- Preamble
- Our video
- Disinfection using free utilities
- Manual disinfection
- Critical locations to inspect in all cases
- General cleaning case
- Safari Cleaning
- Case where Safari no longer starts
- Firefox Cleanup
- Delete Genieo / InstallMac / AppYM
- Remove Conduit - Community Tool Bar
- Remove Bundlore - Flashmall
- Remove MacKeeper
- Remove Advanced Mac Cleaner
- Clean up the caches
- Verification
- Infected configuration profile
- Tip
- Anti-virus for Mac
- Protections for Safari and other browsers
Preamble
When you do research in your browser, Safari or other, and you see an influx of advertising links, often in writing in green color, that you with a new search engine which is unknown to you, your pages are redirected to sites unwanted, you have a multitude of pop-ups or advertising windows, it is that you have probably and unconsciously accepted the installation of one or more adware from an unhealthy site. (like Softonic, telecharger.cnet.com, download.com or other infected download sites).
Strictly speaking, these are not viruses, but adware.
We must therefore "clean" the Mac.
Our video
Loading your video "FAQ: Remove Adware, Unwanted Ads, Scams, MacKeeper on Mac OS X"Disinfection using free utilities
If the Mac is running a version of OS X greater than Mac OS X 10.6, it is necessary above all to privilege a cleaning using a utility dedicated to that. It will be much faster, more efficient and very simple.
Manual disinfection will only be necessary in the event that the Mac is running under a version prior to Mac OS X 10.7 or in the event of failure of these utilities or in the face of certain recalcitrant cases such as MacKeeper for example.
Most often, one of these tools will suffice.
To remove these Adwares on Mac, from Mac OS X 10.7 or OS 10.8, there is currently MalwareBytes for Mac:
Right here :
https://www.adwaremedic.com/index.php
or here
https://www.malwarebytes.com/mac
Last minute :
- Latest version of MalwareBytes requires OS X 10.10
See this page:
https://support.malwarebytes.com/hc/en-us
- try these links, if still valid when you read this page, which allows the download of an old version of AdwareMedic:
https://macdownload.informer.com/adwaremedic/download/
or :
https://support.malwarebytes.com/external-link.jspa?url=https%3A%2F%2Fdata-cdn.mbamupdates.com%2Fweb%2FMBAM-Mac-1.2.4.584.dmg
https://www.logicielmac.com/logiciel/adwaremedic-2713.html
https://www.logicielmac.com/download/5529a21f.dl
and also :
- Adware Removal Tool from Bitdefender:
https://www.bitdefender.com/solutions/adware-removal-tool.html
BitDefender's "Adware Removal Tool" works from Mac OS X 10.7
Note: Malwarebytes for Mac is released from software AdwareMedic originally published by: The Safe Mac, software which was later acquired by MalwareBytes.
Help for AdwareMedic has been posted here:
https://assiste.com/Logitheque/AdwareMedic.html
Note about MalwareBytes / Adwaremedic:
The MalwareBytes disinfection software does not necessarily contain a complete database when downloading the software, this database being constantly updated, when it is launched, MalwareBytes will connect to the MalwareBytes server, (eg SafeMac) , to load the latest information for disinfection. As a result, the Mac will need to be connected to the net when it is launched.
In any case, Mac OS X 10.7 or 10.8 is the minimum required for these utilities
Notes : To delete MacKepper and similar utilities, we can use DetectX which works from Mac OS 10.7, but offers a special version for Mac OS X 10.6 : https://sqwarq.com/detectx/
Manual disinfection
When I wrote this help, there was no help from Apple on this type of infection. Since then, Apple has also published help to remedy this type of pollution, it can be found here:
https://support.apple.com/fr-fr/HT203987
To clean the Mac manually it will have to inspect several places on the hard drive, including different libraries.
FYI: There are at least 3 Libraries in the Mac OS X system:
- the main one is at the root of the hard drive, its path is:
/ Library
- the second is in the System folder, its path is:
/ System / Library
- and finally, a Library for each user, this one is at the root of the directory of each user, its path, for the user in service is:
~ / Library
The User Library is hidden in the latest versions of OS X. Consequently, and since Mac OS 10.7, your personal library is no longer visible by default, to access it you can pull down the menu "Go"of the Finder, while keeping the alt key pressed. You will then see the line Library, if you click on this line you go to your Personal Library.
