Author Topic: MacOS:Bundlore-BG [Adw]  (Read 824 times)

0 Members and 1 Guest are viewing this topic.

Offline Stubb

  • Newbie
  • *
  • Posts: 2
MacOS:Bundlore-BG [Adw]
« on: October 11, 2018, 08:12:11 AM »
Popup alerted that Filesystem Shield blocked

Infection: MacOS:Bundlore-BG [Adw]
Process: /Applications/Safari.app/Contents/MacOS/Safari
File: /Users/ME/Library/Safari/Extensions/.dat.nosync018b.ot4Rpk


I searched the forums for Bundlore-BG and had no hits, and only four for Bundlore (from 2012-2015).
Is there any way of knowing what website was responsible? I had opened a new window and opened a set of saved tabs that I look at regularly. Repeated this later and had no Avast alerts.

Using: Avast 13.11, Virus Definitions 18101000; MacOS 10.13.6, Safari 12.0
Extensions installed: Blur (Abine), Adblock Plus

P.S. It might be convenient to put the version of Avast and the Virus Definitions on the pop-up window.

Offline .: Mac :.

  • Avast Überevangelist
  • Ultra Poster
  • *****
  • Posts: 4985
Re: MacOS:Bundlore-BG [Adw]
« Reply #1 on: October 14, 2018, 03:56:56 PM »
It looks to possibly be a safari extension based on the file path reported. Can you check that there are no installed extensions that you did not install yourself? Check the extensions tab in the Safari preferences.
"People who are really serious about software should make their own hardware." - Alan Kay

Offline MisterX

  • Newbie
  • *
  • Posts: 2
Re: MacOS:Bundlore-BG [Adw]
« Reply #2 on: October 14, 2018, 11:34:10 PM »
I also got the same alert 4 days ago.  I've gone to some trouble to figure out what happened since I did not actually install anything that day. I haven't had much luck finding anything helpful.
« Last Edit: October 14, 2018, 11:46:11 PM by MisterX »

Offline .: Mac :.

  • Avast Überevangelist
  • Ultra Poster
  • *****
  • Posts: 4985
Re: MacOS:Bundlore-BG [Adw]
« Reply #3 on: October 14, 2018, 11:45:39 PM »
Hi MisterX,

Yes shopping/coupon extensions and add-ons are often associated with Adware like Bundlore, and many themselves could be called adware in the purest sense. I suspect its a similar scenario for Stubb

Cheers,
Mac
"People who are really serious about software should make their own hardware." - Alan Kay

Offline MisterX

  • Newbie
  • *
  • Posts: 2
Re: MacOS:Bundlore-BG [Adw]
« Reply #4 on: October 14, 2018, 11:49:30 PM »
I thought that it might have been installed by a Safari extension update. But after checking the dates of recent updates, nothing matches when Avast found Bundlore-BG.  I've edited my previous post.

Offline .: Mac :.

  • Avast Überevangelist
  • Ultra Poster
  • *****
  • Posts: 4985
Re: MacOS:Bundlore-BG [Adw]
« Reply #5 on: October 15, 2018, 12:03:53 AM »
Often its bundled with some free applications, as a way for them to monetize the app. Luckily extensions are the easier form of adware to remove.

If you get any further detection, post a screenshot and we can assist with removal.
"People who are really serious about software should make their own hardware." - Alan Kay

Offline Stubb

  • Newbie
  • *
  • Posts: 2
Re: MacOS:Bundlore-BG [Adw]
« Reply #6 on: October 16, 2018, 08:09:17 AM »
The extensions I have had installed for some time are BLUR (by Abine, tracker blocking, masked e-mails) and AdBlock Plus.  There were no unwanted surprises in Preferences (nor in System Preferences LogIn items).

I deleted the quarantined file, reran AV and malware scans. Have not had any alerts.

Just for information, what currently appears in ~/Library/Safari/Extensions are Extensions.plist and Blur.safariextz. The .plist file is incomprehensible but does contain a block of stuff about Blur.

\Apple-signed_Hash of Content Blocker String_Bundle Directory Name_Added Non-Default Toolbar Items_Archive File Name_Bundle Identifier_Developer Identifier[Hidden Bars_Removed Default Toolbar ItemsWEnabledYSignature_Has Called canLoad   _Blur-2.safariextension†_Blur-2.safariextz_com.abine.dntpsafariZ82M4SELZCB††......

The next blob goes on and on and with many URL sort of things that either have something to do with AdBlock or whose presence makes no sense. Since I've never examined this file before, I can't know.

I think I'll uninstall those extensions, make sure the files get trashed and reinstall. I'll report back to confirm whether the stuff in ~/Library/Safari/Extensions looks okay or not.

Update:

Appears the long blob is from the adblocker. I was also having trouble with very slow response in Hotmail which I thought might be related to this in an indirect way. Uninstalling everything associated with AdBlock Plus eliminated that issue. I installed a new one, uBlock Origin, which seems to play well with everyone. Checking Extensions.plist, once again there is a long list of stuff; that must all come from the ad blockers.

p.s. The audio Verification option doesn't work. The captchas do because I can't read some of them.
« Last Edit: October 16, 2018, 10:21:42 AM by Stubb »