‘Variety-dot-com!

Posted by: Mike

‘Variety-dot-com! - 09/09/18 09:17 PM

Lately any website I go to with Safari will -after a few seconds- will surprise me with a ‘pop up’ notifying me that I have ‘won’ something, either from Walmart or from Amazon. I’m using the Safari ‘pop up block’ feature, but it still comes up. I also clear any web data. When I checked under ‘Advanced’ I find web data from ‘Variety.com’ . It seems impossible to get rid of this. These annoying pop ups do not occurr when using any other browser , like Chrome, Firefox, or now Edge. Is this a virus?
Posted by: Reboot

Re: ‘Variety-dot-com! - 09/09/18 09:42 PM

Look in Extensions in Safari Preferences. What is listed there?

Also download and run Malwarebytes.
Posted by: Mike

Re: ‘Variety-dot-com! - 09/09/18 10:27 PM

It also appeared on Safari on my iPad!
Posted by: Mike

Re: ‘Variety-dot-com! - 09/09/18 10:31 PM

The only extension listed is from 1Password. And that’s never caused any problems.

Posted by: Reboot

Re: ‘Variety-dot-com! - 09/09/18 11:36 PM

http://malwarebytes.com

Duh. grin
Posted by: Reboot

Re: ‘Variety-dot-com! - 09/10/18 12:02 AM

Originally Posted By: Mike
It also appeared on Safari on my iPad!
I've seen this on my iPhone. The spinning 'Amazon wheel you won' BS. Does it happen with the same frequency on the iPad?

What happens is these poisoned ads get injected into a perfectly legit web site's ad rotation, the web site realizes it, then they get rid of it but it may take a while. For example I use http://wordplays.com for my crossword hints because it is lean and mean. They have few ads but not much. I never use it on the Mac, just my iPhone. A while back sometimes when I'd go there it gave the Amazon BS. It went away a few months ago.

Maybe it's some site you go to on both the iPad and Mac?
Posted by: Mike

Re: ‘Variety-dot-com! - 09/10/18 12:38 AM

“Maybe it's some site you go to on both the iPad and Mac?”—

Hmm......From Huffington Post? Never had problems there before.... crazy
Posted by: Mike

Re: ‘Variety-dot-com! - 09/10/18 01:09 AM

Since it doesn't 'pop up' in either Chrome and/or Firefox and Edge, perhaps it's a Safari 'vulnerability'? cry
Posted by: Reboot

Re: ‘Variety-dot-com! - 09/10/18 02:33 AM

Originally Posted By: Mike
Since it doesn't 'pop up' in either Chrome and/or Firefox and Edge, perhaps it's a Safari 'vulnerability'? cry
Amuse me. Install and run Malwarebytes. If that doesn't find anything we'll go from there.
Posted by: Mike

Re: ‘Variety-dot-com! - 09/10/18 12:23 PM

Installed it.....so far, so good!
But, no matter how many times I clear all web data, this stupid ‘variety.com’ web addy cannot be cleared.
It doesn’t seem to contain any data (indicator says zero data),but it’s still there even though I deleted it several times. Everything else ‘clears’ out just fine..... mad
Posted by: Reboot

Re: ‘Variety-dot-com! - 09/10/18 12:30 PM

Did Malwarebytes find anything when you ran the scan?
Posted by: Mike

Re: ‘Variety-dot-com! - 09/10/18 02:56 PM

Nothing found..... frown
Posted by: Mike

Re: ‘Variety-dot-com! - 09/10/18 03:46 PM

Ran it again: found and quarantined three items: 'AdBlock Master, Antivirus Thor Lite, and Genieo.
Posted by: Reboot

Re: ‘Variety-dot-com! - 09/10/18 11:04 PM

Cool.

Adblock Master has been removed from the App Store.

You may not understand some of the geek in this, but the end of the video explains why you were getting ads.



Thor Lite has been removed from the App Store also so MB got rid of it. Thor doesn't find anything but tries to get people to buy it.

Linky with video. In the video in the link it shows Genieo junk at the end, is it like what you had?

Genieo was a big problem. They bundle their adware with a lot stuff. You have to watch any "free" installer very carefully. That came from some installer offering to make your life easier.

I use MPlayerX. You have to watch the tricky installer though. MB wants to delete the app because of the nature of the shady installer but the player is safe once installed, it plays almost anything. If it won't VLC will.

That was just a PSA on video playback, but the point is a lot of app installers get tricky like MPlayerX. If you watch the installer video below you'll see that there are both a Skip button and a Continue button each malicious step. We are trained to think Skip means stop the installation so we hit Continue without reading the fine print.

Posted by: Mike

Re: ‘Variety-dot-com! - 09/10/18 11:14 PM

Thanks for your help!!
I’ll keep an eye on it! grin