it magically appeared once again, and for the last couple of days it has made its presence known several times a day on both Safari and FF.
Today I ran the "un-installer" following the step by step instructions which included removing a couple preferences SOOOOOOOOO we shall see what happens now.
Daryl
Post by: Xairbusdriver on March 24, 2017, 05:39:09 PM
QUOTE
WELLLLLLL unfortunately this is the dialog box that I DUMBLY in fact double DIMBLY fell for a couple of months back
Sorry if I answered unhelpfully. I know some gave said the problem didn't appear to have anything to do with Flash. And then there appears the Flash Player dialog. I'm totally confused. Are you saying that the image you included in your post (#12) is not the one causing problems?
The use of non-specific words like "this", "that", and "it" can often be confusing when both parties don't know what the other means by the word. Thus, "...unfortunately this is the dialog box..." seems to imply that the image included in post #12 was not the dialog you think caused problems. Apparently, you don't have an image of the "problem causing" dialog. I am simply confused about including an image of somethings that now appears to be totally irrelevant to the thread. In that case, no need to display he settings of your "Plug-in Settings...", those settings would appear to be irrelevant, also, since they involve Flash.
Post by: daryl66 on March 24, 2017, 06:12:05 PM
QUOTE(Xairbusdriver @ Mar 24 2017, 05:39 PM) <{POST_SNAPBACK}>
QUOTE
WELLLLLLL unfortunately this is the dialog box that I DUMBLY in fact double DIMBLY fell for a couple of months back
Sorry if I answered unhelpfully. I know some gave said the problem didn't appear to have anything to do with Flash. And then there appears the Flash Player dialog. I'm totally confused. Are you saying that the image you included in your post (#12) is not the one causing problems?
The posted image is the one that I originally and mistakenly thought was ligit and from Adobe. It installed malware. This same image which STILL has all the appearance of being ligament is NOT and keeps popping up when using both FF and Safari.
Daryl
Post by: kimmer on March 24, 2017, 06:51:20 PM
Post by: Xairbusdriver on March 24, 2017, 08:11:34 PM
QUOTE
This same image which STILL has all the appearance of being ligament is NOT and keeps popping up when using both FF and Safari.
1. Exactly how have you determined that what looks like an Adobe update dialog is fake?2. What actions occur when you clicked Update?
I started this reply on my iPhone but I'm now editing with a real computer and a real keyboard!
I generally do a complete Uninstall of Flash using the steps I'll link to later*. For at least the last few years, I've not been able to use the simple update method with the dialog you've posted. I've seen it the last few days and have simply been waiting for more time to do the Uninstall/Flush all remnants of Flash and its junk, Restart, download the updated files at Adobe's site, install, Restart, ad infinitum...
However, since I've sounded so harsh and grumpy, I plan on using the method when that dialog next appears. I'll turn off Ghostery, try to find a site that uses Flash and get that dialog and make screen shots of what I see, and post them here. Hopefully, you can compare what you see and prove that either something is abusing the Flash dialog or we can remove that dialog as a (OOPS, the cat jumped on the keyboard and stepped on the caps lock!) and eliminate Flash (as much as I dislike it) as the possible culprit.
Back sooner or later.
* <https://helpx.adobe.com/flash-player/kb/uninstall-flash-player-mac-os.html>
See also:<https://forums.adobe.com/thread/1267823>
Post by: Xairbusdriver on March 24, 2017, 08:56:58 PM
- <50 Beautiful Flash Websites>
<Best Flash Websites>
<Clouds Over Cuba>
<bear71>
<Disney-Magic Kingdom>
<50 Gorgeous Flash websites...>
<A Wed Design Studio>
<KO Flash>
<yokaboo>
A few others that were linked from some of the above sites.
Nor did changing the search to "... using Flash Player". I did bet one request to use my co,puter camera, which I declined.My next attempt will probably be the Flash Player System Pref.
The Flash Prefs
Check Now button selected
Still not the Adobe Update dialog.
But you can at least see the version I'm using and the PPAPI Plug-in I'm not using.If you don't mind, I'd like to wait until I get the actual Adobe Update dialog like the image you posted in #12. It comes along every few days, I'm just in no hurry to update it. And I seriously doubt using the "Yes" button in the Update available sheet will bring that infamous dialog on-screen!
Post by: daryl66 on March 24, 2017, 09:02:53 PM
QUOTE(Xairbusdriver @ Mar 24 2017, 08:11 PM) <{POST_SNAPBACK}>
QUOTE
This same image which STILL has all the appearance of being ligament is NOT and keeps popping up when using both FF and Safari.
Exactly how have you determined that what looks like an Adobe update dialog is fake? What actions occur when you clicked Update?Well being asleep at the wheel, it popped up when using Safari. I clicked on the "download" button. As I recall it downloaded a dmg which when opened proceeded to install. Nothing I saw gave me a clue it was not ligit. I started having trouble when typing ie: letters were different than than what I typed, Some kind of password manager that I had never seen before magically appeared and then I found 2 more strange applications in the application folder. I thought that Safari had been infected.
Daryl
Post by: daryl66 on March 24, 2017, 09:24:43 PM
QUOTE(Xairbusdriver @ Mar 24 2017, 08:56 PM) <{POST_SNAPBACK}>
Still not the Adobe Update dialog. But you can at least see the version I'm using and the PPAPI Plug-in I'm not using.
But you can at least see the version I'm using and the PPAPI Plug-in I'm not using.Appears like I did successfully get "flash" uninstalled, according to your links. Gonna sit tight for a while see if it re-appears.
Daryl
Post by: Xairbusdriver on March 24, 2017, 09:35:04 PM
Post by: daryl66 on March 24, 2017, 10:45:22 PM
QUOTE(Xairbusdriver @ Mar 24 2017, 09:35 PM) <{POST_SNAPBACK}>
Just an update, are you sure you got the Abne junk removed back in February?
Cannot find any sign of it. No pref file(s), not in the app folder, no results with either spotlight or "find" so???????