Remove adware from Mac OSX Safari, Chrome, Firefox [November 2018]




Updated: November 2018 – Big update, updated the manual removal instructions


mac remove malwareSince adware is big business. Adware and Potentially Unwanted Program (PUPs) publishers have found their way to Mac OS. Specifically, the Mac OS browsers, Safari, Google Chrome, and Mozilla Firefox.

In our search for adware and Mac OS malware, we found lots of new adware applications for Mac OS in 2016, 2017 and recently 2018. For what we have seen at the end of 2017 and mid/end 2018 is that Mac OS malware is emerging to social engineering. Since Mac OS is a very secure operating system, cybercriminals deceive users into downloading viruses, adware and in some recent cases even Ransomware. Social engineering using adware and potentially unwanted programs (PUPs) is the most common way for a Mac OS system to get infected. Below you’ll find a list of known Mac OS adware and malware.

known Mac OS malware:
Codec-M, FkCodec, Yontoo, Torrenthandler, ClickAgent, Fake Flash Player installations, ChatZum, Conduit, MyBrand, Trovi, Search Protect, SP, Searchme, Slick Savings, Amazon Shopping Assistant, Ebay Shopping Assistant, Domain Error Assistant, Set Search Settings, Searchtab, GoPhoto.it, Omnibar, GoldenBoy, Texiday, Listchack, InKeepr, Nariabox, Celipsow, savekeep, saVe keeep, suave keepo, jollywallet, Vidx, Viddxx, Vidox, Viidax, ViiDDx, MacVX, MacVaX, MacCaptain, MacPriceCut, SaveOnMac, Mac Global Deals or MacDeals, MacSter, MacXcoupon, Shop, Brain, SShoP Braaiin, MacMin, MaucMino, VidX, Awesome Screenshot, Shopy Mate, PalMall, FlashMall, Cinema-Plus Pro, Search App by Ask, MacShop, MacSmart, News Ticker Remover, Shopper Helper Pro, Photo Zoom, Best YouTube Downloader, ArcadeYum, Extended protection, Video, Download helper, FlashFree, RecipeHub, iLivid, CustomSearchForSafari, Media Player, MusixLib, GoMovix, MovixHub, AdBlock Super, Webpage, Screenshot, NewTabTV, WalletBee, PremierOpinion, Opti-Page, Toppy, Shoppy, CrossRAT, Mac OS Cryptominers, ColdRoot

What does adware on Mac OS do?

Mac adware displays pop-up advertisements, inline-text, and audio advertisements. Adware for Mac is also known to cause browser redirects to suspicious download sites or dangerous technical support web pages, these support web pages pretend to work for Apple Support. In reality, these web pages are scams to deceive users into buying an expensive support contract with false claims. Tech Support web page state your mac is infected with a virus and a service telephone number should be called to remove the virus from your Mac. Read more on tech support scam pages.

Adware is built for revenue, adware serves all sorts of websites by redirecting the browser to a specific ad. Adware is also known to hijack the browsers default homepage and search engine. All the web browser traffic is then redirected using the by adware installed browser hijacker.

MacOS adware is not to be found keylogging, spreading itself throughout your network or infecting system files. Adware is known to collect both personally and non-personally identifiable information (PII) for the Mac and browser. The information collected by adware (not limited to): your IP address, your current location, which is based on the internet providers IP-address, your default installed internet browser, device screen size, Mac system version and even the web-browser history.

All this information is sold for marketing purposes. Some suspicious adware applications have information about how they handle and collect the gathered information in an end user license agreement. However, no one reads the EULA and accepts the EULA by default upon installation.

How to prevent adware on a Mac?




Adware for Mac OS usually installs itself together with other software applications downloaded from the internet. This technique is called bundling and the downloaded software is known as pay per install software. Pay per install software is a monetizing tool for software developers. The software developer gets paid for every new software e.g. adware installation. These pay per install services are abused by many web pages that offer free software. Pay per install software is most likely responsible for the adware infection on a Mac.

The Mac user should be aware of what is downloaded from the internet. Clicking the custom or advanced button during installation can reveal what kind of applications are installed on the Mac during installation. Uncheck any software you do not wish to install.

By paying attention to the installation details during a software installation, the Mac user might prevent the installation of adware or any other potentially unwanted program.

Example: Mac adware installer

Mac OS Example of a Per Per Install Mac OS adware programLook carefully, clicking the Accept button ends in a replacement of your default homepage with Yahoo Search and installs a Safari extension named “Search-Assist”.

This is an example of a download manager that offers additional software for revenue during installation.

To prevent the installation of additional software, select the advanced button (see image) and uncheck or opt out the quick installation button.

By doing so you have the change to deny any third party software installations.