But, to go directly to specific places from the hard disk we will use the menu "Go / Go to folder ...."from Finder then paste the destination path in the input box.
To simplify things, we will use the symbol ~ to designate the user's directory.
For example, to go to the Application Support folder of my Personal Library, instead of entering
/ Users / francis / Library / Application Support
I will simply paste the following line into the entry area of the Go / Go to Folder menu:
~ / Library / Application Support
this will take us directly to the Application Support subfolder of the User Library in use,
or even
~ / Library / LaunchAgents
to go directly to the LaunchAgents subfolder of the User library.
While to go to the "Application Support" subfolder of the Library main, we will simply enter this command:
/ Library / Application Support
or to go to the Receipt folder in / private / var / db / receipt:
Practical information :
- the symbol ~ is obtained by pressing the keys simultaneously alt et N
- the shortcut for quick access to the entry zone of the "Go / Go to folder ..." menu is made by pressing these 3 keys simultaneously: Shift cmd G
Critical locations to inspect in all cases
- go to these different folders, always pasting the path indicated in the Finder menu "Go / Go to folder ..."
and inspect the contents of each of these different folders
/ Library / PrivilegedHelperTools
/ Library / Application Support
/ Library / LaunchDaemons
/ Library / LaunchAgents
/ Library / StartupItems
/ Library / Scripts
/ Library / Extensions
/ System / Library / LaunchDaemons
/ System / Library / LaunchAgents
/ System / Library / StartupItems
/ System / Library / Frameworks
~ / Library / Application Support
~ / Library / LaunchAgents
~ / Library / LaunchDaemons
~ / Library / Caches
~ / Library / Safari / Extensions
~ / Library / Scripts
~ / Library / Input Methods
(if it is present on your system)
General cleaning case
- Start by removing the freshly installed application that could be the source of the pollution. Inspect your Applications folder for any questionable applications and then follow this page:
Then here is a non-exhaustive list of unhealthy files to delete for cleaning adware such as, Tlbsearch, Vsearch, iMesh, searchme, Hide Ad, Open Ad, Nav-Link, Genieo, Navlink, etc.
From each of the different locations mentioned above, delete any files or folders whose names include the following terms:
Advanced Network Care or AdvancedNetworkCare
Advanced MacCleaner, or Advanced Mac Cleaner
Adware.NewTab
Adware.Operator
amazon
Amazon Shopping
amc (dirt related to Advanced Mac Cleaner)
ArcadeYum
Ask
AssetsChanger
Assistant and Ebay Shopping Assistant
AuthManager_Mac or AuthManager
Awesome screenshot
Best YouTube Downloader
BitCoinMiner
booking or booking.com
Bundlore
Chill Tab or chilltab
movies
CinemaPro
cinemas
Cinemas - + - more
com.adobe.update.plist
com.Software-Updater.agent
com.HotShoppy.agent
com.pcv.hlpramc or com.pcv
com.vsearch.agent.plist
com.vsearch.daemon.plist
com.vsearch.helper.plist
combocleaner
Conduit
Conduit Search Protec
ConvertMe
Crossrider
CTloader
Download.com
doudoudan
easy shopper
EasyDocMerge
ebay
Epolife
Erightsoft.com
Extended protection
Feelbegin
FlashFree
FlashImitator
FlexibleShopper
FromDocToPDF
Genius
GoldenBoy
Gwenrose
hlpramc
HotShoppy
ifunsoft
InKeepr
inkeeper
InstallCore
InstallData
installdp
installd.sh
InstallMac
InstallMIEZ
instantfwding
IObit
istartsurf
Jack
Jack.plist
Jakecares
Javeview
jdibackup
justdevelop
kuklorest
Leperdvil
Listchack
loadoages.com
loadoages.com/pd/gua
Mac.XLoader.B
MacBooster or Macbooster
MacDefender
Mac File Opener or macfileopener
Mac Global Deals
MacSpeedUpProX or Mac Speed Up Pro
MacCaptain
MacDeals
macdownloader
Macfest
MacKeeper or mackeeper
Mac Mechanic or macmechanic
MacProtector
MacPriceCut
MacSave
MacSaver
MacSecurity
MacShop
MacSmart
Mac Speedup
Macster
MacVaX
MacVX
MacVx
MacXcoupon
maftask
MaMi
Manroling
mapsgallaxy
MaxLoader
Mindspark
Montageobox
Myway or myway
Nariabox
Nav Link or navlink
News Ticker or News Ticker Remover
obstruction
Oliverto
OSX / AssetsChanger,
OSX / FlashImitator,
OSX / InstallMiezoffers4u
Otwexplain
Outbrain
PalMall
PCVARK
Photo Zoom
pricepeep
Procinema Pro +
ProductTask
Pro Mac Speedup
prosearchtip
qq.com.Reset
PUP.Bookinh
PUP.Browser
PUP.Reimage
Reimage or reimage
SafeFinder, Safe Finder or safefinder
SaveOnMac
Schlayer
search
SearchAssist
searchlock
searchme or Search me
SearchMine
searchmyway
Semtex
Shop Brain
Shopper Helper Pro
ShoppyTool
Slick Savings
Software-Updater or SoftwareUpdater
spigot
SShoP or SShoP Brain
Taboola
Tapsnake
Tapufind or TapuFind
tb.ask.com
Texiday
trovi
Trovi.com
TuneUpMyMac
varenyky
Video download helper
vsearch
VSearch.comamework
Web Search
weknow
YourSearch
YourSearchMe
XLoader
Zeobit or zeobit
ZipCloud
As well as any other questionable file or folder that is related to the unknown or questionable extensions.
