Hallo ein Freund von mir hat ein Apple Notebook mit Yosemite drauf. Bei mehr oder weniger jedem Klick öffnet sich Werbung und ne neue Seite und ähnliches.

Ich bin zwar im IT Support tätig, habe aber vonn Apple und deren OS so gut wie null Ahnung.
Wie kann ich ihm jetzt am Besten abhelfen ?

Hole morgen mal das LAppi hier hin und gehe gleich mal per TeamViewer drauf. Kann ich schonmal vllt irgendwie Logs ziehen ?

Was wäre der erste Schritt ?

Hallo Galvanoauge,

Folge bitte dieser Anleitung http://www.trojaner-board.de/158652-...dware-mac.html

Logfile erstellen:
Lade dir bitte EtreCheck herunter: hxxp://etresoft.com/download/EtreCheck.zip

1. Entpacken und Ausführen
2. Kopiere das Logfile in das Clipboard - Button "Copy to Clipboard".
3. Füge das Logfile in "Code-Tags" in diesem Thread ein.

Wenn von AdwareMedic auch was gefunden wurde, bitte auch das Log hier einfügen. Dazu oben unter dem Menüpunkt Scanner Open Logfile auswählen. Suche die Einträge von Heute (Datum) und füge diese hier in "Code-Tags" ein.

Gruß,
-dante

treCheck version: 2.1.1 (104)
Report generated 10. Dezember 2014 21:12:06 MEZ

Hardware Information: ℹ️
	MacBook Pro (13-inch, Early 2011) (Verified)
	MacBook Pro - model: MacBookPro8,1
	1 2.3 GHz Intel Core i5 CPU: 2-core
	4 GB RAM Upgradeable
		BANK 0/DIMM0
			2 GB DDR3 1333 MHz ok
		BANK 1/DIMM0
			2 GB DDR3 1333 MHz ok
	Bluetooth: Old - Handoff/Airdrop2 not supported
	Wireless:  en1: 802.11 a/b/g/n

Video Information: ℹ️
	Intel HD Graphics 3000 - VRAM: 384 MB
		Color LCD 1280 x 800

System Software: ℹ️
	OS X 10.10.1 (14B25) - Uptime: 22 days 4:25:45

Disk Information: ℹ️
	Hitachi HTS545032B9A302 disk0 : (320,07 GB)
	S.M.A.R.T. Status: Verified
		EFI (disk0s1) <not mounted> : 210 MB 
		Recovery HD (disk0s3) <not mounted>  [Recovery]: 650 MB 
		Macintosh HD (disk1) / : 318.84 GB (158.71 GB free)
			Encrypted AES-XTS Unlocked
			Core Storage: disk0s2 319.21 GB Online

	MATSHITADVD-R   UJ-8A8  

USB Information: ℹ️
	Apple Inc. FaceTime HD Camera (Built-in) 
	Apple Inc. Apple Internal Keyboard / Trackpad 
	Apple Inc. BRCM2070 Hub 
		Apple Inc. Bluetooth USB Host Controller 
	Alcor Tech Intenso Alu Line 31,46 GB
		S.M.A.R.T. Status: Verified
		INTENSO (disk2s1) /Volumes/INTENSO : 31.46 GB (8.09 GB free)
	Apple Computer, Inc. IR Receiver 

Thunderbolt Information: ℹ️
	Apple Inc. thunderbolt_bus

Gatekeeper: ℹ️
	Mac App Store and identified developers

Adware: ℹ️
	Conduit [Remove]
	Downlite [Remove]

Kernel Extensions: ℹ️
		/Applications/InsomniaX 2.app
	[not loaded]	org.binaervarianz.driver.insomnia (1.0.0d1) [Support]
	[not loaded]	org.binaervarianz.iokit.insomnia (1.0.0d1) [Support]

Problem System Launch Agents: ℹ️
	[failed]	com.apple.CallHistoryPluginHelper.plist
	[failed]	com.apple.cmfsyncagent.plist
	[failed]	com.apple.coreservices.appleid.authentication.plist
	[failed]	com.apple.icloud.fmfd.plist
	[failed]	com.apple.telephonyutilities.callservicesd.plist

Problem System Launch Daemons: ℹ️
	[failed]	com.apple.AirPlayXPCHelper.plist
	[failed]	com.apple.AssetCacheLocatorService.plist
	[failed]	com.apple.ctkd.plist
	[failed]	com.apple.findmymac.plist
	[failed]	com.apple.GSSCred.plist
	[failed]	com.apple.nehelper.plist
	[failed]	com.apple.periodic-monthly.plist [Details]
	[failed]	com.apple.periodic-weekly.plist [Details]
	[failed]	com.apple.systemstats.analysis.plist
	[failed]	com.apple.wdhelper.plist

