Need Mac/Safari Help

[KimInTheForest]

Okay, this is REALLY off topic. But I wasn't sure where else to turn. I know some of you are very computer savvy.

Earlier tonight my Safari browser (on my iMac) got stuck on what I am sure is a bogus "macprotectionalert.info/error" message. It wants me to call the "Mac Support Team" immediately at an 800 number and will not release my screen/browser until I do so. I cannot get rid of the "alert" message or close it or move beyond it. All Safari functions are inoperative. I cannot clear cookies or clear browser history to get rid of it because nothing works while this message is jamming the browser.

Force Quit doesn't clear it permanently. The bogus error message is there again as soon as I re-open Safari. Even shutting down and turning off the computer and unplugging everything including ethernet cable doesn't work. As soon as I turn everything back on and open Safari, that bogus message screen is where it goes to.

I am posting this question via Firefox. Google Chrome would also work. But I would  rather not lose my Safari browser altogether. It is my preferred browser. But it is unusable unless I can get this bogus "macprotectionalert" message to close permanently. Any ideas? Thanking the geeks among you in advance!

kim

[KimInTheForest]

UNBELIEVABLE! I seem to have solved my problem on my own. Who knew I was a Mac geek genius? Haha! I followed some very long and elaborate instructions I found online about how to solve this problem. None of the first 20 steps worked. But when I got to the end of the list and tried the last thing... IT WORKED! (I had to go to folder ~/Library/Preferences, then look for a file named com.apple.Safari.plist, and drag it to the trash. Then restart my computer and re-open Safari.)

Thanks for being there. Haha!

kim

[Philadelphia]

any time. lol

[gnatcatcher]

Kim, I just saw this thread, but in general, when any program has gone bizarre on a Mac and force quitting doesn't work, deleting the plist file for that program has a good chance of setting things right. The program will then create a new plist. An anal-retentive person like myself might copy the original plist file to a thumb drive "just in case" before deleting it, but I've never yet had to restore the saved copy.

Congratulations on your new Mac credential! Welcome to nerdland (not to be confused with beautiful Nederland, CO and its Frozen Dead Guy festival).

Gnatty

P.S. Did you know that if a problem prevents you from getting to Force Quit on the Apple menu, you can force quit an application by control-option-clicking its Dock icon, then choosing Force Quit from the contextual menu that appears? That wouldn't have been useful this particular time, but it occasionally comes in very handy. And it's actually faster than the Apple menu method.

[KimInTheForest]

Thanks Philadelphia & Gnatty! Is there really a Nederland, CO with a Frozen Dead Guy Festival?%@#!!? Maybe we should hold a virtual bobsled & glüwein party there after our virtual gator & crawdad bar-b-cue at Tommy's and our virtual luau in Hawaii with Bree on the Beach…

kim

[gnatcatcher]

. . . Is there really a Nederland, CO with a Frozen Dead Guy Festival?%@#!!?. . .

http://frozendeadguydays.org

[KimInTheForest]

http://frozendeadguydays.org

Amazing! Must go! There's even a Frozen Dead Poet Slam.

kim

[Mugwump]

UNBELIEVABLE! I seem to have solved my problem on my own. Who knew I was a Mac geek genius? Haha! I followed some very long and elaborate instructions I found online about how to solve this problem. None of the first 20 steps worked. But when I got to the end of the list and tried the last thing... IT WORKED! (I had to go to folder ~/Library/Preferences, then look for a file named com.apple.Safari.plist, and drag it to the trash. Then restart my computer and re-open Safari.)

Thanks for being there. Haha!

kim

The action you took will have removed some data that is not malicious so you might find it a little slow on some sites for a while. Clearing cookies and saved data is ok but it will slow down some sites and make you re-enter passwords for some sites.

The other method to get around this malicious javascript attack on mac users if to do this

 1. Press command-W to close the tab or window. A huge box will pop up. Press the return key and both the box and the page will close. If that doesn't happen, continue.

2. From the Safari menu bar, select

          Safari ▹ Preferences... ▹ Security

and uncheck the box marked Enable JavaScript. Leave the preferences dialog open.

Close the malicious window or tab.

Re-enable JavaScript and close the preferences dialog.

3. If the Preferences menu item is grayed out, quit Safari. Force quit if necessary. Relaunch it by holding down the shift key and clicking its icon in the Dock. From the menu bar, select

          Safari ▹ Preferences... ▹ Privacy ▹ Remove All Website Data

to get rid of any cookies or other data left by the server. Open your Downloads folder and delete anything you don't recognize.

Sounds to me safari has about the same problem as IE 6 had being locked up by a web page that hijacks the home page function by using some non standard javascript function/actions that are specific to Mac Safari in this case.