Safari Cleaning
- go to the Safari / Preferences / Extensions menu, and there delete all extensions that you did not install voluntarily and all those that you do not know the function perfectly.
=> In particular any extension whose name contains one of the terms stated in the list cited above
- go to Safari / Preferences / Privacy, and here delete all cookies and other data.
- go to Safari / Preferences / General, and there redefine your home page
- go to Safari / Preferences / Search, and redefine your search engine
For older versions of Safari:
- go to the "Safari / Reset Safari ..." menu, check all the boxes and validate.
For current versions of Safari:
- go to the menu "Safari / Clear history
- go to Safari / Preferences / Advanced and check the box "Show the development menu in the menu bar"
- go to the menu Development / Empty the caches
- Quit Safari.
Case where Safari no longer starts
If the extensions installed in Safari prevent the operation of the latter, you can manually remove its extensions and preferences as follows:
When Safari is closed:
From the Finder menu bar,
- go to the Go / Go to folder menu ...
- and paste this into the input box:
~ / Library / Safari
You are now in the Safari folder, from here you have to
- throw everything in the trash, including the Extensions folder, except the bookmarks file, ie the "Bookmarks.plist" file, this if we want to keep the bookmarks.
- empty the trash in secure mode
- Go now to:
~ / Library / Preferences
- in this Preferences folder, locate the files whose name contains Safari, for example:
com.apple.Safari.Extensions.plist
com.apple.Safari.plist
- discard these files, and again,
- empty the trash in safe mode.
Firefox Cleanup
Do similar manipulations for Firefox, and any other existing browser on the Mac, knowing that the Firefox folder is not located directly in the User Library, but in:
~ / Library / Application Support
- The best is to completely delete the Firefox folder after saving his bookmarks.
- Since Firefox extensions are placed directly in the application's resources, it is even preferable to delete the Firefox application itself. We can re-install it later.
Delete Genieo / InstallMac / AppYM
- Go to the folder
/ Applications
- discard these items if present:
Genieo
InstallMac
InKeepr
InKeepr /
Uninstall Genieo
Uninstall IM Completer.app
Texiday
Listchack
AppYM
- Go to:
~ / Library / Application Support
- discard these files or folders if present:
com.genieoinnovation.Installer /
Genieo
IM.Installer
Texiday
Listchack
InKeepr
Epolife
InstallMac
Javeview
Kuklorest
Manroling
Otwexplain
Zip Devil
- Go to:
~ / LibraryLaunchAgents
- throw these files:
Javeview.update.plist
Manroling.update.plist
- Then go to:
/ Library / LaunchAgents
- throw these files:
com.genieoinnovation.macextension.plist
com.genieoinnovation.macextension.client.plist
com.genieo.engine.plist
com.genieo.completer.update.plist
xxxxxxxx.AppRemoval.plist
xxxxxxxx.download.plist
xxxxxxxx.ltvbit.plist
xxxxxxxx.update.plist
here, the sequence of characters xxxxxxxx can correspond to one of the following terms:
Epolife
InstallMac
Javeview
Kuklorest
Manroling
Otwexplain
- then, go to:
/ Library / LaunchDaemons
- throw this file:
com.genieoinnovation.macextension.client.plist
- Then go to:
/ Library / PrivilegedHelperTools
- throw this file:
com.genieoinnovation.macextension.client
- then go to:
/ Private / etc
in this folder etc - if present, delete the file:
launchd.conf
- Then go to:
/ Usr / lib
in this lib folder check the presence of the following files and discard them,
but only if you found and removed the launchd.conf file mentioned above :
libgenkit.dylib
libgenkitsa.dylib
libimckit.dylib
libimckitsa.dylib
- Empty the trash in secure mode
- Restart the Mac
- Go to:
/ Library / Frameworks
- and discard this file if present:
GenieoExtra.comamework
Empty the trash in secure mode.
