How to get rid of spigot malware

[paul...@spamain'tkosher.oink]

This POS malware has infected my Chrome for Amazon. Hasn't infected my
Safari or Firefox, but Chrome is my default browser. The scumbags who
wrote it gave a removal option which of course doesn't work. I went
into my user>library>application support and found a spigot folder.
Trashed it and flushed it. Then rebooted the OS. Still there. Any
ideas?

[he...@att.net]

In article <1lsqt8k.ztstui1mwijxcN%paulfuchs@spamain'tkosher.oink>,

A quick search on <spigot malware mac> found this information:


Adware Removal Guide : Spigot
Published November 7th, 2013 at 5:42 PM EDT, modified September 22nd,
2014 at 6:37 AM EDT

CNET Safari extensionsSpigot is an adware company responsible for a
number of different adware programs. Recently, CNETšs Download.com site
has been brazenly wrapping a lot of Mac software in a CNET Installer
that also installs Spigotšs adware. (See Boycott CNETšs Download.com.)

Although this behavior on CNETšs part is despicable, and seems likely
to get them sued by multiple parties, the installer does inform the
user (if he/she actually reads the terms) of what will be done. I doubt
that Spigotšs adware will ever be detected as malware by anti-virus
software based only on this incident.

Removal
Delete all of the following browser extensions that you find: Searchme,
Slick Savings, Amazon Shopping Assistant, Ebay Shopping Assistant and
Domain Error Assistant. (See Identifications > Examine Browser
Extensions for instructions on how to locate your browser extensions.)
Not all of these may be present in all browsers.

Move the following items to the trash. Note that, if you donšt know how
to locate a file or folder based on the paths that I will give in the
instructions, you should read Locating files from paths.

~/Library/Application Support/Spigot/
You will also need to change the home page and search engine settings
in your browseršs preferences.

[Jolly Roger]

I think I would have tried their documented method first:

<http://www.spigot.com/about/contact-us/uninstall-spigot-mac-extensions/>

--
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[paul...@spamain'tkosher.oink]

Jolly Roger <jolly...@pobox.com> wrote:

> On 2014-09-29, paulfuchs@spamain'tkosher.oink
> <paulfuchs@spamain'tkosher.oink> wrote: > This POS malware has infected my
> Chrome for Amazon. Hasn't infected my > Safari or Firefox, but Chrome is
> my default browser. The scumbags who > wrote it gave a removal option
> which of course doesn't work. I went > into my user>library>application
> support and found a spigot folder. > Trashed it and flushed it. Then
> rebooted the OS. Still there. Any > ideas?
>
> I think I would have tried their documented method first:
>
> <http://www.spigot.com/about/contact-us/uninstall-spigot-mac-extensions/>

Maybe I should have been clearer in my OP. First I did use the
recommended procedure that Spigot offered in your link. Didn't work.
Next I spent at least an hour using Google (through Start Page)
searching for other removal procedures. I found the extensions in the
path I specified in my OP and trashed and flushed them. Then rebooted.
Still getting the damn thing. It pops up everytime I click in Amazon
and covers the bottom quarter of the Amazon screen. I then ran a global
finder search for anything containing the word "spigot" and then Amazon
(since Amazon is the only site affected). Came up with zero for spigot
and the Amazon results were all harmless. I guess I can do my Amazon
shopping with Safari but I hate to let these creeps infect my computer.
Furthermore, in my search, it was implied that the Spigot extensions
led to all sorts of rip-off theft problems beyond annoyance. So I was
hoping someone here had an idea I hadn't tried.

[Jolly Roger]

Perhaps there is a cookie stored in Chrome that is causing that
behavior. Try deleting any cookies you have for Amazon and related web
sites in Chrome.

[Barry Margolin]

In article <slrnm2ks8d....@amelia.local>,
Lewis <g.k...@gmail.com.dontsendmecopies> wrote:

> Okay, so one time? In band camp? paulfuchs@spamain'tkosher.oink
> <paulfuchs@spamain'tkosher.oink> was all, like:

> > Jolly Roger <jolly...@pobox.com> wrote:
>
> >> On 2014-09-29, paulfuchs@spamain'tkosher.oink
> >> <paulfuchs@spamain'tkosher.oink> wrote: > This POS malware has infected my
> >> Chrome for Amazon. Hasn't infected my > Safari or Firefox, but Chrome is
> >> my default browser. The scumbags who > wrote it gave a removal option
> >> which of course doesn't work. I went > into my user>library>application
> >> support and found a spigot folder. > Trashed it and flushed it. Then
> >> rebooted the OS. Still there. Any > ideas?
> >>
> >> I think I would have tried their documented method first:
> >>
> >> <http://www.spigot.com/about/contact-us/uninstall-spigot-mac-extensions/>
>
> > Maybe I should have been clearer in my OP. First I did use the
> > recommended procedure that Spigot offered in your link. Didn't work.
>

> What, exactly, didn't work? When you tell Safari to uninstall and
> extension, it uninstalls it. It cannot reënable itself.

>
> > Next I spent at least an hour using Google (through Start Page)
> > searching for other removal procedures. I found the extensions in the
> > path I specified in my OP and trashed and flushed them. Then rebooted.
>

> The fact that the extensions files were still on the hard drive does not
> mean they were active, but I am surprised they were still on the drive
> as I thought Safari did delete them on uninstall.

