Question: Q: Uninstall Chill-tab «Virus» from Safari
Hello, everyone. I have had a problem for the last month with the «Chill-tab Virus». I’m not sure how I got this virus, but I know its VERY annoying to deal with everyday. Every time I start up my early 2015 MacBook pro and start teaching the internet I get this annoying pop up [IMAGE BELOW]. I have literally visited hundreds of websites trying to find a fix for this virus.. It’s annoying to have to force quit Safari and reopen it just to be able to use it.
I have tried lots of ways to remove this virus. I have installed virus cleaner, deleted everything in the Shared folder, deleted all Safari cash, searched chill-tab(Even SafariExtInstall) in finder and deleted everything, I have went through maybe websites an done step by step. Can someone just tell me the real way to remove this for good? Also MacKeeper came with the virus but I think I removed it.
Here is some stuff about my mac if it’ll help:
MacBook Pro (Retina, 13-inch, Early 2015)
MacBook Pro — model: MacBookPro12,1
1 2.7 GHz Intel Core i5 (i5-5257U) CPU: 2-core
8 GB RAM Not upgradeable
4 GB DDR3 1867 MHz ok
4 GB DDR3 1867 MHz ok
Wireless: en0: 802.11 a/b/g/n/ac
Battery: Health = Normal — Cycle count = 172
iCloud Quota: 4.75 GB available
Intel Iris Graphics 6100 — VRAM: 1536 MB
Color LCD 2560 x 1600
APPLE SSD SM0128G disk0: (121.33 GB) (Solid State — TRIM: Yes)
EFI (disk0s1 — MS-DOS FAT32) [EFI]: 210 MB
(disk0s2) [CoreStorage Container]: 120.47 GB
Recovery HD (disk0s3 — Journaled HFS+) [Recovery]: 650 MB
Broadcom Corp. Bluetooth USB Host Controller
Apple Inc. thunderbolt_bus
Apple SSD SM0128G Media (disk1 — Journaled HFS+) / [Startup]: 120.12 GB (19.10 GB free)
Encrypted AES-XTS (Unlocked)
Physical disk: disk0s2 120.47 GB Online
macOS Sierra 10.12.6 (16G29) — Time since boot: less than an hour
Mac App Store and identified developers
Adware: /Library/LaunchAgents/macsearch.plist
One possible adware file found. [Remove/Report]
Executable not found!
One orphan file found. [Clean up]
/Library/Application Support/AVGAntivirus/components/fileshield/unsigned
/System/Library/Extensions
[not loaded] 7 Apple tasks
[loaded] 178 Apple tasks
[running] 97 Apple tasks
[not loaded] 40 Apple tasks
[loaded] 176 Apple tasks
[running] 102 Apple tasks
[not loaded] com.adobe.AAM.Updater-1.0.plist (Adobe Systems, Inc. — installed 2017-08-14)
[loaded] com.adobe.AdobeCreativeCloud.plist (Adobe Systems, Inc. — installed 2017-08-14)
[running] com.avg.update-agent.plist (AVG Technologies CZ, s.r.o. — installed 2017-09-08)
[loaded] com.avg.userinit.plist (Shell Script 59a6db8e — installed 2017-09-08)
[loaded] com.oracle.java.Java-Updater.plist (? 4b51aa1f 72ac4dde — installed 2017-08-13)
[loaded] macsearch.plist (? e85a6e27 4f77794f — installed 2017-09-02) Adware! [Remove/Report]
[running] com.adobe.adobeupdatedaemon.plist (Adobe Systems, Inc. — installed 2017-08-14)
[running] com.adobe.agsservice.plist (Adobe Systems, Inc. — installed 2017-08-14)
[not loaded] com.apple.installer.cleanupinstaller.plist (? ? ? — installed 2017-08-13)
[loaded] com.avg.init.plist (Shell Script d34ba41 — installed 2017-09-08)
[loaded] com.avg.uninstall.plist (Shell Script ced238bd — installed 2017-09-08)
[loaded] com.avg.update.plist (Shell Script 7a885bf0 — installed 2017-09-08)
[failed] com.htGzWBDa.plist (? f8813c98 0 — installed 2017-09-02) — /Library/htGzWBDa/htGzWBDa.app/Contents/MacOS/htGzWBDa: Executable not found!
