Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

Trying to Uninstall Codec-M: the Mac variant of Codec-C


I'm running Firefox 10.0.2 on a Mac running OS X 10.6.8. Last week I made a bad mistake, and allowed "Codec-M" to load on my computer. This appears to be the Mac version of Codec-C.

It installed into Firefox as an Add-On. It's visible in the Firefox>Preferences>Manage Add-ons page, however there is no remove button, so I became suspicious.

I've found it's not where it should be. I opened the Firefox bundle in my user account and it's not in the Extensions folder.

The Firefox>Help>Troubleshooting Information gave me its ID, which is "{EEF73632-A085-4fd3-A778-ECD82C8CB297}". This appears on NO file on my hard-drive by a simple search, so whatever this thing is it's gone to ground. It's listed as being disabled, but with the other details considered, I don't trust that.

I used the instructions at "https://support.mozilla.org/en-US/kb/Troubleshooting%20plugins#w_manually-uninstalling-a-plugin", exposed my plug-in paths, went to About:plugins and it doesn't appear in the list. All the other ones do, but it is not listed.

I tried going to the Global Firefox folders, but there's nothing in there either.

I'd appreciate some help. It might be coincidence, but my internet has been running VERY slow since this started, and I'm worried about my personal info.

How do I force this thing off my Mac?

Additional System Details

Installed Plug-ins

  • The QuickTime Plugin allows you to view a wide variety of multimedia content in web pages. For more information, visit the QuickTime Web site.
  • DivX Plus Web Player version
  • DivX VOD Helper Plug-in
  • Java Plug-In 2 for NPAPI Browsers
  • Shockwave Flash 10.3 r183
  • iPhoto6


  • User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:10.0.2) Gecko/20100101 Firefox/10.0.2

More Information

codec-M false {EEF73632-A085-4fd3-A778-ECD82C8CB297}

Question owner

Here's what I see on my Add-On list. I really don't believe that "disabled" status.

jjamjar 0 solutions 1 answers

Helpful Reply

I don't know if it is related but it looks as though this evening my daughter tried to install a game downloaded from PirateBay. Since then the home page and default search engine on our browsers on both our user accounts has been changed to 'isearch.whitesmoke...', affecting Chrome and Safari [but not Camino].

When I launched Firefox this evening I got a prompt that Codec-M wanted to install. It was located in the Home folder at /Library/Application Support/Mozilla/Extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}/{EEF73632-A085-4fd3-A778-ECD82C8CB297}. The creation date/time of the folder coincided with the Pirate download.

I hope this helps; this is my first experience of malware in 12 tears of Mac use. It looks as though the rogue plugin and the altered search engine/home page browser prefs are related but it would be good if someone could confirm this - it would also be good to know if there are any other components to get rid of.

Sobrenity 0 solutions 1 answers

Helpful Reply

I ran into a movie player telling me I needed to install the Codec-M to watch the streaming movie. I have seen these Codec's before and did not notice the -M at the end of Codec until later. After I gave it the OK to install, I became immediately suspicious because there were two boxes asking me if I wanted to make Codec-M my browser homepage and the other if I wanted it to be a default for Firefox. The thing was, they were ALREADY Checked!!

So, thinking I was smart, I unchecked them (probably what saved me from an attack) Then I STUPIDLY clicked the "Install" button. It then asked to store the Install DMG into my firefox ADD-ONS!! ... where I "could always change its location later"!!! I KNEW this was malware NOW! But with no way out I told it to store the install/un-install DMG onto my desktop. Once it was there I opened it. There was indeed a install and a un-install there.

That was when a pop up notice came up and said something like "We recommended you install this into your Firefox as a default" or something like that. I don't remember all if it , for blood was shooting from my eyes, while trying to avoid a disaster at the same time.

Apparently they did not like it when I unchecked their pre-checked boxes then ignored their "ADVICE' and put the malware onto my desktop instead of in the Firefox browser. Whatever this thing is/was, it was certainly interested in gaining access to my browser, anywhere, anyhow!!

Luckily I have "Clean-My-Mac" software installed on my Mac and I immediately went to it and threw away the In/un-install DMG file by dragging it to the uninstall application section and clicking clean.

But that was the first step. Then I had to retrieve the Codec-M icon from my application folder and do the same thing. Lastly there was one more disc player icon labelled Codec-M that was also on my desktop and I dragged that to my Mac cleaner as well.

Needless to say I also had to change my master Id because its required to let them install their crap. I just hope that they did not squeeze anything through while I was unprotected!! ARRRRRGH!!

Hope this helps those who may have run into this imposter. First one I ever ran into in 6 years. I've had "Clean My Mac for 4 years and I use it to clean all sorts of unnecessary junk that collects in my system from time to time. I have also used it to get rid of apps I no longer want. I don't know if it does a thorough job like "APP-ZAPPER" but it zapps most of them and all the junk they leave behind.

Good Luck!

joeyg331 0 solutions 1 answers

comment removed

Modified by joeyg331