Launch Agents: ℹ️
	[loaded]	com.oracle.java.Java-Updater.plist [Support]
	[running]	com.teamviewer.teamviewer.plist [Support]
	[running]	com.teamviewer.teamviewer_desktop.plist [Support]
	[running]	com.vsearch.agent.plist Adware! [Remove]

Launch Daemons: ℹ️
	[loaded]	com.adobe.fpsaud.plist [Support]
	[loaded]	com.oracle.java.Helper-Tool.plist [Support]
	[loaded]	com.oracle.java.JavaUpdateHelper.plist [Support]
	[loaded]	com.teamviewer.Helper.plist [Support]
	[running]	com.teamviewer.teamviewer_service.plist [Support]
	[not loaded]	com.vsearch.daemon.plist Adware! [Remove]
	[running]	com.vsearch.helper.plist Adware! [Remove]
	[running]	hdjsd.plist [Support]

User Launch Agents: ℹ️
	[running]	com.spotify.webhelper.plist [Support]

User Login Items: ℹ️
	iTunesHelper	UNKNOWNHidden (missing value)
	Spotify	Programm (/Applications/Spotify.app)

Internet Plug-ins: ℹ️
	JavaAppletPlugin: Version: Java 7 Update 71 Check version
	FlashPlayer-10.6: Version: 15.0.0.239 - SDK 10.6 [Support]
	QuickTime Plugin: Version: 7.7.3
	Flash Player: Version: 15.0.0.239 - SDK 10.6 Mismatch! Adobe recommends 16.0.0.235
	Default Browser: Version: 600 - SDK 10.10
	Silverlight: Version: 5.1.30514.0 - SDK 10.6 [Support]
	iPhotoPhotocast: Version: 7.0 - SDK 10.8

User internet Plug-ins: ℹ️
	ConduitNPAPIPlugin: Version: 1.0 - SDK 10.6 [Support]

3rd Party Preference Panes: ℹ️
	Flash Player  [Support]
	Java  [Support]

Time Machine: ℹ️
	Auto backup: YES
	Volumes being backed up:
		Macintosh HD: Disk size: 318.84 GB Disk used: 160.13 GB
	Destinations:
		DRIVE-N-GO [Local] 
		Total size: 499.76 GB 
		Total number of backups: 19 
		Oldest backup: 2013-12-25 15:50:45 +0000 
		Last backup: 2014-12-06 10:27:38 +0000 
		Size of backup disk: Adequate
			Backup size 499.76 GB > (Disk used 160.13 GB X 3)

Top Processes by CPU: ℹ️
	    43%	TeamViewer_Desktop
	    42%	WindowServer
	     3%	TeamViewer_Service
	     1%	launchd
	     1%	TeamViewer

Top Processes by Memory: ℹ️
	146 MB	softwareupdated
	121 MB	TeamViewer_Desktop
	86 MB	Finder
	69 MB	Safari
	52 MB	spindump

Virtual Memory Information: ℹ️
	362 MB	Free RAM
	1.28 GB	Active RAM
	945 MB	Inactive RAM
	1.22 GB	Wired RAM
	81.01 GB	Page-ins
	1.75 GB	Page-outs

Diagnostics Information: ℹ️
	Dec 10, 2014, 05:22:18 PM	Spotify_2014-12-10-172218_[redacted].hang
	Dec 9, 2014, 05:37:26 PM	com.apple.WebKit.WebContent_2014-12-09-1...crash
	Dec 9, 2014, 05:21:52 PM	Spotify Helper_2014-12-09-172152_[redacted].crash
         

Hallo,

Bitte Terminal öffnen:

Folgendes eingeben:

ls -al ~/Library/Launch* > ~/Desktop/Log1.txt && ls -al /Library/Launch* >> ~/Desktop/Log1.txt
         

ls -al ~/Library/Internet\ Plug-Ins > ~/Desktop/Log2.txt && ls -al /Library/Internet\ Plug-Ins >> ~/Desktop/Log2.txt
         

Es befinden sich nun zwei Textdateien "Log1.txt" und "Log2.txt" auf dein Desktop. Kopiere den Inhalt hierher.

Edit: hast du AdwareMedic ausgeführt? Siehe VSearch normalerweise wird es entfernt.