Here's what I see on my Add-On list. I really don't believe that "disabled" status.

I don't know if it is related but it looks as though this evening my daughter tried to install a game downloaded from PirateBay. Since then the home page and default search engine on our browsers on both our user accounts has been changed to 'isearch.whitesmoke...', affecting Chrome and Safari [but not Camino].

When I launched Firefox this evening I got a prompt that Codec-M wanted to install. It was located in the Home folder at /Library/Application Support/Mozilla/Extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}/{EEF73632-A085-4fd3-A778-ECD82C8CB297}. The creation date/time of the folder coincided with the Pirate download.

I hope this helps; this is my first experience of malware in 12 tears of Mac use. It looks as though the rogue plugin and the altered search engine/home page browser prefs are related but it would be good if someone could confirm this - it would also be good to know if there are any other components to get rid of.

I ran into a movie player telling me I needed to install the Codec-M 1.0.0.1 to watch the streaming movie. I have seen these Codec's before and did not notice the -M at the end of Codec until later. After I gave it the OK to install, I became immediately suspicious because there were two boxes asking me if I wanted to make Codec-M my browser homepage and the other if I wanted it to be a default for Firefox. The thing was, they were ALREADY Checked!!

So, thinking I was smart, I unchecked them (probably what saved me from an attack) Then I STUPIDLY clicked the "Install" button. It then asked to store the Install DMG into my firefox ADD-ONS!! ... where I "could always change its location later"!!! I KNEW this was malware NOW! But with no way out I told it to store the install/un-install DMG onto my desktop. Once it was there I opened it. There was indeed a install and a un-install there.

That was when a pop up notice came up and said something like "We recommended you install this into your Firefox as a default" or something like that. I don't remember all if it , for blood was shooting from my eyes, while trying to avoid a disaster at the same time.

Apparently they did not like it when I unchecked their pre-checked boxes then ignored their "ADVICE' and put the malware onto my desktop instead of in the Firefox browser. Whatever this thing is/was, it was certainly interested in gaining access to my browser, anywhere, anyhow!!

Luckily I have "Clean-My-Mac" software installed on my Mac and I immediately went to it and threw away the In/un-install DMG file by dragging it to the uninstall application section and clicking clean.

But that was the first step. Then I had to retrieve the Codec-M icon from my application folder and do the same thing. Lastly there was one more disc player icon labelled Codec-M that was also on my desktop and I dragged that to my Mac cleaner as well.

Needless to say I also had to change my master Id because its required to let them install their crap. I just hope that they did not squeeze anything through while I was unprotected!! ARRRRRGH!!

Hope this helps those who may have run into this imposter. First one I ever ran into in 6 years. I've had "Clean My Mac for 4 years and I use it to clean all sorts of unnecessary junk that collects in my system from time to time. I have also used it to get rid of apps I no longer want. I don't know if it does a thorough job like "APP-ZAPPER" but it zapps most of them and all the junk they leave behind.

Good Luck!

comment removed