Checking For and Removing Adware From Your Mac

While each piece of unwanted software that tries to get on your Mac is slightly different, there are some general steps you can take to check for and remove malware. The LaunchAgents and LaunchDaemons folders are usual locations to check. You should also look for unwanted browser extensions and do an audit of the files in your Applications folder.

You can also watch this video at YouTube (but with ads).

Video Transcript: So let's say you suspect that you have adware on your Mac. Adware is not as serious as some malware. It's not really stealing your information or doing harm to your computer but it's showing you ads everywhere and it's annoying and you shouldn't have it on your Mac. Of course the way to avoid that is to make sure you only download software from sites you trust and to research software before you download it. But once you have it you want to get rid of it. You can look in some general places and do some general things that will get rid of most kinds of adware. 
If you can identify the kind of adware you've got the best thing to do is to goggle that with the keywords Mac, remove, and the name of the adware. Usually you'll come up with some site that gives you instructions. As a matter of fact it's best to look at several sites that give you instructions and see that they all agree before actually doing those things.
But let's say you want to go and check in the usual places and try to clean up your Mac a little bit. So the first thing you want to do, is you want to make sure you quit any apps that you're running, especially Safari. So you quit that and you're out of all your apps. Now you're just going to be in the Finder here looking at your files. You're going to use the Go menu to go into your Library. Now you click on Go and there is no Library entry there. But if you hold the Option key down on your keyboard Library pops up, you select it, and now you're in your Library. In your Home folder.
I'm going to choose Column view here so I can see things a little easier. So I can see I'm in Library and here are the folders in Library. One of them is something called  LaunchAgents. So you're going to look in here. I'm going to expand this column a bit so I can see these things. Now you want to look and see what's in there and try to see if you can identify each item. So, for instance, here's one that obviously Spotify. If you have Spotify installed, it's there, no problem. Skype, the same thing. DropBox, the same thing. There's some form of Adobe. I use lots of Adobe software so I'm not surprised. I know that GC is a kind of software to make sure I have a license to Adobe software on there. So all four of these checkout. I know what they are.
If you don't know what something is you can always copy the file name and do a Goggle search on it. Usually you'll come up with somebody that has asked a question before and they say, oh that's for Microsoft or whatever. So you say, yes I have that software so I know that's legitimate. But if you see the name of some adware or something you don't recognize then that may be the culprit and you may want to delete that.
Now also look, in addition to LaunchAgents, look for something called LaunchDaemons. That's kind of also another place where things that automatically get launched startup are stored.
In addition to your User folder here you want to check the computer's system libraries. There are two libraries. There's the system library which is for all users and there's the User Library which is just for your user account. I'm going to Command click here on the top title bar here so I can go all the way back up to the hard drive level. In the hard drive level I can see the System Library and I can go and see there is LaunchAgents. I can expand this column here as well and check out all of these things to make sure they check out. I can look at LaunchDaemons as well and check all these out as well. I know what each one of these it. There's some stuff from Microsoft. There's my screen recording software. There's a bunch things for Adobe. Backup software. All things that I understand. But if you see the adware that you're trying to get rid of listed here or something you don't recognize then search for it and see if it's something you should delete. So that's your first step.
The next thing you'll want to do is go to System Preferences. In there go to User & Groups. Your user there should already be selected. So click on the padlock to authenticate. Go to Login Items. In here you'll see some apps that will automatically startup when you login. So make sure you can identify everything in there. If not search for it or if it's obviously the adware you're trying to get rid of you can select it and use the minus button here to delete it.
Now it's time to look in Safari again. But instead of just launching Safari by clicking on Safari you're going to hold the Shift key down as you do so. What this does is any windows that you had opened in the previous session of Safari will not reopen. So if something is kind of in a hidden window somewhere it's going to be eliminated. So now back in Safari and you want to go to Safari Preferences. In Safari Preferences there's a couple things you want to check.
First Extensions. Go to Extensions here and it shows you list of extensions. This is a place where sometimes if you had adware installed it's going to be installed as a Safari extension. So you look through here and you make sure you identify everything. Here's the DuckDuckGo privacy extension. I did a tutorial on that a little while ago which is why it's installed. I remember installing it. I know why it's there. I'm good. But if you look at the other things here you may find something there that you don't know what it is. You can search for it or maybe you find the thing that's obviously adware and you can select it and delete it. Don't just deactivate it. Actually just uninstall it with this Uninstall button right here.
Also, you can go in the General tab and there's Homepage here. Sometimes what adware does is it changes the Homepage on your browser. So even after you've uninstalled it completely you notice that whenever you open up a new browser window it goes to some weird search engine or some ad or something like that. So check what's here. I have it set to wikipedia from a previous tutorial but you may have it set to nothing, or to Goggle, or something like that. Just make sure that's something you want there as your Homepage.
One last general piece of advice. You may want to just, at this point, do an Applications audit on your Mac. So, in the Finder, open a New Finder Window, and you can click on Applications on the sidebar there or go to Applications. Look through all of the applications you see that you have installed. Just do it one by one. Take your time. Almost all of these, and probably all of them, are going to be just fine. You'll recognize them as something you've installed or something that should be there. If there's something you don't recognize, again, Goggle it, see what it is. Just don't blindly delete something that you're unsure about because a lot of things in here that may not have the name you expect or you may not have realize they're on your Mac.
But if you see something that's obviously the piece of adware you're dealing with then you're going to want to clean it out of your Applications folder even if it's not set to launch automatically or do anything like that. You don't want it on your Mac. It's a good idea to just do an audit and look through them. I've got, you can see, 154 items here. It wouldn't take me that long to get through them. I'm a pro user that's been adding apps, and I have lots of apps for development and for video editing, for all sorts of things in here. So you probably have even less. Most of these will be things you recognize. There's iMovie, there's Word, there's Pixelmator, Acorn. All the stuff that you probably recognize right at a glance. So it will be quick to go through this and see what, maybe, shouldn't be there.

Comments: 4 Responses to “Checking For and Removing Adware From Your Mac”

FoolishCop

6 years ago

Thanks for this video! The very first thing I checked was my LaunchAgents folder and found a number of items from something called Tolitek, which a quick search told me was malware. It's since been deleted. Thanks again!

Lars Kjeldsen

Extremely useful video. Learned a lot of malware and where on my Mac it is hidden. Fx I finally got rid of this annoying malware in the upstart: com.macpaw.CleanMyMac3.Agent.plist. It has been haunting my computer in the upstart for ages.

Shirley

Do you mean that if you find something that you don't recognize or used in the past but no longer do for example "atomic bird.macaroni.launchd.plst", that you can drag those items to the trash?

Gary Rosenzweig

Shirley: I wouldn't drag anything to the trash unless you know what it is. So in your example, if you knew what "atomic bird.macaroni" was referring too, like maybe a piece of software you installed but no longer use, then trash it. But if you don't recognize it, I would search the web for it and figure it out.

Comments Closed.

Checking For and Removing Adware From Your Mac

Comments: 4 Responses to “Checking For and Removing Adware From Your Mac”

Welcome to MacMost

Free Weekly Newsletter

MacMost Online Courses

Keyboard Shortcuts PDF

Connect with MacMost

MacMost Sections

Popular Tutorials

Information