Adware Cleaner Support

Congrats on hopefully having removed your adware with Adware Cleaner! Now that you’re Mac has been restored, you’ll probably want to prevent any more adware coming back.

The most effective thing you should do right away is navigate to Settings -> Security & Privacy. Click the Lock icon at the bottom and then switch your setting on the bottom to allow apps downloaded from “Mac App Store” or “Mac App Store and identified developers.”

Now when you try to install anything that isn’t in the App Store or an identified developer, you’ll get a pop-up message that says it can’t be opened.

Another useful tool is installing an AdBlock extension for your web browser to prevent popup ads.

https://getadblock.com

Removing adware is relatively simple.

The hard part is looking for the specific key files to delete and keeping up to date with the latest adware information and knowing which key files to look for and delete.

This guide will help walk you through removing the most common adware for free. 🙂

If you want a useful Mac app that will do this for you with the click of 1-button, then it’s worth checking out Adware Cleaner on the Mac App Store. These instructions may seem daunting, so some people may want to take the easier road using the app.

1. Check Your Browser Extensions

It is very common for Adware to hide in your browser extensions and/or add-ons. Look at your extensions you have installed in your browser:

Safari – From the Safari menu, go to Preferences -> Extensions, near the right side of the row of icons along the top of the window.
Chrome – From the Chrome menu, go to Preferences -> Extensions item in the list on the left side of the window.
Firefox – Go to Add-ons from the Tools menu, then look at both the Extensions and Plugins lists in the window that opens.

There are lots of good browser extensions out there, but be careful which ones you decide to install. If you see extensions that you don’t remember installing, it is most likely adware. Below is a list of some common Adware that you might see installed.

Omnibar, GoldenBoy, Texiday, Listchack, InKeepr, Nariabox, Celipsow
See Genieo Removal https://support.norton.com/sp/en/us/home/current/solutions/v103415336_EndUserProfile_en_us
savekeep, saVe keeep, suave keepo, or anything similar
Delete all of the following browser extensions that you find: savekeep, saVe keeep and suave keepo.
jollywallet cash back
Delete the “jollywalet cash back” browser extension.
Vidx, Viddxx, Vidox, Viidax, ViiDDx, MacVX (and variants like MacVaX), MacCaptain, MacPriceCut, SaveOnMac, Mac Global Deals or MacDeals, MacSter, MacXcoupon, Shop Brain (or variants like SShoP Braaiin), MacMin (and variants like MacMMin, MaucMino, etc)
Delete any browser extensions with the following names:

Vidx (or variants such as ViddX, Vidox, Viidax and ViiDDx)
MacVx (or variants such as MacVax or MacVox)
MacCaptain
MacPriceCut
SaveOnMac
Mac Global Deals
MacDeals
MacSter
MacXcoupon
Shop Brain (or variants such as SShoP Braaiin)
MacMin (or variants such as MacMMin or MaucMino)
MacCost

Move the following items to the trash.

/Applications/Vidx.app
/Applications/MacMin.app
/Library/Application Support/VidToMP3
/Library/Application Support/fa4e8.94b.550d413f
~/Library/Application Support/osxDownloader
MacMin (and variants like MacMMin, MaucMino, etc) – see Vidx removal
Awesome Screenshot
Remove this extension
Shopy Mate, PalMall, FlashMall, Cinema-Plus Pro (and variants like Cinema + HD, Cinema + Plus + or Cinema Ploos)
Delete all of the following browser extensions that you find: Shopy Mate, FlashMall, Cinema-Plus Pro(and variants like CinemaPlus, CinemaPro, Cinema + HD, Cinema + Plus + or Cinema Ploos).

Move the following items to the trash.

/Applications/WebTools.app
/Applications/WebShopper.app
~/Applications/WebTools.app
~/Applications/WebShopper.app
/Library/cinemapro1-2/
~/Library/cinemapro1-2/
~/Library/WebTools/
~/Library/Application Support/webHelperApp/
~/Library/Application Support/WebShopper/
~/Library/LaunchAgents/WebServerSocketApp
~/Library/LaunchAgents/UpdateDownloder
~/Library/LaunchAgents/com.webhelper.plist
~/Library/LaunchAgents/com.webtools.update.agent.plist
~/Library/LaunchAgents/com.webtools.uninstaller.plist
Search App by Ask
Delete any extension called something like Search App by Ask.