- Restart the Mac
- redefine your home page in Safari
Additional useful information :
https://www.thesafemac.com/arg-genieo/
https://www.thesafemac.com/arg-identification/
Remove Conduit - Community Tool Bar
Always from the Go / Go to folder ... menu of the Finder,
- Go to:
/ Library / InputManagers
- and delete this element:
CTLoader
- Then go to:
/ Library / LaunchAgents
- delete this element:
com.conduit.loader.agent.plist
- then go to:
/ Library / LaunchDaemons:
- delete this element:
com.perion.searchprotectd.plist
- then go to:
/ Library / Application Support / SIMBL / Plugins
- delete this element:
CT2285220.bundle => see reamarque below *!
- then go to:
/ Library / Application Support
- remove this element:
Conduit
- Then go to:
/ Applications
- remove this element:
SearchProtect
- then go to
~ / Library / Application Support
- delete this element:
Conduit
- Then go to:
~ / Library / Internet Plug-Ins
- delete these elements:
ConduitNPAPIPlugin.plugin
TroviNPAPIPlugin.plugin
- Then go to your directory, either:
~/
- delete these elements:
Conduit
trovi
If Firefox is installed:
- Go to:
~ / Library / Application Support / Firefox / Profiles
- go to the folder:
xxxxxx.default or xxxxx is a series of "weird" characters ...
- and here delete these elements:
abstraction.js
takeOverNewTab.txt
searchplugins
searchplugins
- and delete any file whose name includes the terms:
MyBrand.xml
conduit.xml
If this does not solve the problem, you will have to remove Firefox entirely with AppCleaner, then reinstall it.
- Note: In case you have found the SIMBL plug-in CT2285220.bundle, you should remove SIMBL as well, unless the installation meets a specific need.
To remove SIMBL, discard the following files:
- in:
/ Library / Application Support
- delete:
SIMBL
- in:
/ Library / LaunchAgents
- delete:
net.culater.SIMBL.Agent.plist
- in:
/ Library / ScriptingAdditions
- delete:
SIMBL.osax
Empty the trash in safe mode, and restart the Mac.
Additional info:
https://www.thesafemac.com/arg-conduit/
Remove Bundlore - Flashmall
- inspect the contents of the Applications folder, and remove the possible presence of these elements:
WebTools
WebShopper
if present, throw these items in the trash and empty the trash in safe mode
- Go to your directory, either:
~
check if there is an Applications folder containing the same thing; if so, same treatment
- NB: in any case, there must not be an Applications folder in your directory
- go to:
~ / Library / LaunchAgents
- Inspect the contents of this folder, and upload the files that bear this name:
com.crossrider.wss*.agent.plist
com.webhelper.plist
com.webtools.update.agent.plist
flashmall_updater.plist
flashmall_updater.sh
WebSocketServerApp
Note: The * sign represents a series of numbers or variable characters.
Some files may not be there, remove those that are present, and empty the trash in safe mode.
- Close the Finder window and restart the Mac.
After restarting, we will remove some residual dirt.
- Go to:
~ / Library / Application Support
- Check if there is the presence of a folder named:
webHelperApp
if present, turn it to the trash and empty the trash in safe mode.
One last step:
- Go to:
~ / Library
- here look if there is a folder named:
WebTools
if present, turn it to the trash and empty the trash in safe mode.
- Restart the Mac ...
See also this page dedicated to Bundlore - Flashmall ect .. (Shopy Mate, FlashMall, Cinema-Plus Pro (and variants like CinemaPlus, CinemaPro, Cinema + HD, Cinema + Plus + or Cinema Ploos):
https://www.thesafemac.com/arg-bundlore/
Remove MacKeeper
To remove MacKeeper, which is not actually a virus, but bogus security-cleaning software, scareware, (as well as Detox My Mac), which causes a lot of problems, follow this procedure:
In case MacKeeper is still in place, start with:
- download and install Malwarebytes usable only from Mac OS X 10.7
- We can also use DetectX which works from Mac OS 10.7, but which offers a particular version for Mac OS X 10.6: https://sqwarq.com/detectx/
- Launch Malwarebytes and validate the removal of all adware and other junk found.
