Ron Zellner

Q: remove Mac Cleaner

I just updated to OS 10.10.5 on my iMac and Advanced Mac Cleaner suddenly appeared on my Dock.  I have read that this may be a troublesome application in general.  I am concerned that it appeared uninvited during what I thought was a standard, prompted update process.  They have an uninstaller download that requires my logon password.  I do not feel comfortable with any of their resources.  I have removed any associated files in the standard manner.  Any advice or precautions you can offer would be appreciated.

iMac, Mac Pro, MacBook, Mac OS X (10.5.2)

Posted on Sep 5, 2015 9:27 PM

Close

Q: remove Mac Cleaner

  • All replies
  • Helpful answers

Page 1 of 3 last Next
  • by Ron Zellner,

    Ron Zellner Ron Zellner Sep 5, 2015 9:49 PM in response to Ron Zellner
    Level 1 (5 points)
    iWork
    Sep 5, 2015 9:49 PM in response to Ron Zellner

    ZipCloud also appeared on my Dock after the update process.  Is this related?  Is it legitimate?  It is not in my login items, but does appear on restart.  It's an app in my applications folder.

     

    I have two free apps from FIPLAB  (Duplicate Detective and Memory Clean), can there be a connection to these?

  • by pinkstones,

    pinkstones pinkstones Sep 6, 2015 3:36 AM in response to Ron Zellner
    Level 5 (4,209 points)
    Safari
    Sep 6, 2015 3:36 AM in response to Ron Zellner

    Yes, because you don't need those programs.  They're pointless.  Literally, completely pointless.  You don't treat Macs like you do PCs.  So, uninstall those two programs, and follow all instructions necessary for getting rid of MacCleaner and ZipCloud.

  • by Linc Davis,Helpful

    Linc Davis Linc Davis Sep 6, 2015 7:22 AM in response to Ron Zellner
    Level 10 (207,990 points)
    Applications
    Sep 6, 2015 7:22 AM in response to Ron Zellner

    A

    You installed a fake "utility" called "Advanced Mac Cleaner." Like any software that purports to automatically "clean up" or "speed up" a Mac, it's a scam. To remove it, take the steps below. Some of the files listed may be absent. Back up all data before proceeding.

    If you paid for the software with a credit card, consider reporting the charge to the bank as fraudulent.

    Step 1

    Triple-click anywhere in the line below on this page to select it:

    ~/Library/LaunchAgents/com.pcv.hlpramc.plist

    Right-click or control-click the highlighted line and select

              Services Reveal in Finder (or just Reveal)

    from the contextual menu.* A folder should open with an item selected. Move the selected item to the Trash. Log out or restart the computer.

    *If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination  command-C. In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

    Step 2

    Move the following item to the Trash as in Step 1:

    /Library/Application Support/amc

    This time you may be prompted for your administrator login password. There's no need to log out after taking this step.

    Step 3

    Move this item to the Trash:

    ~/Library/AdvancedMacCleaner

    Step 4

    Open the Applications folder and move an item named "Advanced Mac Cleaner" (if it's present) to the Trash. Empty the Trash.

    B

    "ZipCloud," sometimes named "JustCloud," is a cloud-storage service with a doubtful reputation. The OS X client is sometimes distributed along with malware. Although ZipCloud may not be malicious itself, it should be suspected by virtue of the company it keeps.

    To remove ZipCloud, start by backing up all data (not with ZipCloud itself, of course.)

    Quit the "ZipCloud" or "JustCloud" application, if it's running, and drag it from the Applications folder to the Trash. Don't try to empty yet.

    Triple-click anywhere in the line below on this page to select it:

    ~/Library/LaunchAgents

    Right-click or control-click the highlighted line and select

              Services Open

    from the contextual menu.* A folder named "LaunchAgents" should open.

    In the folder, there may be one or more files with a name beginning as follows:

               com.jdibackup.

    Move all such files to the Trash.

    Log out or restart the computer and empty the Trash.

    *If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination  command-C. In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

    C

    You may have installed ad-injection malware ("adware").

    Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

    Some of the most common types of adware can be removed by following Apple's instructions. If those instructions don't work for you, or if you have trouble following them, see below.

    This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure that doesn't involve downloading anything.

    Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

    If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. That will disable the malware temporarily.

    Step 1

    Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

    ~/Library/LaunchAgents

    In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

    If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

    There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

    Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

    Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

    Leave the folder open for now.