Move the following items to the trash.

~/Library/Application Support/Sponsors.framework
MacShop, MacSmart, News Ticker Remover, Shopper Helper Pro, Photo Zoom, Best YouTube Downloader, ArcadeYum, Extended protection, Video download helper, FlashFree, RecipeHub, iLivid, CustomSearchForSafari, Media Player, MusixLib, GoMovix, MovixHub, AdBlock Super, Webpage Screenshot, NewTabTV, WalletBee
Remove these extensions
PremierOpinion
See removal guide https://www.pcrisk.com/removal-guides/8226-premier-opinion-surveys
Opti-Page, Toppy
Delete all of the following browser extensions that you find: Opti-Page, Toppy.

Move the following items to the trash.

~/Library/Application Support/Google/Chrome/Default/chromex
~/Library/Application Support/Google/Chrome/Default/chromexdm
~/Library/Application Support/mediahm
~/Library/LaunchDaemons/com.mediahm.operator.update.plist
Codec-M
Delete the Codec-M browser extension.
Move the following items to the trash.

~/Library/Application Support/Codec-M
~/Library/LaunchAgents/com.codecm.uploader.plist
/Applications/Codec-M.app
Yontoo and/or Torrenthandler
Delete the Yontoo and Torrenthandler browser extensions.
Anything claiming to be Adobe Flash Player
Delete any Safari extensions claiming to be Adobe Flash Player. The real Flash Player does not use a browser extension.
ChatZum
Delete the ChatZum browser extension.
Move the following items to the trash.

/Applications/ChatZumUninstaller.pkg
/Library/Application Support/SIMBL/Plugins/SafariOmnibar.bundle
/Library/Internet Plug-Ins/uid.plist
/Library/Internet Plug-Ins/zako.plugin
Conduit, MyBrand, Trovi, Search Protect, SP, or anything ending with Community Toolbar
Delete any Conduit, MyBrand, Trovi or Search Protect browser extensions that you find, as well as any with a name ending in “Community Toolbar.” (e.g. Genealogy Gems Podcast Community Toolbar, SB Tool Bar Community Toolbar, WiseConvert Community Toolbar, MovieBario Community Toolbar, etc)
Move the following items to the trash.

/Library/InputManagers/CTLoader/
/Library/LaunchAgents/com.conduit.loader.agent.plist
/Library/LaunchDaemons/com.perion.searchprotectd.plist
/Library/Application Support/SIMBL/Plugins/CT2285220.bundle
/Library/Application Support/Conduit/
/Applications/SearchProtect.app
/Applications/SearchProtect/
~/Library/Application Support/Conduit/
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
~/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin
~/Conduit/
~/Trovi/
Searchme, Slick Savings, Amazon Shopping Assistant, Ebay Shopping Assistant, Domain Error Assistant
Delete all of the following browser extensions that you find: Searchme, Slick Savings, Amazon Shopping Assistant, Ebay Shopping Assistant, Domain Error Assistant.

Move the following items to the trash.

~/Library/LaunchAgents/com.spigot.SearchProtection.plist
~/Library/LaunchAgents/com.spigot.ApplicationManager.plist
~/Library/Application Support/Spigot/
Set Search Settings, searchtab, any extension with a name like xxsearch (where “xx” can be anything), such as jbsearch or mtsearch, and any extension with a person’s name, such as JeffKekkoor BrianDeer
Delete all of the following browser extensions that you find: Set Search Settings, searchme, searchtab, and any extension with a name like xxsearch (where “xx” can be anything), such as jbsearch or mtsearch. In addition, extensions whose names are a person’s name, such as JeffKekko or BrianDeer, should be disabled.
GoPhoto.it
Delete the GoPhoto.it and jollywallet cash back browser extensions.

2. Check Your Libraries
Adware can install “LaunchAgents” to keep running in the background 24/7. Look in two different LaunchAgents folders to see a file matching the description. If you do, it’s Adware.

~/Library/LaunchAgents

com.codecm.uploader.plist
Delete the Codec-M browser extension.
Move the following items to the trash.