- See also this page: https://macsecurity.net/fr/view/166-mackeeper-virus
Here is for example what Malwarebytes found after an infection by Mackeeper and his acolytes ZipCloud, ShoppyTool, CrossRider: (I deliberately polluted for the tests)
2021-01-30 22:48:49 : ----- Scan Started -----
2021-01-30 22: 48: 49: Scanning with signatures 47 version (2021-1-27)
2021-01-30 22: 48: 51: Adware.Crossrider: /Users/english/Library/LaunchAgents/com.SoftwareUpdater.agent.plist
2021-01-30 22: 48: 51: Adware.Crossrider: / Applications / ShoppyTool
2021-01-30 22: 48: 51: Adware.Crossrider: /Users/english/Library/LaunchAgents/com.ShoppyTool.agent.plist
2021-01-30 22: 48: 52: PUP.ZipCloud: /Applications/ZipCloud.app
2021-01-30 22: 48: 52: PUP.ZipCloud: /Users/francis/Library/LaunchAgents/com.jdibackup.ZipCloud.autostart.plist
2021-01-30 22: 48: 52: PUP.ZipCloud: /Users/francis/Library/LaunchAgents/com.jdibackup.ZipCloud.notify.plist
2021-01-30 22: 48: 52: PUP.MacKeeper: /Applications/MacKeeper.app
2021-01-30 22: 48: 52: PUP.MacKeeper: /Users/english/Library/LaunchAgents/com.mackeeper.MacKeeper.Helper.plist
2021-01-30 22: 48: 53: *** 0 scan time: 00: 00: 03 ***
2021-01-30 22:48:53 : ------ Scan Ended ------
2021-01-30 22:49:01 : ---- File Removal Started ----
2021-01-30 22: 49: 01: ======================================= ====
2021-01-30 22: 49: 01: REMOVING ITEM: Adware.Crossrider
2021-01-30 22: 49: 01: >> Removing file item: /Users/english/Library/LaunchAgents/com.SoftwareUpdater.agent.plist
2021-01-30 22: 49: 01: ======================================= ====
2021-01-30 22: 49: 01: REMOVING ITEM: Adware.Crossrider
2021-01-30 22: 49: 01: >> Removing file item: / Applications / ShoppyTool
2021-01-30 22: 49: 01: ======================================= ====
2021-01-30 22: 49: 01: REMOVING ITEM: Adware.Crossrider
2021-01-30 22: 49: 01: >> Removing file item: /Users/francis/Library/LaunchAgents/com.ShoppyTool.agent.plist
2021-01-30 22: 49: 01: ======================================= ====
2021-01-30 22: 49: 01: REMOVING ITEM: PUP.ZipCloud
2021-01-30 22: 49: 01: >> Removing file item: /Applications/ZipCloud.app
2021-01-30 22: 49: 01: ======================================= ====
2021-01-30 22: 49: 01: REMOVING ITEM: PUP.ZipCloud
2021-01-30 22: 49: 01: >> Removing file item: /Users/english/Library/LaunchAgents/com.jdibackup.ZipCloud.autostart.plist
2021-01-30 22: 49: 01: ======================================= ====
2021-01-30 22: 49: 01: REMOVING ITEM: PUP.ZipCloud
2021-01-30 22: 49: 01: >> Removing file item: /Users/francis/Library/LaunchAgents/com.jdibackup.ZipCloud.notify.plist
2021-01-30 22: 49: 01: ======================================= ====
2021-01-30 22: 49: 01: REMOVING ITEM: PUP.MacKeeper
2021-01-30 22: 49: 01: >> Removing file item: /Applications/MacKeeper.app
2021-01-30 22: 49: 01: ======================================= ====
2021-01-30 22: 49: 01: REMOVING ITEM: PUP.MacKeeper
2021-01-30 22: 49: 01: >> Removing file item: /Users/francis/Library/LaunchAgents/com.mackeeper.MacKeeper.Helper.plist
2021-01-30 22:49:01 : ---- File Removal Complete ----
2021-01-30 22: 49: 24: ===== Attempting restart =====
2021-01-30 22:51:19 :
2021-01-30 22:51:20 : ----- Scan Started -----
2021-01-30 22: 51: 20: Scanning with signatures 47 version (2021-1-27)
2021-01-30 22: 51: 31: *** 0 scan time: 00: 00: 12 ***
2021-01-30 22:51:31 : ------ Scan Ended ------
Or with AppCleaner:
- Download the AppCleaner version that suits the version of Mac OS X, from its original source, i.e. here:
http://freemacsoft.net/appcleaner/
- When AppCleaner is downloaded put the application in the Applications folder
- Launch AppCleaner
- In the AppCleaner window drag MacKeeper
- AppCleaner will gather all the files related to MacKeeper and present them in its window, there
- Validate the deletion.
