You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Adware

What is TabAppDaemon? App was installed on my MacBookPro (2012) 10/9/2019 AM MST. Found it and its folder in my library. Is it the Adware that is causing a second Tab to created in Safari. Pop up tells me that I have 3 viruses and I need to clean up by clicking here (I didn't believe them, nor did I follow their instructions.) Popup makes an annoying sound and I believe it also flashes. Almost sounds like an Amber Alert. It seems pretty random what website triggers it - although it seems to like my google searches for malware.

I thought I got a legit notice from Adobe about my Flash Player being out of date. That may have been fake & where I picked up the Adware. I think I clicked on that, but did not complete the process to install. Instead I went to Adobe.com to get Flash. Pop-ups turned off in Safari preferences - but it doesn't stop the Adware. Should I delete "TabAppDaemon" & its folder?

Thanks, Carolyn

MacBook Pro

Posted on Oct 9, 2019 11:03 PM

Reply
Question marked as Top-ranking reply

Posted on Oct 16, 2019 8:16 PM

Do you have second viable web browser? I try to have two; and with some, three.

So long as you do not use same bad links, options remain open.


For El Capitan mostly mine's been Firefox Quantum 69.0.3, latest version. And in

unimportant site visits, using 'outdated Safari' with much less risk to my content.


Did you try above Support articles, how to block pop-ups; + other, avoid phishing (etc) ??


I've asked a friend to look in here; hope they've some ideas.

Been too busy offline to think; so am less effectual here now.



Similar questions

6 replies
Question marked as Top-ranking reply

Oct 16, 2019 8:16 PM in response to Carolyn_of_Tucson

Do you have second viable web browser? I try to have two; and with some, three.

So long as you do not use same bad links, options remain open.


For El Capitan mostly mine's been Firefox Quantum 69.0.3, latest version. And in

unimportant site visits, using 'outdated Safari' with much less risk to my content.


Did you try above Support articles, how to block pop-ups; + other, avoid phishing (etc) ??


I've asked a friend to look in here; hope they've some ideas.

Been too busy offline to think; so am less effectual here now.



Oct 10, 2019 1:14 AM in response to Carolyn_of_Tucson

The issues you have may be related to the fake flash player - or

anything you may have clicked on while online with a browser.


• How to block pop-ups in Safari - Apple Support

• Avoid phishing emails, fake 'virus' alerts, phony support calls, and other scams - Apple Support


Two free version software that can be of help are named Etrecheck

and separate (but do not conflict in their helpful purpose) the other

one, MalwareBytes for Mac have instructions to study & put to use.

(the 'options to buy' only adds features that aren't needed to use now)


There may be other things in addition to try and do, that can help

prevent issues in matters such as these. Others may offer ideas here.

(to utilize - 'use posting tools in your reply box to add text' - see this)


Good luck & happy trails!🌞


Oct 15, 2019 10:27 AM in response to K Shaffer

K Shaffer, Thank you for replying.

  1. Clicking on the link to MalwareBytes for Mac did also create a pop-up fake Ad for an antiviral company, etc.
  2. I didn't go there.
  3. I got to MalwareBytes site directly - no thanks to new tabs created by the Adware.
  4. Downloaded Malware Bytes for Mac, it when to my download folder, tried to drag it to my desktop, but with a single click it appeared to fly into my hard drive.
  5. It hasn't worked. Same fake ads and fake warnings from Apple support keep popping up. Most of the time as a second tap that has a very large URL, but sometimes it appears as the primary website.
  6. I wasn't able to find the MalwareBytes on my computer. The instructions from MalwareBytes.com says I should be able to search for it. Nor is it in my Apps or Library. I am thinking that the Adware blocked its installation. I may try installing it again.
  7. As a warning to others I think I acquired this adware when I went directly to Adobe.com to download the latest edition of Flash (another fake pop-up had told me that mine was outdated - aargh). Gave it permission to download. Okay so far. But then while I was "blinking" or otherwise not paying attention a fake page again as me for permission to download. Which, in my deep regrets, did.
  8. The popup ads like to appear when I go to the Apple Support page or when I am googling Adware.

Oct 19, 2019 8:53 AM in response to BDAqua

Thank you K Shaffer & BDAqua,

After my second download of Malware Bytes for Mac I was able to find its launcher, both of them in fact. Maybe I was simply misspelling it in my searches. I don't know where the launcher was hiding. Anyway I was able to get the App and did a scan and it found16 Confirm Threats. 15 of them in my "user name" library dated 10/09/2019 or 10/10/2019. I previously & manually cleaned out the main library looking for 10/09/2019 and .plist (from reading other adware solutions in Apple Support).

I was able to trash the 15 Confirm Threats for by Malwarebytes for Mac and so far no more popups. I could not find the one named /Applications/.UpdateMac7.

Things learned:

  1. Adware piggy-backed on legit download of Adobe Flash by inserting a fake page over the real one to get my permission.
  2. TabAppDaemon or TabApp is adware. My original question. It was installed in Library/LaunchAgents on 10/09/2019
  3. Most everything else went to /Users/"my user name"/Library on 10/10/2019
  4. To get to /Users/"my user name"/Library, you need to do a Command-Shift-G and type in the pathway. Otherwise you won't be able to see what is there. (Also learned from reading through Apple Support response). Thank you.


I think I got it all, except /Application/.UpdateMac7


Posting to this forum has been one of the triggers for the pop-ups. So wish me luck.

Oct 16, 2019 9:49 PM in response to Carolyn_of_Tucson

Hi, K Shaffer asked me to take a look in here, he's had some good suggestions.


OpenSafari>Preferences>Extensions, see if or what is there.


EtreCheck is a simple little app to display the important details of your system configuration and allow you to copy that information to the Clipboard. It is meant to be used with Apple Support Communities to help people help you with your Mac.

http://www.etresoft.com/etrecheck


Pastebin is a good place to paste the whole report...

https://pastebin.com/


Workable but harder for me to work with...the Note tool on the bottom of this editor's toolbar, as shown in the image, to copy and paste the output from EtreCheck.

Adware

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.