All of this non standard web coding nonsense in both Windows and Mac is why I switched to Linux years ago but I am a bit of a rebel

In windows you would have to delete some corrupted user data which is very obscure and hard to find, some of which may not be able to be modified without a reinstall of Windows especially in older versions of Windows like XP.

In Linux you simply mess with a hidden folder called .mozilla or .chrome in your home directory basically the same as Mac.

So yes Mac is easier to fix this kind of garbage than windows, but it is disconcerting that Safari is starting to get hosed by the web pirates.

Thanks for the heads up I have a brother and sister in law that are tech challenged and use Macs and Windows, they call me all the time to figure out how to fix things. Hopefully they avoid this scam but if it hits them I am sure I will hear about it. LOL

[/color]

[KimInTheForest]

Thanks for all the good info, Mugwump!

I actually did try all of those things you mentioned before finding and trashing that .plist file. None of those other methods worked or they weren't available in some cases. Could not access Safari menu bar because everything on it was grey and inoperative. I did try Command-W. Also force quit then tried to re-open safari while holding down shift key. Tried these things many times. This was a very persistent malicious javascript.

And you're right that the action I took slowed down some sites since.

Should I add a free anti-virus program to my mac like Avast? I never did in the 4 years I have owned this Mac because I didn't want to slow it down (as anti-virus software invariably does) and because I thought Mac was more or less immune. But obviously not to malicious javascript!

A friend advised me to go into my App Store and download Bitdefender virus protection and run a full scan. Do you think that would help at this point? Or is the problem solved?

Thanks!
kim

[gnatcatcher]

Kim, I just searched the TidBITS web site and found that they have a thorough, recent article about what you experienced and what to do about it (including how to prevent it): http://tidbits.com/article/15777

TidBITS is a very trustworthy Mac eZine of many decades' duration.

Gnatty

[KimInTheForest]

Thanks Gnatty!

kim

[Mugwump]

Should I add a free anti-virus program to my mac like Avast? I never did in the 4 years I have owned this Mac because I didn't want to slow it down (as anti-virus software invariably does) and because I thought Mac was more or less immune. But obviously not to malicious javascript!

A friend advised me to go into my App Store and download Bitdefender virus protection and run a full scan. Do you think that would help at this point? Or is the problem solved?

Thanks!
kim

I don't think antivirus will help in this case because it is a non standard javascript that exploited a know vulnerability in Safari so most anti virus will not help because you cannot scan all of your webscript activity as you surf the web. Apple will have to patch Safari to fix the problem.

You can run with javascript disabled in Safari but unfortunately a fair portion of the useful functions rely upon javascript. Much of which is still poorly written. However most of the web will run just fine with a no script and then you can re allow scripts only from sites you trust like this one and your bank etc. It is a pain but being hosed by a javascript is not a good thing and I am sure it has the folks who code at Apple burning the midnight oil right now.

What I would do is enable scripts on Safari only from sites you trust and run Firefox or Chrome for everything else like surfing for shopping etc that can lead you to sites that carry malicious scripts.

My boss got hosed two years ago by an online gaming/ card play site from India and it took me two hours to remove all the garbage ware browser add ons and little spyware/addware crap and this was on Windows 7. He just clicked through an install process and did not bother to read about or check up on the reputation of the site so he learned a valuable lesson.

What is happening with Safari is different it is a vulnerability in how Safari uses javascript that bypasses the user input and switches browser setting and then loads a popup window on startup as a default setting. Annoying as hell but not as funny as some of the pop up behind hidden pages that you got with Internut Exploiter 6 years ago .... OOOPS Internet Explorer. LOL

Regards
Eric

[KimInTheForest]

Thank you Eric! Very useful to know. I think I will switch over to Firefox or Chrome as you suggest for my web-surfing. I also stream videos from various sites. That's what I was trying to do last night when I got into trouble with this thing.

Thanks for your help,
kim

[Mugwump]

Thank you Eric! Very useful to know. I think I will switch over to Firefox or Chrome as you suggest for my web-surfing. I also stream videos from various sites. That's what I was trying to do last night when I got into trouble with this thing.

Thanks for your help,
kim

Oh, the other way you might be able to get rid of this nonsense if it happens again is more simple than that. It makes sense if you turn off wifi or internet connections before you launch safari that the page will not be able load a remote script pop up payload. At which point you should be able work on safari to change safari to load something like a blank page on startup or google.  Safari should not be starting with a javascript popup window from a page unless it is loaded from the net. 

Fascinating how these scams work, just remember that if it tells you to call a number and tells you there is something wrong with your computer it is certainly a scam the same as the Microsoft Technical Support scam phone calls!

