https://discussions.apple.com/thread/5965198
You installed the "DownLite" trojan, perhaps under a different name. Remove it as follows.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
/Library/Application Support/VSearch
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.* A folder should open with an item named "VSearch" selected. Drag the selected item to the Trash. You may be prompted for your administrator login password.
Repeat with each of these lines:
/Library/LaunchAgents/com.vsearch.agent.plist
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
After moving all the files, restart the computer and empty the Trash.
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including any that have the word "Spigot" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This trojan is distributed on illegal websites that traffic in pirated movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect much worse to happen in the future.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar, paste into the box that opens (command-V). You won't see what you pasted because a line break is included. Press return.
http://www.thesafemac.com/arg/
Adware Removal Guide
Published November 7th, 2013 at 3:36 PM EDT, modified August 9th, 2014 at 9:51 PM EDT
Adware has been a plague on the Windows world for years. Unfortunately, this plague has begun to spread to the Mac as well. There are a number of different programs out there that serve no useful purpose except to shove ads in your face, all just to make money for the developer of the adware. Because it lives in the borderline between malware and legit software, though, detection by anti-virus software can be very hit-or-miss. This can make removal difficult.
Where does it come from?
Adware often comes packaged in installers for other software. Most often, this is because something was downloaded illegally from a torrent or piracy site. Sometimes it is because it has been added to a legit piece of software by an unscrupulous download site. (Even well-known download sites, such as Download.com and Softonic, have resorted to this kind of unethical behavior, and should never be used.) Other times it is because a developer has opted to use an adware-riddled installer, provided with incentives from the adware creator, to distribute their software. It could even be installed through deceit, by pretending to be something that it is not in order to trick the user into installing it. (This last type is usually the only type that is detected as malware by anti-virus software.)
What are the symptoms?
The most typical symptom of such adware is the display of advertisements on your Mac where none should exist. Adware also will often change your browser’s home page and search engine settings, and may even cause redirects from legit sites to sites constructed for the financial benefit of the adware developer. It can also cause secondary problems, such as web pages displaying incorrectly (due to insertion of foreign HTML code) or browser crashes.
However, problems with unwanted ads in the web browser are not necessarily caused by adware on your computer. They could also be caused by a compromised network or a problem with the site itself.
Step 1: Run the Adware Removal Tool
Download and run The Safe Mac’s Adware Removal Tool. It will scan your system and remove any known adware automatically. Be sure to pay attention to all prompts, as you may need to decide whether or not to delete certain preference files, or may need to restart the computer and then run the script again. Read the prompts carefully, and be sure you understand and follow all instructions.
If you feel uncomfortable running a script downloaded from a website that you may not have ever heard of before today – which is perfectly reasonable – then you can try the manual removal instructions instead. If you opt for manual removal, be sure to follow the directions very carefully! Be aware that, for some adware, there is some risk involved with manual removal if you accidentally delete the wrong thing or don’t follow the instructions carefully. Some adware can cause your system to crash and be unable to start back up if the instructions aren’t followed carefully!
Step 2: Check for other causes
If you don’t find any signs of adware, your problems may not actually be caused by adware at all. You may be on a compromised network, or an ad-supported wifi network. You may also be looking at a site that has been hacked, or even just an ordinary bad site. For help figuring out where the problem might be, see the Other Causes page in this guide.
Step 3: Report new adware
If you have followed the instructions in the first two steps carefully, but you found no adware in step 1 and the tests in step 2 indicate that the problem is due to adware, you can download the TSM System Reporter and use it to scan your system and send me a report. This is important for detecting new adware.
Don’t be shy about sending reports if you think you may have something new. However, please do not send me reports if you have not completed both steps 1 and 2! I get a lot of reports from people who have not done so, and those reports often show adware that would have been removed by the Adware Removal Tool. You will save yourself (and me) a lot of time by following the directions the first time, rather than waiting for a response from me telling you to go back and follow the directions!
Note that this page is a work-in-progress, and probably always will be. If you find adware not described on these pages, or find that known adware is behaving in ways other than as described here, please contact me!