How to remove savefrom.net adware?

[Timtraveller]

Hello,

I've often browsed this forum for general clues and hints.

Now during the past week or so, there's a small window that appears "ping!" in the right corner of Firefox 61.0.2 with some useless software to download, courtesy of "savefrom.net". Having read up on it, it can often be removed by looking up the Add-ons in Firefox, but there's no hint of it there on my browser. It seems I should install some sort of program to remove it, but haven't seen a free such for Mac yet.

I think I may have received it when using some app to download a youtube video (that's how it often appears) but it's a bit surprising because downloading a video shouldn't require installing anything. I'm not sure in fact.

Any ideas how to get rid of this savefrom.net thing?
Thanks!

PS.
I use El Capitan 10.11.6.

 

[ferrarr]

Malwarebytes for Mac should help.

https://www.malwarebytes.com/mac/

It's free to install, and it will give you a 30 free trial of the Premium version. After the trial expires, it will notify you and ask if you want to pay for the premium version, which you do not need, but that is up to you to decide. It really depends on how careful you are while on the net, and if you pay attention to the things you download.

I also recommend using add-ons or extensions on each browser you have on all your PC's. I use Ghostery and AdGuard AdBlocker.

https://www.ghostery.com
https://adguard.com/en/welcome.html

 

[pm-r]

If Bob's suggestion for Malwarebytes doesn't find anything you might want to try doing a search for anything with "savefrom.net" in it, and you may even need Find Any File.app (FAF) to anything:
http://apps.tempel.org/FindAnyFile/index.php




- Patrick
======

 

[Timtraveller]

Malwarebytes didn't find it, but I wanted to try something like that sooner or later so thanks for the hint.

Find Any File – great! I've sometimes been disappointed by Spotlight, and this is a perfect complement to it. Many thanks, Patrick!
Morever, it did find tracks of the spyware:

Firefox/Profiles/stogmlma.default-1490440923753-1533525534836/storage/default/https+++en.savefrom.net

It's worth noting that although I've cleaned the history of Firefox, the same "Default" folder contains information about sites I've visited since August 6th. Below "https+++en.savefrom.net" there's 211 kb worth of random data.

It seems it's not just a matter of removing the "savefrom" folder, but maybe the entire "stogmlma" (not recognised by google) is of its creation?

Would removing the "stogmlma.default..." folder solve it all?

I'm glad I started looking into this, the approximately daily "Bing!" sound and the ad in the right corner of Firefox is absolutely offensive, not to mention the fact that it's spyware of course.

 

[Timtraveller]

Update: it seems when clearing history previously I hadn't checked "Offline Website Data".

Having done that now, it shows the "savefrom.net" was just one of the sites I had visited: it's no longer listed. The actual spyware must go by some other name in the system to avoid being detected.

 

[pm-r]

Having done that now, it shows the "savefrom.net" was just one of the sites I had visited: it's no longer listed. The actual spyware must go by some other name in the system to avoid being detected.

If you need it, try some of the removing/uninstaller hits from here:
remove savefrom.net adware mac
https://www.google.com/search?clien...ove+savefrom.net+adware+mac&ie=UTF-8&oe=UTF-8




- Patrick
======