    Step 2

    Do as in Step 1 with this line:

    /Library/LaunchAgents

    The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

    Step 3

    Repeat with this line:

    /Library/LaunchDaemons

    This time the folder will be named "LaunchDaemons."

    Step 4

    Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

    Step 5

    If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

  • by Ron Zellner,

    Ron Zellner Ron Zellner Sep 6, 2015 2:17 PM in response to Linc Davis
    Level 1 (5 points)
    iWork
    Sep 6, 2015 2:17 PM in response to Linc Davis

    Thank you for the information.  I have deleted all of the resources that you have identified that I could find.  As I said, I did not realize that I was installing these resources, I was responding to a standard OS update request that appeared on my desk top.  I was not aware that I was installing anything other than the new OS 10.10.5, but the apps updater may have actually been responding to some apps that were there from some previous action.  I did buy and install MacKeeper a while back but I thought I had successfully removed that a few months ago.  I have had a general problem of a slow down when opening applications like MS Word, especially slow when naming and saving a new file.  There were times when I could hear my hard drive continually working much like when it is indexing files, especially when waking the computer in the morning. That got better after removing MacKeeper.  Was wondering if that was related to Spotlight settings or activity.

  • by Eric Root,

    Eric Root Eric Root Sep 7, 2015 1:52 PM in response to Ron Zellner
    Level 9 (71,686 points)
    iTunes
    Sep 7, 2015 1:52 PM in response to Ron Zellner

    Activity Monitor - Mavericks  also Yosemite

     

    Activity Monitor in Mavericks has significant changes

     

    Performance Guide

     

    Why is my computer slow

     

    Why your Mac runs slower than it should

     

    Slow Mac After Mavericks

     

    Things you can do to resolve slowdowns  see post by Kappy

     

    6 Easy Tips to Speed Up OS X Yosemite on Your Mac

     

    Try running this program and then copy and paste the output in a reply. The program was created by Etresoft, a frequent contributor.  Please use copy and paste as screen shots can be hard to read.

     

     

     

     

     

    Etrecheck – System Information

     

  • by veni_vidi_vitty,

    veni_vidi_vitty veni_vidi_vitty Oct 10, 2015 7:53 AM in response to Linc Davis
    Level 1 (0 points)
    Oct 10, 2015 7:53 AM in response to Linc Davis

    Thank you, Linc Davis!  I downloaded mac cleaner from Cnet of all places... and then realized it was a scam.  Your instructions were clear and helpful.

  • by Globettotter,

    Globettotter Globettotter Dec 10, 2015 5:00 AM in response to Linc Davis
    Level 1 (0 points)
    Dec 10, 2015 5:00 AM in response to Linc Davis

    Screen Shot 2015-12-10 at 10.08.38.pngScreen Shot 2015-12-10 at 10.08.38.png

     

    After deleting the Mac Cleaner app a few weeks ago I noticed I would get a single flash of my screen around midnight. This started to be of concern and I felt that there must be something lurking in the background. Yesterday (9th Dec) I got the "Recommended Download" pop up shown which is clearly related to the same set of malware as the "Need more hard disk space on this Mac?" which by its screen shot (dated 27th Sept) would have been deleted not too long after.

     

    I went through your complete list carefully. All I had left on my MBP was the first item in your list - A Step 1, ~/Library/LaunchAgents/com.pcv.hlpramc.plist. I deleted that and restarted my computer.

     

    I have been scanning through my active processes (in Activity Monitor) to see if there is anything that looks suspicious. But it is hard to tell unless you are an expert in OS X processes.

     

    As I have used FileZilla in the past, I thought re-installing it onto my new laptop would be a good idea. I also made the mistake of signing up for ZipCloud before realising that was a bad idea and cancelling the same day before any transactions were honored. So it could be that I picked up the malware from one of those sources.

     

    As for my screen flash, I am definitely not hallucinating. I will observe to see if it still happens.

  • by Linc Davis,

    Linc Davis Linc Davis Dec 10, 2015 10:22 AM in response to Globettotter
    Level 10 (207,990 points)
    Applications
    Dec 10, 2015 10:22 AM in response to Globettotter

    You may have installed ad-injection malware ("adware").

    Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

    Some of the most common types of adware can be removed by following Apple's instructions.

    If you're not already running the latest version of OS X ("El Capitan"), updating or upgrading in the App Store may cause the adware to be removed automatically. Back up all data before taking that step. If you're already running the latest version of El Capitan, you can nevertheless download the current updater from the Apple Support Downloads page and run it. Again, some kinds of malware will be removed. That may be all you need to do as far as removal is concerned, but you'll still need to make changes to the way you use the computer to protect yourself from further attacks.