~/Library/Application Support/Codec-M
~/Library/LaunchAgents/com.codecm.uploader.plist
/Applications/Codec-M.app
anything with the word “genieo” in it
Genieo removal – https://support.norton.com/sp/en/us/home/current/solutions/v103415336_EndUserProfile_en_us
a set of three files, each with names starting with the same text and ending in “.download.plist”, “.ltvbit.plist” and “.update.plist”
Genieo removal – https://support.norton.com/sp/en/us/home/current/solutions/v103415336_EndUserProfile_en_us
Safari Security, files ending in “_enabler.plist”, “_enabler.sh”, “_updater.plist”, “_updater.sh”. WebSocketServerApp, com.webhelper.plist, com.webtools.update.agent.plist, anything starting with com.crossrider.wss. UpdateDownloader, anything similar to com.extensions.updater69337.agent.plist or com.extensions.updater69337.ver
Delete all of the following browser extensions that you find: Shopy Mate, FlashMall, Cinema-Plus Pro(and variants like CinemaPlus, CinemaPro, Cinema + HD, Cinema + Plus + or Cinema Ploos).

Move the following items to the trash.

/Applications/WebTools.app
/Applications/WebShopper.app
~/Applications/WebTools.app
~/Applications/WebShopper.app
/Library/cinemapro1-2/
~/Library/cinemapro1-2/
~/Library/WebTools/
~/Library/Application Support/webHelperApp/
~/Library/Application Support/WebShopper/
~/Library/LaunchAgents/WebServerSocketApp
~/Library/LaunchAgents/UpdateDownloder
~/Library/LaunchAgents/com.webhelper.plist
~/Library/LaunchAgents/com.webtools.update.agent.plist
~/Library/LaunchAgents/com.webtools.uninstaller.plist

/Library/LaunchAgents

anything with the word “genieo” or “texiday” in it, or with a name starting with “com.installer.completer”
Genieo removal – https://support.norton.com/sp/en/us/home/current/solutions/v103415336_EndUserProfile_en_us
com.conduit.loader.agent.plist
Delete any Conduit, MyBrand, Trovi or Search Protect browser extensions that you find, as well as any with a name ending in “Community Toolbar.” (e.g. Genealogy Gems Podcast Community Toolbar, SB Tool Bar Community Toolbar, WiseConvert Community Toolbar, MovieBario Community Toolbar, etc)
Move the following items to the trash.

/Library/InputManagers/CTLoader/
/Library/LaunchAgents/com.conduit.loader.agent.plist
/Library/LaunchDaemons/com.perion.searchprotectd.plist
/Library/Application Support/SIMBL/Plugins/CT2285220.bundle
/Library/Application Support/Conduit/
/Applications/SearchProtect.app
/Applications/SearchProtect/
~/Library/Application Support/Conduit/
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
~/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin
~/Conduit/
~/Trovi/
com.vsearch.agent.plist (There are a number of variants that substitute other random words for “vsearch” in this file name)
Move the following items to the trash.

/Library/Application Support/VSearch
/Library/LaunchAgents/com.vsearch.agent.plist
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
/System/Library/Frameworks/v.framework

You may also find files with the following names, where “xxx” can be any word:

/Library/LaunchAgents/com.xxx.agent.plist
/Library/LaunchDaemons/com.xxx.daemon.plist
/Library/LaunchDaemons/com.xxx.helper.plist

/Library/LaunchDaemons

Jack.plist, com.vsearch.daemon.plist or com.vsearch.helper.plist
Move the following items to the trash.

/Library/Application Support/VSearch
/Library/LaunchAgents/com.vsearch.agent.plist
/Library/LaunchDaemons/com.vsearch.daemon.plist
/Library/LaunchDaemons/com.vsearch.helper.plist
/Library/LaunchDaemons/Jack.plist
/Library/PrivilegedHelperTools/Jack
/System/Library/Frameworks/VSearch.framework
/System/Library/Frameworks/v.framework

You may also find files with the following names, where “xxx” can be any word:

/Library/LaunchAgents/com.xxx.agent.plist
/Library/LaunchDaemons/com.xxx.daemon.plist
/Library/LaunchDaemons/com.xxx.helper.plist
com.perion.searchprotectd.plist
Delete any Conduit, MyBrand, Trovi or Search Protect browser extensions that you find, as well as any with a name ending in “Community Toolbar.” (e.g. Genealogy Gems Podcast Community Toolbar, SB Tool Bar Community Toolbar, WiseConvert Community Toolbar, MovieBario Community Toolbar, etc)
Move the following items to the trash.