Example: Fake Mac OS virus pop-up

Mac os fake virus scam popup

pop-ups such as the Apple support scam picture on the right are deceptive and triggered by adware applications installed on a Mac. There are many different kinds of pop-ups, some adware programs redirect the browser to shopping sites, gambling sites etcetera.

Adware for Mac OS is specifically designed to create income for its publisher. Browser redirects are designed to sell products, make you click on a pay per click ad or provide personal information for marketing purposes.

If you experience any of the following, your browser homepage has changed without your permission or many intrusive pop-up advertisements are shown. I recommend removing any malware from your Mac using these comprehensive Mac malware removal instructions. Please, follow all steps to completely clean and optimize your Mac.

Remove adware from Mac OSX Safari, Chrome or Firefox

This web page offers malware removal tools to clean your Mac from any malware. In the chapter manual removal instructions, I have created a two-step instruction to successfully clean your Mac.

Option 1 – Remove adware from Mac with tools

Combo Cleaner for macCombo Cleaner to Clean your Mac from Viruses, Junk, and Unwanted Software
CleanMyMacRemove Malware from your Mac with CleanMyMac X
Malwarebytes for macScan your Mac for Adware and Potentially Unwanted Programs with Malwarebytes for Mac

Option 2 – Manually remove adware from Mac

computer_icon_32Step 1 – Remove AdminPrefs profile
uninstall adware macStep 2 – Uninstall adware applications on Mac
remove adware safari macStep 3 – Remove adware from Safari on Mac
remove adware chrome macStep 4 – Remove adware from Google Chrome on Mac
remove adware firefox macStep 5 – Remove adware from Firefox on Mac

 

Combo Cleaner – Clean your Mac from Viruses, Junkware and Uninstall Unwanted Applications

Combo Cleaner is the utility toolkit to optimize and protect your precious Mac against malware, viruses, adware and potentially unwanted programs. Combo Cleaner is a professional Mac antivirus with hourly malware, viruses, and adware definition updates.

Combo Cleaner provides the following features, a Disk Cleaner, remove big files and find duplicate files using its comprehensive scanner to save gigabytes of valuable disk space. Combo Cleaner also has a Privacy shield that eliminates various information stored when browsing the Internet. It's the all in one security solution for your Mac.

Download Combo Cleaner

  • Download Combo Cleaner.
  • Double-click the downloaded file.
  • In the opened window drag and drop the Combo Cleaner icon onto the Mac application's icon.

install combo cleaner

  • Open Launchpad and click on the Combo Cleaner icon.
  • Wait until the antivirus engine downloads it's virus definition updates.

combo cleaner updating virus definitions

  • Click "Start Combo Scan”.

combo cleaner start virus scan

cleanmymac xUninstall Adware from Mac with CleanMyMac X

uninstall mac mechanic from mac

Remove adware & malware with CleanMyMac X!

CleanMyMac is incredibly easy to use, including a powerful scanner that digs up all the junk, adware and viruses on your Mac. Smart One click cleaning with health alerts to keep your Mac protected. CleanMyMac will clean the Mac system from suspicious adware applications, optimize and protect the Safari, Google Chrome, and Firefox browser. Recommended for any Mac user!

Download Now

 

Open the Uninstaller tab in the left menu, search for adware applications and click the Uninstall button.

Adware slows down your Mac considerably by showing intrusive ads on your Mac and in the Safari browser. CleanMyMac X Optimization takes care of this problem.

Open the Optimization tab in the left menu and click View all items to optimize your Mac.

cleanmymac x

After that optimization, you should perform a Smart Scan. In the left menu click Smart Scan at the top to completely clean your Mac and remove any adware, malware or viruses.

cleanmymac x smart scan

malwarebytes logoRemove Adware from Mac with Malwarebytes


Malwarebytes for Mac is a free tool that scans for and removes threats that attack your system or your data, introduce unwanted behaviors, and degrade performance. Making your Mac, once again, your Mac.

Malwarebytes for Mac

Before installing Malwarebytes for Mac you need the following specifications, MacOS 10.10 or higher and a working internet connection for product and malware definition updates.
Hardware specifications; Core 2 Duo CPU or faster with 2 GB RAM, 40 MB free hard disk space and an 800x650 minimum screen resolution.

Download Now

Install Malwarebytes for Mac, follow installation instructions. After installation turn on protection.

malwarebytes mac - turn on protection

In order to protect your Mac against malware, Malwarebytes wants to install a system extension. Click the "Open Security Preferences" button to allow Malwarebytes.

malwarebytes mac - allow system extension

In the "Security & Privacy" settings on your Mac, click Allow to install Malwarebytes properly.

malwarebytes mac - allow security settings

Malwarebytes is successfully installed and activated for a 30-day trial license including real-time protection.
Click Done to continue.

malwarebytes mac - activation complete

In the Malwarebytes dashboard, click "Scan now" to launch a malware scan on your Mac. The time it takes to perform a malware scan with Malwarebytes is around 1-2 minutes for Mac.

malwarebytes mac - scan now

In the scan overview, you see a summary of the malware found by Malwarebytes on your Mac. Click "Confirm" to start the malware removal on your Mac.

malwarebytes mac - remove threats

Malwarebytes wants to reboot your Mac to complete the removal process, reboot your Mac. The malware is now removed from your Mac and the Mac is protected against future adware and malware infections.