- Quit AppCleaner. In principle MacKeeper is deleted, in principle ...
But in reality, neither Malwarebytes nor AppCleaner managed to remove everything because there are leftover files stashed here and there. There are residues here and there, for example, you have to check here:
~ / Library / Caches / com.zeobit.MacKeeper
~ / Library / Caches / com.zeobit.MacKeeper.Helper
~ / Library / LaunchAgents / com.zeobit.MacKeeper.Helper
~ / Library / LaunchAgents / com.zeobit.MacKeeper.plugin.Backup.agent
~ / Library / Preferences / com.zeobit.MacKeeper.plist
~ / Library / Preferences / com.zeobit.MacKeeper.Helper.plist
or here:
/ Private / var / db / receipts /
where we might find these files:
com.mackeeper.MacKeeper.affid.pkg.bom
com.mackeeper.MacKeeper.affid.pkg.plist
com.mackeeper.MacKeeper.pkg.bom
com.mackeeper.MacKeeper.pkg.plist
and other related dirt like:
com.justdevelop.it.ZipCloud.reseller.pkg.bom
com.justdevelop.it.ZipCloud.reseller.pkg.plist
527638327@qq.com.Reset.pkg.bom
527638327@qq.com.Reset.pkg.plist
and other filth elsewhere.
- You must now check all the locations indicated above in the section Locations to inspect from these locations delete all the files whose names include mackeeper, zeobit, 911, 911bundle.
Then, for the possible remains:
- Launch the Terminal which is in Applications / Utilities ..
- In the Terminal window paste this command:
sudo find / -iname * mackeeper * -exec rm -rf {};
- Validate with the Enter key on the Mac
- The Terminal will then ask for the Mac Administrator password,
(this to accept the sudo command)
- So give the password, and that without worrying about the fact that we do not see what we type as characters, we enter our password "blind" in the Terminal and that's normal.
- Wait a few moments for the Terminal to do its search and removal work.
That was the command to remove any file with the term mackeeper in its filename.
Do the same manipulation in the Terminal by replacing the term mackeeper with the term zeobit
- Now to check that nothing remains as files:
- Paste this command in the Terminal:
sudo find / -iname * mackeeper *
- Let the Terminal search, and it should answer you:
No such file or directory
Which means he found nothing more.
Again, do the same search by replacing the term mackeeper with the term zeobit
- Then exit the Terminal.
- Launch the Keychain Access application, and check if there are any lines related to Mackeeper. Delete them if so.
- Restart the Mac.
This procedure is partially extracted from this page:
https://www.securitemac.com/desinstaller-mackeeper.html
Note: The latest version of MacKepper has its own uninstaller, but it does not actually delete all the unhealthy files.
