The Safe Mac

Follow The Safe Mac on Twitter to stay advised of the latest Mac security news!


Vidx adware pretends to be video plugin

Posted on May 23rd, 2014 at 8:55 PM EDT

e-biohazard

Something called Vidx has been teasing me for a little while now, with some tantalizing hints but no concrete leads. Today, one of my colleagues pointed me to a website where it can be downloaded. I’ve spent quite a bit of time playing with it today, and it isn’t much different from other adware, except for one particular trick.

Vidx siteThe site itself clearly advertises the software as a video plugin, with the implication that it can play popular formats such as DivX, WMV and AAC. In reality, it provides no such functionality. The download does not actually install any internet plugins, which typically provide such functionality. Just to be sure, I tried loading some videos both with and without the Vidx software installed, and there was no difference between the two.

Downloading and installing is quick and easy. The installer requires no license agreements or user interaction… which also means there’s no chance to change your mind after you tell Mac OS X to allow the app to open.

The app installs a copy of itself in the Applications folder (which does nothing other than install the software again), as well as browser extensions in Safari, Firefox and Chrome. Interestingly, when I installed it the first time, it did not actually install the Safari extension. It could be found on my system, downloaded into a hidden temporary folder alongside the components of the Firefox and Chrome extensions, but it was not actually installed. Running the Vidx app in the Applications folder installed the Safari extension.

Two different Safari extensions were seen, although they appeared to be identical once installed. One file was called Vidx.safariextz, while the other was simply called extension.safariextz. (The latter has also been teasing me for a couple months, as I’ve seen reports of this suspiciously-named file being on people’s Macs, but had never gotten concrete details until now.)

Vidx FirefoxOddly, each time the installer runs, another copy of the extension is added to Firefox and Chrome. Each time, the extension is given a name that is a slight variation on the Vidx name. At left, some (though not all by any means) of those variations can be seen installed in Firefox, after running the Vidx app seven times. This may not seem like a realistic scenario, but keep in mind that the app doesn’t appear to do anything, and it would not be uncommon for someone to try opening it multiple times, not being sure why it didn’t appear to open.

The only reason I can think of for this behavior is to make automated removal difficult. If the name is different each time, it makes it harder for any kind of automated script or app, such as my own Adware Removal Tool, to remove it from the system.

If you have fallen for this scam, you should remove it immediately. Remove any browser extensions named anything similar to Vidx, and if you see a Vidx app in your Applications folder, throw it in the trash. For more information, see the Vidx page of my Adware Removal Guide, or use my Adware Removal Tool to delete all the components automatically.

If you have a Web of Trust account, you can help to get this site flagged as malicious by rating the site here:

https://www.mywot.com/en/scorecard/supervidx.com

Tags: ,


30 Comments

  • MadMegan says:

    THank you I love you you saved my internet life :)

  • DEVON says:

    I’M PRETTY SURE YOU SAVED MY SAFARI!!! THIS IS EXACTLY THE CURE! EVERYTHING IS GONE!

  • Britta says:

    Vielen, vielen Dank Dir! :) Ich war am Verzweifeln, was mit meinem Safari los ist, immer hat sich Werbung geöffnet und ich konnte es mir nicht erklären, habe endlos gesucht. Und das auf meinem iMac, der doch gegen Malware nicht so empfindlich ist.

  • David O. says:

    Your website, Adware Removal Tool, and suggestions for Firefox worked great to solve the annoying vidx adware problem on my Mac. Everything is back to normal. Thank you and I will recommend to others.

  • Profdesmondfreeman says:

    Thank you so much this insidious piece of deception was driving me insane! Simply removing it from my list of applications made no difference. Very glad to see the back of it.

    • Sani says:

      Hiya! Many thanks for wriintg this kind of an unusual blog post. Really you could have mentioned those subjects the opposite way round. But you provided it a wonderful very own spin. Looking foward to going to your web site more regularly.

  • Steve_SamueL says:

    Do you have one of these for windows.
    It worked for my mac and now my windows computer is having the same problem
    thanks so much :P

  • @elias says:

    I’m running your latest removal Tool but actually I’ve not had vidx installed. The Tool delete the Feedly Add-On from Firefox, Safari and Chrome declared as VidX ?

    Also using etrecheck and searching tools but nothing get about vidx.

    Many thanks for this wonderful software

    • Thomas says:

      So, am I understanding correctly that it deleted a legit Feedly add-on and called it Vidx? If so, I’ll have to investigate that!

      • @elias says:

        I have backed up the folder from trash declared as Vidx. If you want I send you an zip-folder with the contents for investigation – send an email please or PM over my Account: https://discussions.apple.com/people/%40elias

        Another point was (I don’t know why) the tool remove the prefs from Firefox and Chrome. If I set Chrome to sync ma Favourites, after using the tool I was not able to connect to the Google Sync-Server. What happen cannot made out. I use a backup from the past and the runs again.

        • Thomas says:

          I found the problem… version 14 of the Adware Removal Tool fixes the issue. The “signature” string I was searching for to identify Vidx was a little too simple, and matched some of the content of that add-on. The Vidx signature is more specific now.