Malwarebytes for Mac Features

Cleans infected Mac from Adware, Potentially Unwanted Programs and malware such as Ransomware (yes, it exists for Mac), Spyware, Viruses. Prevents Mac virus, spyware, and malware infections from drive-by infections or Pay Per Install download managers.

Proactively blocks adware and unwanted programs from infecting you Mac and Browser. No more toolbars, pop-up redirects and browser hijackers. Update to the latest Malwarebytes protection automatically. The latest updates are protecting your Mac computer daily from the newest infections. Free and fully to use 30 days trial in the premium license. Malware removal is always free with Malwarebytes for Mac.

computer_icon_32Manually remove adware from Mac

If you experience unwanted homepage or search engine changes in the Safari, Google Chrome or Firefox browser on a Mac, you should check the Mac and web browser for unknown browser extensions. Browser extensions integrate with the browser, which is often a good thing.

However, some browser extensions cause unwanted changes such as a new homepage, new tab, search engine. If you experience anything of the following below, check the browser extensions in the web browser on Mac and remove any extension you do not know.

  • The Safari homepage, search engine or new tab is changed without your approval.
  • In-text advertisement, such as “Ads by”, “powered by” on random web pages.
  • Unknown pop-ups that redirect to even more suspicious web pages in Safari.

 Remove adware from Mac

The preferences to check is the AdminPrefs profile.

Click the Apple icon in the top left corner. Open System Preferences, search for a setting “Profiles” and find a profile called AdminPrefs, click the “-” button to remove the administrator profile. Adware is known to install a fake administrator profile to prevent users from changing web browser settings.

 adminprefs mac profile

 Uninstall adware applications (malware from Mac)

Click on the Finder icon in the Mac menu bar, in the left quick-menu click on Applications. Click on Date modified and sort installed applications on Mac by date. Find any recently installed applications that are unknown to you and move the application to the trash bin.

mac adware applications removal

the image is an example!

 

Continue to the next steps.

Click on the Finder icon in the Mac menu bar, in the top of your screen click on Go and Go to Folder.
Enter the following text in the text-box: /Library/LaunchAgents

launchagents mac

In the LaunchAgents folder, click on Date modified and sort LaunchAgents by date. Check the recently added LaunchAgents and remove the LaunchAgent by selecting it and move the files to the trashcan.

remove launchagents mac

Close the LaunchAgents folder.

Click on the Finder icon in the Mac menu bar, in the top of your screen click on Go and Go to Folder.
Enter the following text in the text-box: /Library/Application Support

Application Support folder mac

In the Application Support folder, click on Date modified and sort Application folders by date. Check the recently added Application folder(s) and remove the Application folder by selecting it and move the files to the trashcan.
You may need to provide the administrator password to move the application folder to the trash.

application support folder mac

Close the Application Support folder.

Click on the Finder icon in the Mac menu bar, in the top of your screen click on Go and Go to Folder.
Enter or copy-paste the following text in the text-box: ~/Library/LaunchAgents

library launchagents mac

In the LaunchAgents folder, click on Date modified and sort LaunchAgents files by date. Check the recently added LaunchAgents files and remove the LaunchAgents file by selecting it and move the files to the trashcan.
You may need to provide the administrator password to move the .plist file(s) to the trash.

adware launchagents mac

Close the LaunchAgents folder.

Click on the Finder icon in the Mac menu bar, in the top of your screen click on Go and Go to Folder.
Enter or copy-paste the following text in the text-box: /Library/LaunchDaemons

launchdaemons folder mac

In the LaunchDaemons folder, click on Date modified and sort LaunchDaemons files by date. Check the recently addedLaunchDaemons files and remove the LaunchDaemons file by selecting it and move the files to the trashcan.
You may need to provide the administrator password to move the .plist file(s) to the trash.

launchdaemons files mac

Continue to the next step to remove adware from the Safari web browser.

safari logo Remove an unwanted homepage, search engine, new tab or advertisements from Safari

Open the Safari web browser on your Mac. In the top left corner click on Safari and select Preferences from the menu.
Open the General tab and change the following settings.