[loaded] com.oracle.java.Helper-Tool.plist (Shell Script e3fefdd2 — installed 2017-08-13)
JavaAppletPlugin: Java 8 Update 144 build 01 (installed 2017-08-13) Check version
AdobeAAMDetect: 3.0.0.0 (installed 2017-08-14)
QuickTime Plugin: 7.7.3 (installed 2017-07-15)
Java (installed 2017-07-22)
Time Machine not configured!
1.30 GB com.apple.WebKit.WebContent
722 MB kernel_task
388 MB com.apple.WebKit.WebContent
143 MB WindowServer
Input Output Process name
1 MB 254 KB com.apple.WebKit.Networking
73 KB 28 KB mDNSResponder
43 KB 37 KB apsd
8 KB 2 KB com.avg.daemon
5 KB 4 KB assistantd
2.98 GB Available RAM
465 MB Free RAM
5.02 GB Used RAM
2.52 GB Cached files
Memory Clean 2: 1.4 (installed 2017-08-14)
Microsoft Remote Desktop: 8.0.27312 (installed 2017-08-19)
Speedtest: 1.3 (installed 2017-08-24)
Microsoft Remote Desktop: 8.0.27319 (installed 2017-08-24)
Memory Clean 2: 1.5 (installed 2017-08-24)
WhatsApp: 0.2.5863 (installed 2017-08-27)
Unity: 2017.2.0b9 (installed 2017-09-02)
MonoDevelop for Unity: 2017.2.0b9 (installed 2017-09-02)
Unity Documentation: 2017.2.0b9 (installed 2017-09-02)
Unity Standard Assets: 2017.2.0b9 (installed 2017-09-02)
iOSSupport: 2017.2.0b9 (installed 2017-09-02)
Bitbox Installer: (installed 2017-09-02)
MacKeeper: (installed 2017-09-02)
MacKeeper: (installed 2017-09-02)
AVG AntiVirus: 17.2 (installed 2017-09-02)
Lame Library v3.99.5 for Audacity: (installed 2017-09-03)
Install information may not be complete.
2017-09-11 15:59:54 com.apple.WebKit.WebContent High CPU use
2017-08-31 22:07:29 Kernel Panic
3rd Party Kernel Extensions: None
Posted on Sep 12, 2017 7:36 PM
Helpful answers
- **I won’t take any responsibility if following my steps cause your mac to misbehave.
- Goto «[username]/Library/LaunchAgents/», remove 2 .plist file which involved in some process like «macsearch» and «bination». You might need to open the plist to check code inside.
- Goto «[username]/Library/», remove «bination.lz» folder. Inside has an .app file.
- Goto «[username]/Library/Caches/», remove suspicious files and folder.
- **Below are the files i deleted, I won’t take any responsible if deleting it affect your mac.
- All files related to mackeeper
- macsearch
- searchinstaller
- Linkury.SafariExtInstall
- All folders like «a_A1SFG2XXXX»
- ChromeAndFirefoxSetter
- Goto «
/Users/Shared», remove
- sf.plist
- SafariSetter.safariextz
- All executable files like «a_A1SFG2XXXX»
- All «App_A123JXXX» zip files and folders
I do not sure the «bination» files are related to this issue. I might mixed up or missed out some files to delete between the Caches and Shared folder, but you should get the idea, delete all files look similar. Check for suspicious files, I believe the malware might using different folder name for different device. Hope it helps.
Dec 14, 2017 2:30 AM
There’s more to the conversation
Loading page content
Page content loaded
Restart Safari with the Shift key down.
Download and run Malwarebytes.
BTW, it’s not a virus, just malware/adware.
Sep 12, 2017 9:27 PM
Sep 13, 2017 8:07 AM
I have this too. This guy from Malware Bytes jumps into each forum and claims to have fixed it and kills the forum. It does not fix it, it just removes the chill-tab extension the malware still sends the ads. Strangely every sites claiming a permanent fix links to Mackeeper.com who supposedly have a fully formed tool to remove it and no-one else does, also the instructions to fix without Mackeeper tend to be non-functional. It looks complex to unpick, too complex for me at least. A rebuild seems easier or restore a saved image if you have one.
Sep 16, 2017 4:07 AM
Darn, I don’t have one. 😟
Sep 17, 2017 6:31 PM
MalwareBytes worked for me. I had to run it twice from a fresh boot, then reboot again. The first time it removed 6 threats. the second time it cleared 2 more including chill-tab. Then reset Firefox (help > troubleshooting > refresh) and Chrome (settings > search engine). might have to do similar to Safari.