We are still getting phony calls from scams here in BC they are still at it. It has almost become laughable, when I do decide to answer an unsolicited call from their automated dialing machines.

I love walking these characters down the garden path when they call us and tell us that there is a problem with our windows computer and this is a technical division of Microsoft or something to that effect. I lead them on for a few minutes and ask them if they can help me connect to their technical support system with Samba under Linux instead of Windows to fix my computer.

Needless to say they very quickly get the idea that I played them for a sucker!

I love messing with the scammers heads, people who are liars are easy to deal with all you have to do is lead them on then pull the rug out from under them.

[KimInTheForest]

Oh, the other way you might be able to get rid of this nonsense if it happens again is more simple than that. It makes sense if you turn off wifi or internet connections before you launch safari that the page will not be able load a remote script pop up payload. At which point you should be able work on safari to change safari to load something like a blank page on startup or google.  Safari should not be starting with a javascript popup window from a page unless it is loaded from the net. 

Believe it or not, I actually tried this. I force quit Safari. I unplugged my ethernet cable from the back of the computer. (My WiFi is always turned off, and I have no WiFi router.) Then I reopened safari… and the malicious javascript is what came up on the screen! From where I don't know. Cached maybe? I really tried everything I could find on this long list of solutions I found online. And the only thing that worked was finding that one plist file and trashing it. I could not believe the persistence of this thing… Crazy!

kim

[Mugwump]

Believe it or not, I actually tried this. I force quit Safari. I unplugged my ethernet cable from the back of the computer. (My WiFi is always turned off, and I have no WiFi router.) Then I reopened safari… and the malicious javascript is what came up on the screen! From where I don't know. Cached maybe? I really tried everything I could find on this long list of solutions I found online. And the only thing that worked was finding that one plist file and trashing it. I could not believe the persistence of this thing… Crazy!

kim

Ok that explains the reason why this little scripting hack is insidious like a virus!   Obviously something in Safari allows a carefully crafted javascript hack to store popups which should only be remote temporary single instance content. YUCK

An interesting distraction from HCV worries though,  it is fun to discuss this sort of nonsense even if it is annoying.

BTW a good way to increase encryption strength with pass words is not to use them. Instead try pass phrases. Simply practice typing things like allcowseatgrassandmoo.

This way a very long and therefore harder to crack encryption happens. Notice the removal of the spaces makes it so the words do not work as individual words so dictionary attacks are also foiled with this method.

One that I have used in the past was JSBachgbdfaacegegbdffaceA440 
A monster but if you are a classical musician it is easy to remember, even if  New York Philharmonic players would disagree and insist that A above middle c is actually A442.

So the best passphases are ones that only you can easily remember. The trick is remembering where you used them.

You can store your pass phases and where they were used by typing them out with the spaces in text files stored on a secured medium if you use obscure ones and forget them. Make sure that you use encrypted files to store the text files but don't forget the passphrase for the encrypted drive or file on a drive where they are stored.

As these types of attacks become more common on all platforms good computer security practices is something that we should all learn. One thing I will give Apple is that their OS you can easily use filevault to encrypt volumes and files unlike Windows where you have to purchase the so called " professional " version of windows to do file and drive encryption or worse buy crapware like Norton. Microsoft's dumbing down of computer users is not a good thing and has polluted the net with hacked sites and compromised computers for years.

I don't think Apple will fall into the same trap so this annoying hack should not last very long. There is no way they could get away with the same crap that Microsoft did for years and survive in the dwindling high end expensive computer market.

 

[gnatcatcher]

One that I have used in the past was JSBachgbdfaacegegbdffaceA440 
A monster but if you are a classical musician it is easy to remember, even if  New York Philharmonic players would disagree and insist that A above middle c is actually A442.

-not to mention higher than 442 for European orchestras. (Yes, I was a professional longhair -- and still have long hair [what's left of it], even though I traded in my instrument for other forms of creative expression.) So, I enjoyed your pass____ example. Mine are run-together phrases, too, although they don't happen to be musical.

<rant on>
Safari has a Preferences check box "Block pop-up windows" which is a joke -- it hasn't done much good in I-don't-remember-how-many-versions of Safari. So I wouldn't count on Apple to fix this. Apple seems to specialize in confusing people about the difference between wants and needs, so it concentrates on generating new niche markets, often leaving in the lurch those of us who actually want to use computers productively.
<rant off>

Gnatty

[KimInTheForest]

Thanks Eric for the tips on increasing encryption strength in passwords. I have always been very laissez faire about my own password security. But really, you're right that we all need to become more computer security savvy in this age of hacks, attacks and malicious scripts…

cheers,
kim