Certificate Errors (Adware ib.adnxs.com) While Using Safari (SOLVED)

Here’s a fun one I ran into this evening on a client’s computer. When we launched Safari, and tried to go to most any website (Yahoo being the most reproducible), we were greeted to a constant barrage of pop-up windows (advertising MacKeeper), or, a certificate error pointing to a website called ib.adnxs.com, which is a form of adware (sort of a virus if you want to call it that). Doing some research on the subject, I found out that to remove this malicious software from Safari, you must remove the following components manually:

  • /Library/Application Support/VSearch
  • /Library/LaunchAgents/com.vsearch.agent.plist
  • /Library/LaunchDaemons/com.vsearch.daemon.plist
  • /Library/LaunchDaemons/com.vsearch.helper.plist
  • /Library/LaunchDaemons/Jack.plist
  • /Library/PrivilegedHelperTools/Jack
  • /System/Library/Frameworks/VSearch.framework

You simply navigate to each of these places on your hard drive and drag those files seen above to the trash. You may have most of them and not all of them (what we witnessed), but, remove the ones that you find. It will ask for your admin password each time, which is normal. When done, restart your computer and empty the trash. Upon launching Safari, we no longer had certificate errors pointing to ib.adnxs.com any longer. Please feel free to contact Capital Mac Service if you have any difficulty finding or removing these files.