/Library/InputManagers/CTLoader/
/Library/LaunchAgents/com.conduit.loader.agent.plist
/Library/LaunchDaemons/com.perion.searchprotectd.plist
/Library/Application Support/SIMBL/Plugins/CT2285220.bundle
/Library/Application Support/Conduit/
/Applications/SearchProtect.app
/Applications/SearchProtect/
~/Library/Application Support/Conduit/
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
~/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin
~/Conduit/
~/Trovi/
PremierOpinion.plist
See removal guide https://www.pcrisk.com/removal-guides/8226-premier-opinion-surveys

/Library/Internet Plug-Ins

zako.plugin
Delete the ChatZum browser extension.
Move the following items to the trash.

/Applications/ChatZumUninstaller.pkg
/Library/Application Support/SIMBL/Plugins/SafariOmnibar.bundle
/Library/Internet Plug-Ins/uid.plist
/Library/Internet Plug-Ins/zako.plugin

Still No Adware Found?

Check your symptoms to make sure you have adware or spyware. You might just be experiencing popup ads that can be blocked using the useful adblock browser extension – https://getadblock.com

Hopefully this isn’t the case, but you could possibly have Malware. BitMedic is a great AntiVirus app available on the Mac App Store for removing Malware.

Don’t forget to see our guide on How to PREVENT more adware.

If you have any questions, feel free to email us at support@pocketbitsllc.com.

1. Scanned your Mac using the option of removing adware from your Mac.
2. Scanned your Mac using the advanced options of clearing your browser extensions and restoring your browser preferences back to default.
3. Restarted your computer. This is necessary.

If you’ve done all of the above and are still experiencing problems, there are a few things you can try next.

If you’re seeing the notification popup on the top right corner of your screen with no web browsers open, then you might have allowed and given permissions to a specific website to send you notification.

To disable these, open up Safari and go to “Preferences” from the top left pull-down menu and click “Notifications”.

You can “Deny” all the websites that are sending bothersome alerts. You can also “Remove All” to disable all them in bulk.

On the bottom left, you can uncheck “Allow websites to ask for permission to send push notifications” to stop Safari from asking you about push notifications completely. Safari will ignore all push notification requests from websites. (this is only av

You can “Deny” all the websites that are sending bothersome alerts. You can also “Remove All” to disable all them in bulk.

On the bottom left, you can uncheck “Allow websites to ask for permission to send push notifications” to stop Safari from asking you about push notifications completely. Safari will ignore all push notification requests from websites. (this is only av

If the problem is happening on specific websites only, it most likely isn’t adware since you’ve already cleared your browser extensions. Your browser extensions is where adware will like to hide. We recommend installing an adware blocker browser extension. http://getadblock.com

If you’re getting pop-up scams about having a virus or threats/warnings, these are not caused by adware. They are scam websites. Ignore these and do not call the number or install any software.

If you’ve done all of the above and you’re still getting adware problems, it could be new adware that hasn’t been discovered yet and is clever enough to avoid the standard browser extension. Choose the contact button inside our app to email us a screenshot and steps to reproduce the adware issue.

Check to make sure you are infected with adware and not a malware virus. Make sure you’ve followed all of the above steps to also confirm that it definitely IS adware and not anything else.

If you are experiencing malware virus problems, you can use our BitMedic Antivirus app to protect yourself.

https://itunes.apple.com/us/app/bitmedic-antivirus-malware/id1001746820?mt=12

The Finder does offer an option to view hidden files. However, this isn’t a graphical option — you have to enable it with a terminal command and restart the Finder for your changes to take effect.

To view hidden files in the Finder, open a Terminal window and run the following commands in it, pressing Enter after each one:

defaults write com.apple.finder AppleShowAllFiles TRUE

killall Finder

This command tells Finder to show hidden files and then restarts it. It’ll show all those hidden files and folders once you’re done. They appear partially transparent to distinguish hidden files and folders from normally unhidden ones.

Want to stop Finder from showing hidden files and folders? Run the following command to disable this option and restart the Finder:

defaults write com.apple.finder AppleShowAllFiles FALSE

killall Finder