Remove an unwanted homepage from Safari

Safari opens with: A new window
New windows open with: Homepage
New tabs open with: Favorites
Homepage: enter a homepage of your choice.

safari homepage settings

Remove an unwanted search engine from Safari

Open the Search tab and change the search engine to Google, Yahoo, Bing or DuckDuckGo.

safari mac search engine settings

Remove an adware browser extension from Safari

Open the tab Extensions and remove all extension you don’t know or need with the Uninstall button.
Helpertips, Chill-Tab or PlayerWeb are examples of malicious adware – Safari browser extensions, your installed extensions list in Safari may look different.

safari rogue extensions

Do you still experience adware, unwanted advertisements or any malware application after this step?
Perform an adware scan with Malwarebytes to remove the adware left over from your Mac computer.

chrome mac Remove an unwanted homepage, search engine, new tab or advertisements from Google Chrome on Mac

Some adware installs in the Google Chrome web browser on Mac, most often as a browser extension. In this step, I show you how to remove the browser extension from Google Chrome and how to reset your homepage, new tab or search engine to one of your choice.

Remove an adware browser extension from Google Chrome on Mac

First, we need to remove any adware browser extension that might be installed in Google Chrome. Some extension prevents users from reverting the homepage, search engine or new tab as these extensions are controlling the homepage, new tab or search engine settings.

Open Google Chrome, in the right top corner in Chrome, click on the three vertical dots (menu). Expand the menu and click More Tools > Extensions.

chrome mac open extensions

In the extensions panel, search for any unknown browser extension and remove the extension(s) with the Remove button. If you have installed any browser extensions in Chrome on Mac remove all extensions listed.

extensions google chrome mac

Reset homepage or new tab in Google Chrome for Mac

Goto the Google Chrome settings, scroll down to “On Startup”. Select Open The New Tab page or Open a specific page or set of pages and enter a homepage URL of your choice in the add a new page field. Save settings.

chrome mac open new tab

Reset search engine in Google Chrome for Mac

In the Google Chrome settings, find “Search engine” and open Manage search engines settings.

chrome mac manage search engine settings

Find the search engine you would like to set as default e.g. Google, Google search engine will replace the unwanted search engine.

chrome search engine settings mac

Click on the three vertical dots on the right next to the malicious search engine and click Remove from list.

remove search engine chrome mac

Do you still experience adware, unwanted advertisements or any malware application after this step?
Perform an adware scan with Malwarebytes to remove the adware left over from your Mac computer.

firefox mac Remove an unwanted homepage, search engine, new tab or advertisements from Firefox on Mac

Some adware installs in the Mozilla Firefox web browser on your Mac, most often as a browser extension. In this step, I show you how to remove the browser extension from Firefox and how to reset your homepage, new tab or search engine to one of your choice.

Remove an adware browser extension from Firefox on Mac

First, we need to remove any adware browser extension that might be installed in Firefox. Some extension prevents users from reverting the homepage, search engine or new tab as these extensions are controlling the homepage, new tab or search engine settings.

Open Mozilla Firefox, in the right top corner in Firefox, click on the three horizontal stripes (menu) and expand the menu and open Add-ons.

firefox mac open menu

In the add-on (extensions) panel, search for any unknown browser extension and remove the extension(s) with the Remove button. If you have installed any browser extensions in Firefox on Mac remove all extensions listed.

adware extensions firefox

Reset homepage or new tab in Firefox for Mac

In the Firefox Preferences, on the left click on Home. Change Homepage and new windows to “Firefox Home (Default)” or “Custom URL” and enter the homepage of your choice. Also change the New tabs to “Firefox Home (Default)” or “Blank Page”.

firefox homepage settings mac

Reset search engine in Firefox for Mac

In the Firefox preferences, click on Search in the left menu. Scroll down a bit and click the button “Restore Default Search Engines”

firefox restore default search engine

Scroll up to the “Default Search Engine” settings. Change “Choose the default search engine to use in the address bar and search bar.” to your desired search engine, e.g. Google.
Save settings and restart Firefox.

firefox mac change default search engine

Do you still experience adware, unwanted advertisements or any malware application after this step?
Perform an adware scan with Malwarebytes to remove the adware left over from your Mac computer.

Please rate this article: 1 Star2 Stars3 Stars4 Stars5 Stars (2 votes, average: 4.00 out of 5)

Loading...

About The Author

11 Comments

  1. Max Reisler
    FixYourBrowser,com
    April 8, 2017
  2. véronique
    December 4, 2017
  3. Max Reisler
    Max Reisler
    December 4, 2017
  4. véronique
    December 4, 2017
  5. Max Reisler
    Max Reisler
    December 5, 2017
  6. Véronique
    December 5, 2017
  7. Max Reisler
    Max Reisler
    December 6, 2017
  8. Homer
    March 9, 2018
  9. Jess Payan
    March 18, 2018
  10. Anonymous
    June 17, 2018
  11. Max Reisler
    Max
    June 17, 2018

Add Comment