Sep 26, 2017 4:26 AM
Can I ask how did you find this information?
Oct 16, 2017 10:54 AM
I also have this. Install first Malwarebytes and restart your Mac. Then restart your Mac and start safari and wait till chill tab is running. Then start Malwarebytes ans start scan. It finds 3 files. Clear it.
Oct 21, 2017 11:45 AM
So I had a problem like this too. I got it all figured out and I think google is your problem. Google was the source of the problem for me so I deleted it. Anyways, when it was all done, this weird icon/emoji appeared on the top right of my screen. It wasn’t an emoji, just a weird icon. It was this weird Black and white circle face, and the only thing that was showing was the eyes. Then, after I got scared, the green light showing that my camera was on, turned on. I was on FaceTime with my friend and she looked it up and it means that someone is looking through my camera. I then realized that this person had access to my computer, and to the network I was on, and all of me and my family’s personal info. After I got scared, Siri gave me a notification saying that voice reader thing was activated. She said it was overrided by my password, which I never typed in. I then realized that the person was listening to me, and then a google document opened up (even tho I had deleted google) and was saying something and then my computer turned off. It took about 30 minutes for my computer to turn on, and when I turned it on and logged in, my computer flashed and a bunch of weird code and information came up, and then it just went away. I am really freaked out because I saw some websites saying that Chill-tab gave u false websites, and your information could be hacked easily. I got it removed, but I feel as if the person was on before I removed chill tab. I fell like this is being watched right now and I need help quickly. Someone please help!
Oct 25, 2017 7:37 PM
So, far I’ve found various residual components of chill-tab. Most of it’s functioning is in the browser preferences. Go through each preference icon (search, security, privacy, etc.). For instance, in Search, Manage Websites, remove its insertion data. Remove anything referencing chill-tab. I have multiple browsers, it even changed Firefox’s default search engine. As I write this, I’m still on a seek & destroy chill-tab mission. Looking for help brought me here. So, far so good. Hope this helps.
Oct 28, 2017 5:13 AM
Thanks for the concise reply, I have the exact same issue.
Nov 9, 2017 9:18 PM
Hope it works for you too.
Nov 15, 2017 2:21 PM
First, I was skeptical about downloading another app, but Malwarebyte did it for me. I waited for the pop up that asks to trust or cancel chill tab before I scanned using malwarebyte, lo and behold there were 4 items scanned and deleted. Then Malwarebytes asked to restart imac, it hasn’t made a pop ad since.
Источник
Remove Chill Tab from Your Mac (Update January 2020)
This article gives insight into the issues that could occur after Chill Tab gains access to your Mac and provides a complete removal guide that will help you to restore affected system and browsers.
Chill Tab “Virus”
Chill Tab is an intrusive undesired program that could affect your Mac without your knowledge. Once loaded on your system it will hijack main browser settings and configure them to display the main page of Search.chill-tab.com browser hijacker. In addition, Chill Tab could cause unexpected browser crashes and urge you to update browser version. Be advised to remove this suspicious program from your affected Mac as soon as possible because it can lead to some serious privacy and security related issues.
Chill Tab continues to spread, as evident by the multiple reports shared by Mac users on forums such as Apple Discussions. The extension is persistent in most attempts to remove it manually.
Threat Summary
| Name | Chill Tab |
| Type | Potentially unwanted application |
| Short Description | Undesired program that invades Mac devices and alters main browser settings. |
| Symptoms | This rogue program could load on each system start. Its purpose is to generate annoying pop-ups and pushes Search.chill-tab.com browser hijacker. |
| Distribution Method | Software bundling; Corrupted freeware installers |
| Detection Tool | See If Your System Has Been Affected by malware | User Experience | Join Our Forum to Discuss Chill Tab. |
What is Chill Tab Mac?
Chill Tab is classified as a potentially unwanted program whose configuration files are spread via software bundling, corrupted third-party apps installers, malvertising and other shady methods.
Corrupted installers of third-party apps are believed to be used as a primary channel used for the distribution of this undesired program. Since many free apps have an open source code, hackers often modify them. After modifications, they release the same apps but with corrupted installers. The latter are set to install Chill Tab along with the primary app. Unfortunately, while installing such an app you could easily miss added extras and eventually start them on your Mac. Happily, there is a way to prevent undesired apps like Chill Tab from invading your device by selecting the Advanced/Custom configuration option presented in the installers of desired apps. Once you open this step you may reveal the presence of any undesired apps and opt out their installation.