Remove Advanced Mac Cleaner
Verifying possible items that start at logon:
- in System Preferences / Users and Groups / your account .. check what is in "Login"
- if you see an unknown application or related to Advanced Mac Cleaner or AMC, remove it by selecting it, then click on the minus sign at the bottom of the window
Go to the Applications folder
- Remove Advanced Mac Cleaner application using AppCleaner utility
see this page
Empty the trash
Using the Finder menu "Go / Go to Folder ...", the method of which is described above, go to the following places to delete the indicated items:
- Go to:
~ / Library
put these 2 items in the trash:
▪ Advanced Mac Cleaner
▪ hlpramc
Go to:
~ / Library / Services
here delete any file related to Advanced Mac Cleaner
- Go to:
~ / Library / Logs
turn these 2 elements
▪ Advanced Mac Cleaner.log
▪ helperamc.log
- Go to
~ / Library / Application Support
transfer these 2 elements:
▪ Advanced Mac Cleaner
▪ amc
- Go to:
~ / Library / Caches
turn these 2 elements
▪ com.pcv.hlpramc
▪ com.PCvark.Advanced-Mac-Cleaner
- Go to:
~ / Library / Saved Application State
transfer this file:
▪ com.PCvark.Advanced-Mac-Cleaner.savedState
- Go to:
~ / Library / Preferences
transfer these 2 files:
▪ com.pcv.hlpramc.plist
▪ com.PCvark.Advanced-Mac-Cleaner.plist
- Go to:
~ / Library / LaunchAgents
transfer these 2 files:
▪ com.pcv.hlpramc.plist
▪ com.PCvark.Advanced-Mac-Cleaner.plist
Empty the trash
Clean up the caches
In any case, also empty the Safari caches or other browser. For Safari, this can be done from the Safari Development menu, if it is activated from the Safari Preferences, but also by going directly to the Caches folder. your Library. Better yet, remove all User caches with a utility like Onyx or Maintenance.
http://joel.barriere.pagesperso-orange.com
Verification
Then, to check if there are any suspicious traces left:
download EasyFind which will allow you to search everywhere on the hard drive of the Mac.
EasyFind is free, and can be obtained through the App Store application or here:
http://www.devontechnologies.com/products/freeware.html
- Launch EsayFind and with it, search your hard drive for the terms related to adware mentioned above, validating the search for invisible files, and ignoring the case.
If EsayFind finds items related to these adware, in the list of results, right-click on the relevant line to ask "Show in Finder".
Once the item is visible in the Finder window, discard it and empty the trash in secure mode
Infected configuration profile
Note: Sometimes nothing visible on the Mac can be found, and the problem may come from an infected configuration profile. There is a free and very useful utility for spotting what is running as daemons or extensions on the Mac, which can help you uncover a corrupted or adware-infected Mac configuration profile. This is the EtreCheck freeware, to be taken here:
https://etrecheck.com/
If classic disinfection does not find anything, use Etrechceck, you may be the victim of a new form of corrupted configuration profile infection.
or also, in the same genus FastTask:
https://sqwarq.com/fasttasks-2/
Another possible verification :
Restart the Mac, and download a MacScan demo:
https://www.securemac.com/macscan/
MacScan, although not an antivirus, will detect Trojans and the like. So do a full scan of the Mac with MacScan.
Everything should be settled next.
See also, if necessary, this help which reviews possible other infections :
Adware Removal Guide Identification
Tip
- Download software only from their sources (official sites) - avoid all sites that offer anything and everything.
- Sites to be avoided are for example: softonic.com, softonic.com, download.com
- Don't be tempted by some unknown free app, miracle video converter style.
Note that malware most often comes from illegal download sites, pirated software sites, porn sites, torrent downloads, (movies, music, software, etc.)
- When the system is about to download or install anything, carefully check the origin of the thing, the function of the thing ... when something is not clearly defined, refuse the download and installation .
Anti-virus for Mac
An antivirus on Mac is not completely superfluous. There are correct ones in free or paid.
-Free, for example:
Sophos
ClamAV
Do not install Avast which itself carries Adware:
https://www.thesafemac.com/avast-installs-adware/
An application against ransomware: RansomWhere?
https://objective-see.com/products.html
-Payants:
BitDefender
ESET
Kaspersky
G DATA
VirusBarrier
ClamXav
Norton Security
Scan and delete on specific locations:
MacScan
Protections for Safari and other browsers
And to navigate safely on Safari or Firefox, useful extensions:
uBlock, a lightweight and effective anti-ad:
https://ublock.org/
or else 1Blocker
https://1blocker.com
CAUTION: We meet a lot of websites with pseudo tests to offer the best antivirus. Sites with names like:
"The 10 Best Mac Antiviruses ...", but in reality these sites are very often advertising sites for some antivirus of some kind, which will be touted as the best, of course. But the tests are bogus, it is easy to notice that some anti-viruses have not even been handled by the pseudos testers. Sometimes these sites themselves carry adware. If these sites offer number 1 an anti-virus which, coincidentally, is the cheapest, caution is all the more in order.
Examples of advertising pages, but false tests:
https://www.10meilleursantivirus.com
https://fr.antivirustop10.com
From reading the results, it is obvious that the competing anti-virus cited have not even been tested, or that the advertisement is false.
Francis.
