OFFICIAL SECURITY BLOG

We’ve moved! You can now read the latest and greatest on Mac adware and malware at Malwarebytes.

Adware Removal Guide : FkCodec

Published November 7th, 2013 at 4:02 PM EDT , modified November 9th, 2013 at 6:34 AM EDT

codecm-safari-extensionFkCodec (aka Codec-M), described in detail in OSX/FkCodec-A in action, was adware that pretended to be a video plug-in required to view a video on a deceptive web site. As such, it was identified as malware by many anti-virus programs, and I haven’t seen any reports of it being installed lately.

In May of 2013, the Genieo installer included code that was meant to download and install FkCodec. I never heard of anyone reporting FkCodec infections around that time, though.

In any case, FkCodec could still be in infrequent distribution, or could be on older systems. If you have found signs of FkCodec, remove it according to the following instructions.

Removal

Delete the Codec-M browser extension. (See Identifications > Examine Browser Extensions for instructions on how to locate your browser extensions.)

Move the following items to the trash. Note that, if you don’t know how to locate a file or folder based on the paths that I will give in the instructions, you should read Locating files from paths.

~/Library/Application Support/Codec-M
~/Library/LaunchAgents/com.codecm.uploader.plist
/Applications/Codec-M.app

You will need to restart the computer before you can empty the trash.

You may need to change the home page and search engine settings in your browser’s preferences.

<- Back to Adware Removal Guide