As reported by users whose devices were affected by Chill Tab, they got the virus by installing third-party apps downloaded from mac-torrents.org. For the sake of your security, we advise you choose wisely your torrent sources and download apps only from trusted ones. Otherwise, you risk affecting your Mac with undesired programs like Chill Tab or even with some pieces of severe malware like ransomware.
This unwanted and potentially harmful program could affect popular web browser like Google Chrome, Mozilla Firefox, Internet Explorer, Microsoft Edge and Safari.
Chill Tab Keeps Coming Back MAC
Soon after Chill Tab is started on your Mac it accesses browser settings and applies some significant changes. Affected users reported that after these changes led to the appearance of a browser hijacker called Search.chill-tab.com in their preferred web browser. So if the following bogus search engine is the first page you see when you open a preferred web browser you should know that Chill Tab PUP is running on your Mac.
The settings of the new tab page and the default search engine could also be replaced by this hijacker.
As long as you are forced to use the services of Search.chill-tab.com all data stored in the affected browser could be obtained by unauthorized actors. This includes your passwords, logins, financial credentials, and all other sensitive details you enter online. This unpleasant issue is easily achievable due to the fact that the website provides an insecure connection. And you could easily identify this with a click on the icon that appears right before the domain in the address bar.
Here is what you will see when you do it in an affected Firefox browser:
Unfortunately, during our research we identified that the hijacker associated with Chill Tab pushes yet another deceptive search engine called [wplinkpreview url=”https://sensorstechforum.com/safe-finder-removal-manual/”]Safe Finder. Actually, it’s the deceptive search engine Safe Finder that displays the results after you enter a search query in the search field of search.chill-tab.com. The bad news is that the number of browser hijackers that could obtain data about your online behavior appears to be two. Why this issue is considered to be bad? Because their owners are likely to use harvested details for aggressive advertising campaigns or even sell them to third-parties of unknown origin. At worst, your data could be obtained by cyber criminals who are likely to use it for their malicious activities.
As of data collection practices associated with Chill Tab, they could be realized with the help of tracking technologies such as cookies, web beacons and log files. The privacy policy page of this bogus app reveals that this app, its services and associated websites are designed to collect both personally and non-personally identifiable information from all affected devices.
Here you could see the list of details that will be acquired and transferred to Chill Tab servers:
- Type of browser
- The type of the your device
- Technical information pertaining to the your device
- Language preferences
- Time stamps
- Clicks and visited pages
- Search logs
- The operating system
- Utilized internet service provider
- IP address
If you want to clean your Mac and prevent all issues caused by Chill Tab you need to remove all files associated with the program. Check our guide below for a step-by-step removal process.
Chill Tab – Update October 2019
According to recent reports Chill Tab has been detected to still be active on users Macs and to be widespread via the most often used means of replication. Chill Tab can also be seen in new and different forms since its creators have attempted to update it in various different ways.
Chill Tab Virus Update August 2019
If you are wondering what is the Chill Tab virus and why it keeps coming back on Mac, you should thoroughly read this article. A large number of users are reporting the Chill Tab virus to show up on their Mac computers and browser tabs with no way of removing it. You should not worry as this is a fixable problem. It is all related to the Chill Tab virus which affects all browsers and may even place some of its files on your Mac. Also known as Chilltab or Chill-tab the program and its performance is nearly the same on every infected machine. You should not panic and definitely not click on the pop-ups, ads, redirects and full page advertisements displayed by Chill Tab as that may trigger even more spam windows and messages to appear on your system and infect your Mac with malware. Read on to see what exactly this PUP is and what you should do to remove it.
How To Remove Chill Tab on Mac
You will see how to remove chill tab and all associated files from your Mac here. You need to complete all steps listed in the removal guide that follows. It presents both manual and automatic removal instructions that combined will help you with how to delete Chill Tab Mac. In case you have further questions or need additional help, don’t hesitate to leave a comment or contact us via email.
Gergana Ivanova
Highly motivated writer with 5+ years of experience writing for ransomware, malware, adware, PUPs, and other cybersecurity-related issues. As a writer, I strive to create content that is based on thorough technical research. I find joy in the process of creating articles that are easy to understand, informative, and useful. Follow me on Twitter (@IRGergana) for the latest in the field of computer, mobile, and online security.
Follow Me:
Источник