    If the above steps don't work for you, see below.

    This easy procedure will detect any kind of adware that I know of. Deactivating it is a separate, and even easier, procedure.

    Some legitimate software is ad-supported and may display ads in its own windows or in a web browser while it's running. That's not malware and it may not show up. Also, some websites carry intrusive popup ads that may be mistaken for adware.

    If none of your web browsers is working well enough to carry out these instructions, restart the computer in safe mode. That will disable the malware temporarily.

    Step 1

    Please triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

    ~/Library/LaunchAgents

    In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. Press return. Either a folder named "LaunchAgents" will open, or you'll get a notice that the folder can't be found. If the folder isn't found, go to the next step.

    If the folder does open, press the key combination command-2 to select list view, if it's not already selected. Please don't skip this step.

    There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. If necessary, enlarge the window so that all of the contents are showing.

    Follow the instructions in this support article under the heading "Take a screenshot of a window." An image file with a name beginning in "Screen Shot" should be saved to the Desktop. Open the screenshot and make sure it's readable. If not, capture a smaller part of the screen showing only what needs to be shown.

    Start a reply to this message. Drag the image file into the editing window to upload it. You can also include text in the reply.

    Leave the folder open for now.

    Step 2

    Do as in Step 1 with this line:

    /Library/LaunchAgents

    The folder that may open will have the same name, but is not the same, as the one in Step 1. As in that step, the folder may not exist.

    Step 3

    Repeat with this line:

    /Library/LaunchDaemons

    This time the folder will be named "LaunchDaemons."

    Step 4

    Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

    Step 5

    If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

  • by philhansen,

    philhansen philhansen Dec 18, 2015 1:20 PM in response to Linc Davis
    Level 1 (4 points)
    Desktops
    Dec 18, 2015 1:20 PM in response to Linc Davis

    Thanks, Linc. Worked great.

  • by rjavier29,

    rjavier29 rjavier29 Dec 27, 2015 9:50 PM in response to Linc Davis
    Level 1 (0 points)
    Dec 27, 2015 9:50 PM in response to Linc Davis

    Screen Shot 2015-12-27 at 10.41.04 PM.png

  • by philhansen,

    philhansen philhansen Dec 29, 2015 6:02 AM in response to rjavier29
    Level 1 (4 points)
    Desktops
    Dec 29, 2015 6:02 AM in response to rjavier29

    What does this mean? Do we have to trash all of these files?

     

    Phil

  • by jlindsay130,

    jlindsay130 jlindsay130 Mar 19, 2016 4:24 PM in response to Linc Davis
    Level 1 (0 points)
    Mar 19, 2016 4:24 PM in response to Linc Davis

    Hi Linc -

    Yikes - I hope you can help me.  I have tried everything to get this evil adware off my computer!  Not sure what to do next. Let me know - Thanks, JL 

    lScreen Shot 2016-03-19 at 4.08.37 PM.png

    Screen Shot 2016-03-19 at 4.11.11 PM.png

     

    Screen Shot 2016-03-19 at 4.12.36 PM.png

  • by limme31,

    limme31 limme31 Apr 19, 2016 2:48 PM in response to Linc Davis
    Level 1 (4 points)
    Apr 19, 2016 2:48 PM in response to Linc Davis

    Thanks for your help Linc. I wonder if you can help me out with the last few steps? I've taken screenshots of the files within

    '~/Library/LaunchAgents' and '/Library/LaunchAgents' and '/Library/LaunchDaemons'.

    Now what happens? Should I be posting the screenshots in this reply?

     

    Also, I'm confused about these steps:

    Step 4

    Open the Safari preferences window and select the Extensions tab. If any extensions are listed, post a screenshot. If there are no extensions, or if you can't launch Safari, skip this step.

    Step 5

    If you use the Firefox or Chrome browser, open its extension list and do as in Step 4.

    If you, or anyone else could help me out with this I'd really appreciate it!

    Thanks in advance!

  • by Angel CD,

    Angel CD Angel CD May 3, 2016 7:12 AM in response to Linc Davis
    Level 1 (4 points)
    May 3, 2016 7:12 AM in response to Linc Davis

    Screen Shot 2016-05-03 at 6.56.02 AM.png Screen Shot 2016-05-03 at 7.06.29 AM.pngScreen Shot 2016-05-03 at 7.08.40 AM.pngScreen Shot 2016-05-03 at 7.09.39 AM.png

Page 1 of 3 last Next