>
> > Still getting the damn thing. It pops up everytime I click in Amazon
> > and covers the bottom quarter of the Amazon screen. I then ran a global
> > finder search for anything containing the word "spigot" and then Amazon
> > (since Amazon is the only site affected). Came up with zero for spigot
> > and the Amazon results were all harmless. I guess I can do my Amazon
> > shopping with Safari but I hate to let these creeps infect my computer.
> > Furthermore, in my search, it was implied that the Spigot extensions
> > led to all sorts of rip-off theft problems beyond annoyance. So I was
> > hoping someone here had an idea I hadn't tried.
>

> Your browser doesn't have a way to disable an unwanted extension? Well,
> maybe you should stop using Firefox, because Safari and Chrome certainly
> allow you to remove extensions and, and here's the good part, do not
> allow extensions to load themselves.

The OP says "malware has infected my Chrome ... hasn't infected my
Safari or Firefox".

--
Barry Margolin, bar...@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***

[Daniel Cohen]

Try The Safe Mac adware removal tool at <http://www.thesafemac.com>.
It's basically an Applescript bundled as an application, and the
original Applescript is also available for download if you want to check
things rather than trust them.

--
<http://www.decohen.com>
The Labyrinth of the Heart: Changed Myths for Changing Lives
book and e-book <http://www.decohen.com/labyrinth.htm>
Send e-mail to the Reply-To address, not the From address.

[paul...@spamain'tkosher.oink]

Lewis <g.k...@gmail.com.dontsendmecopies> wrote:

> Okay, so one time? In band camp? paulfuchs@spamain'tkosher.oink

> <paulfuchs@spamain'tkosher.oink> was all, like: > Jolly Roger

> <jolly...@pobox.com> wrote:
>
> >> On 2014-09-29, paulfuchs@spamain'tkosher.oink
> >> <paulfuchs@spamain'tkosher.oink> wrote: > This POS malware has infected
> >> my Chrome for Amazon. Hasn't infected my > Safari or Firefox, but
> >> Chrome is my default browser. The scumbags who > wrote it gave a
> >> removal option which of course doesn't work. I went > into my
> >> user>library>application support and found a spigot folder. > Trashed
> >> it and flushed it. Then rebooted the OS. Still there. Any > ideas?
> >>
> >> I think I would have tried their documented method first:
> >>
> >> <http://www.spigot.com/about/contact-us/uninstall-spigot-mac-extensions
> >> />
>
> > Maybe I should have been clearer in my OP. First I did use the
> > recommended procedure that Spigot offered in your link. Didn't work.
>

> What, exactly, didn't work? When you tell Safari to uninstall and
> extension, it uninstalls it. It cannot reënable itself.

I don't have a problem with this malware in Safari, the problem is in
Chrome.

>
> > Next I spent at least an hour using Google (through Start Page)
> > searching for other removal procedures. I found the extensions in the
> > path I specified in my OP and trashed and flushed them. Then rebooted.
>

> The fact that the extensions files were still on the hard drive does not
> mean they were active, but I am surprised they were still on the drive as
> I thought Safari did delete them on uninstall.

I manually put them in the trash, flushed them, and rebooted the Mac. >

> > Still getting the damn thing. It pops up everytime I click in Amazon >
> and covers the bottom quarter of the Amazon screen. I then ran a global >
> finder search for anything containing the word "spigot" and then Amazon >
> (since Amazon is the only site affected). Came up with zero for spigot >
> and the Amazon results were all harmless. I guess I can do my Amazon > >
shopping with Safari but I hate to let these creeps infect my computer.
> > Furthermore, in my search, it was implied that the Spigot extensions >
> led to all sorts of rip-off theft problems beyond annoyance. So I was > >

hoping someone here had an idea I hadn't tried. > > Your browser doesn't
have a way to disable an unwanted extension? Well, > maybe you should
stop using Firefox, because Safari and Chrome certainly > allow you to
remove extensions and, and here's the good part, do not > allow
extensions to load themselves.

I chose to diable them by removing and flushing them. But I still get
this Spigot crap in Amazon with Chrome.

[paul...@spamain'tkosher.oink]

Well, I have given up. I cannot find where the Spigot shitheads hid the
extension in Chrome that activates their garbage in Amazon. But that is
not surprising because I am a total amateur when it comes to such
things. Chrome is my default browser and I am reluctant to remove all of
its extensions for obvious reasons. The extension is probably hidden
somewhere inside of the user>google>chrome folder as some meaningless
named file like fkhsgduufghgksbvffg. Rather than screwing up my default
browser, I will just do Amazon in Safari. But it still really pisses me
off.

[Jolly Roger]

On 2014-10-07, paulfuchs@spamain'tkosher.oink <paulfuchs@spamain'tkosher.oink> wrote:
>
> Well, I have given up. I cannot find where the Spigot shitheads hid the
> extension in Chrome that activates their garbage in Amazon. But that is
> not surprising because I am a total amateur when it comes to such
> things. Chrome is my default browser and I am reluctant to remove all of
> its extensions for obvious reasons. The extension is probably hidden
> somewhere inside of the user>google>chrome folder as some meaningless
> named file like fkhsgduufghgksbvffg. Rather than screwing up my default
> browser, I will just do Amazon in Safari. But it still really pisses me
> off.

Do you not recall being told that there are probably *cookies* causing
this behavior? Did you not try deleting all Amazon cookies from Chrome?