The Safe Mac

Identification

Identification of adware simply requires looking for certain key files. If one of these files are present, you are “infected” with the corresponding adware, and will need to follow the removal instructions specific to that adware.

It is important to work through this entire page! Do not stop after finding one piece of adware, or look for a specific piece of adware that you believe is installed. Often, a single malicious installer will dump multiple adware programs onto your system, so you must be sure you find all of them.

If the instructions below are daunting, you can download Malwarebytes Anti-Malware for Mac. It is app that you can use to scan for and remove all the adware described here.

Examine Browser Extensions

Examining browser extensions or add-ons are often sufficient to diagnose the issue. Look at the extensions you have installed in your browser, using the following methods:

  • Safari – choose Preferences from the Safari menu, then click the Extensions icon, near the right side of the row of icons along the top of the window.
  • Chrome – choose Preferences from the Chrome menu, then click the Extensions item in the list on the left side of the window.
  • Firefox – choose Add-ons from the Tools menu, then look at both the Extensions and Plugins lists in the window that opens.

It’s important to understand that there are plenty of legitimate browser extensions out there. If you see any of the items shown in bold below, however, that’s a sign that you have adware installed. Be sure to look at the removal instructions, rather than just removing the extensions, as some adware installs more than just browser extensions!

  • Codec-M – see FkCodec removal
  • Yontoo and/or Torrenthandler – see Yontoo removal
  • Anything claiming to be Adobe Flash Player – see ClickAgent removal
  • ChatZum – see ChatZum removal
  • Conduit, MyBrand, Trovi, Search Protect, SP, or anything ending with Community Toolbar – see Conduit removal
  • Searchme, Slick Savings, Amazon Shopping Assistant, Ebay Shopping Assistant, Domain Error Assistant – see Spigot removal
  • Set Search Settings, searchtab, any extension with a name like xxsearch (where “xx” can be anything), such as jbsearch or mtsearch, and any extension with a person’s name, such as JeffKekko or BrianDeer – see InstallCore removal
  • GoPhoto.it – see GoPhoto.it removal
  • Omnibar, GoldenBoy, Texiday, Listchack, InKeepr, Nariabox, Celipsow – see Genieo removal
  • savekeep, saVe keeep, suave keepo, or anything similar – see Savekeep removal
  • jollywallet cash back – see Jollywallet removal
  • Vidx, Viddxx, Vidox, Viidax, ViiDDx, or anything similar – see Vidx removal
  • MacVX (and variants like MacVaX), MacCaptain, MacPriceCut, SaveOnMac, Mac Global Deals or MacDeals, MacSter, MacXcoupon, Shop Brain (or variants like SShoP Braaiin) – see Vidx removal
  • MacMin (and variants like MacMMin, MaucMino, etc) – see Vidx removal
  • Awesome Screenshot – remove this extension (see Screenshot extension injects ads for details)
  • Shopy Mate, PalMall, FlashMall, Cinema-Plus Pro (and variants like Cinema + HD, Cinema + Plus + or Cinema Ploos) – see Bundlore removal
  • Search App by Ask – see Ask Toolbar removal
  • MacShop, MacSmart, News Ticker Remover, Shopper Helper Pro, Photo Zoom, Best YouTube Downloader, ArcadeYum, Extended protection, Video download helper, FlashFree, RecipeHub, iLivid, CustomSearchForSafari, Media Player, MusixLib, GoMovix, MovixHub, AdBlock Super, Webpage Screenshot, NewTabTV, WalletBee – remove these extensions
  • PremierOpinion – see PremierOpinion removal
  • Opti-Page, Toppy – see OperatorMac removal

Examine Libraries

Some adware installs LaunchAgents, which are used to keep a component running in the background at all times. You will need to look in two different LaunchAgents folders. (If you’re not sure how to locate a folder from a path, see Locating files from paths.) If you see a file matching the description, you have adware installed!

~/Library/LaunchAgents

  • com.codecm.uploader.plist – see FkCodec removal
  • anything with the word “genieo” in it – see Genieo removal
  • a set of three files, each with names starting with the same text and ending in “.download.plist”, “.ltvbit.plist” and “.update.plist” – see Genieo removal
  • Safari Security, files ending in “_enabler.plist”, “_enabler.sh”, “_updater.plist”, “_updater.sh” – see Bundlore removal
  • WebSocketServerApp, com.webhelper.plist, com.webtools.update.agent.plist, anything starting with com.crossrider.wss – see Bundlore removal
  • UpdateDownloader, anything similar to com.extensions.updater69337.agent.plist or com.extensions.updater69337.ver – see Bundlore removal

/Library/LaunchAgents

  • anything with the word “genieo” or “texiday” in it, or with a name starting with “com.installer.completer” – see Genieo removal
  • com.conduit.loader.agent.plist – see Conduit removal
  • com.vsearch.agent.plist – see VSearch removal
    • There are a number of variants that substitute other random words for “vsearch” in this file name. If you see a file named “com.xxx.agent.plist” (where “xxx” could be anything), and see similarly-named files in the /Library/LaunchDaemons folder (as described below), you have VSearch!

/Library/LaunchDaemons

  • Jack.plist, com.vsearch.daemon.plist or com.vsearch.helper.plist- see VSearch removal
    • There are a number of variants that substitute other random words for “vsearch” in this file name. If you see files named “com.xxx.daemon.plist” and “com.xxx.helper.plist” (where “xxx” could be anything), and see a similarly-named file in the /Library/LaunchAgents folder (as described above), you have VSearch!
  • com.perion.searchprotectd.plist – see Conduit removal
  • PremierOpinion.plist – see PremierOpinion removal

/Library/Internet Plug-Ins

Other

Choose Preferences from the Safari menu. If you see an icon at the far right of the icon bar labeled “Glims,” see Glims removal.

If you have avast! anti-virus installed, the avast! Online Security browser extension includes an adware feature called SafePrice. (See Avast installs adware!) I recommend uninstalling avast! entirely, for this and other reasons. Alternately, you can remove just the avast! Online Security extension, or turn off the SafePrice option in its settings.

No Adware Found?

If you didn’t find anything following the above instructions, your problem may not actually be due to adware. Continue on to Step 2: Look for other causes.

<- Back to Adware Removal Guide