  • Roy Behymer says:

    I’ve already discovered the VIDX plugin on my Mac with a number of sites that were previously free of popup ads, now totally infected with them. Removing the plugins did stop that behavior. Just be aware that once you’ve seen those popup ads, you are likely to see a sudden increase in spam email. Just shortly after discovering and deleting the Vidx plugin, I started to see an increase in spam emails. I normally don’t receive more than about 15-20 emails total in a day. I’m now seeing almost twice that in spam alone. One thing many have in common is some variation on the phrase “Cant see our A.D as pics are invisible? Go ahead and visit right here to fix.” I’m usually extremely cautious with surfing, so my spam count is normally exceptionally small and I know better than to trust these new emails. I will not be clicking and visiting to fix. I’m probably going to have to close that email address and open a new one to stop the sudden spam influx. Big hassle, having to contact those who should have my address or changing account info at various sites. Just thought folks should have a heads-up on what they can expect if they run the Vidx app.

    • Thomas says:

      If removing Vidx extensions from your web browser didn’t fix it, you probably have other adware installed. These things often piggyback together. I’ve seen as many as four installed by a single installer. See my Adware Removal Guide to search for and remove the rest.

  • devonaugusta says:

    Thank you so much for your blog and your Adware removal tool. I have been plagued by an awful adware, and despite my best attempts to find the problem, wasn’t able to do so manually. Your’s did the trick though, so thank you for all the work you’ve put into identifying these awful programs.

  • Ciera says:

    You are awesome! I was scared downloading it. But it worked!

  • Grace says:

    Thanks for your tips. It worked for me. I had Vidx in my apps and as extension in Firefox. Seems to be gone now. All working great again.. Still going to change my passwords though just in case!
    Blessings!

  • Leona says:

    Thank you so, so much for the removal of the adware tool. I’m normally incredibly cautious when it comes to signing up \\ downloading things and this one (Vidx) caught me off guard. Very annoying application and really happy your software worked. Everything has been removed. It’s great to see people like you creating applications like this.

  • Dan says:

    First off, thank you so much for developing and releasing your addware removal tool! It really made my life much better when I downloaded the Vidx “video converter” app. I followed your steps and got rid of the file extensions (actually, I only had a handful, so I just bagged the whole lot), and then ran your removal tool and my problem was solved.

    Since you have some familiarity with this nasty little bit of addware I thought I bounce my remaining problem off of you. Although the addware appears to be gone (Safari is functioning normally), the Vidx app icon still appears in my launch pad. When I try to drag the icon to the trash, that little sucker just zips right back up onto the screen. Needless to say, I haven’t tried to open the app, as I suspect doing so will just get me back to where I started.

    Do you have any ideas as to how to actually remove the app from launch pad? Your article didn’t seem to address this particular problem. Or, if it did, I was just to dense to realize it.

    • Thomas says:

      There should be a Vidx app in the Applications folder, but the Adware Removal Tool should have removed that. Check to make sure the app isn’t still there, and if it is, drag it to the trash.

      I’m unclear on where the icon is… when you say “launch pad,” do you actually mean the LaunchPad, or do you mean the Dock on the bottom of the screen? If it’s on the Dock, drag it off the Dock, then wait until a little “cloud” icon appears below the cursor. When that happens, let go and it will be removed from the Dock. (Deleted apps don’t get removed from the Dock automatically.) If it’s on the LaunchPad, it should be removed once the app is deleted. If it isn’t, you may need to restart the computer to force the LaunchPad to update.

    • Dan says:

      Oh, I should add, I examined all of the libraries listed in the add ware removal guide. I only had 2 files that showed up. One was a Microsoft office file, and the other was an adobe file.

      • Thomas says:

        I’m not sure what files you removed, as there are no Microsoft Office or Adobe files listed in the Adware Removal Guide…?

  • Dan says:

    Just saw your reply as I posted my last– sorry. When I say launch pad I am referring to the launch pad icon in the tray. I click the launch pad icon in the tray, up pops all of my apps (contacts, iPhoto, etc… ) and that darn vidx icon is still there. If I go to finder–>applications there is no Vidx file to delete.

    • Thomas says:

      You can’t delete things from the LaunchPad by dragging to the trash. In fact, the only apps you can remove from within the LaunchPad are apps from the App Store. All other apps should be removed other ways. Did you see the Vidx app in the Applications folder, or is it not there? Did you try restarting?

      • Dan says:

        Nah… not in the applications folder, not that I can find, at least….

        Screen shots found here https://discussions.apple.com/message/26292453#26292453

        This little bugger had buried itself, somewhere…….darned if I can figure our where….

        Again, your removal tool got me squared away… but I want to get this dang thing off of my my computer

        • Thomas says:

          That’s the icon for the installer, which is probably still lurking in your Downloads folder or somewhere similar. The script doesn’t remove that, because it could be in a wide variety of places. If you can’t figure out where it is, try searching for the name of that app in Spotlight.

    • Dan says:

      Oh, and as per your suggestion, I am cross posting to the Apple support community. I started a thread in the “Safari section. The post includes screen shots of my launchpad screen, and my finder—> applications screen. I should have mentioned earlier that although Vidx does show up on my Launchpad applications, it does not appear in my finder–>applications.

  • Anika says:

    Thank you SO SO SO MUCH!!! Extremely easy to use and a life saver!! God bless you :)

  • Relda Mara says:

    Hey, thank you for sharing. These Vidx were annoying me for couple weeks and you set me free, haha!
    From Brazil, greetings.

  • Michael E. Hensley says:

    I have been fighting AD crap the past 5 days due to something that snuck in with Adobe Flash. NOW!! thanks to you It is All Gone.

This post is more than 90 days old and has been locked. No further comments are allowed.

This page and all contents (unless otherwise noted) copyright 2011-2014 by Thomas Reed.
For questions or comments, please contact me.