Why is there AdGuard DNS on my MacBook?

epsilon-11 wrote:

i'm stupid. forgot i ran that bc adguard was showing up blocking things on my mac. when i try to go to some pages it says the certificate is from dns.adguard.com (blocking websites) never installed adguard. HELP please. why is there adguard dns on my mac?

Perhaps another user installed it. Or you did and forgot; or it might have been installed unintentionally when you or some other user visited a web site or downloaded and installed something that was bundled with adguard.

You can go to About This Mac, choose System Report, look for Software => Applications and you can see when adguard was installed or at least last modified.

epsilon-11 wrote:

i ran the uninstall terminal command, and, it uninstalled browser extentions i didnt know i had...? how is this not picked up by malwarebytes and avast? and the process is still running. plus i wiped this computer around may 22. also, the app .com.apple.ctcatergories is listed as unknown obtained from. and Library/Application Scripts/group.is.workflow.my.app. also unknown. adguard is not listed.

Because none of them are malware. All of this is stuff someone with access to your computer installed. It doesn’t magically get there by itself. Either it came bundled with something you installed or you allowed someone access to your Mac.

Some uninstallers don’t work completely because they are made by companies who don’t care to clean up after themselves.

You can “wipe” a modern Mac and then migrate everything you had previously installed. The OS is isolated from your data, some Apple apps, and all third-party apps.

Besides installing something without knowing you installed it, what is wrong with your Mac. You made several posts with log entries you don’t understand and somehow equate that with malware. You haven’t stated a problem with your Mac. You are digging into the logs expecting some malware to be there saying, “surprise, you found me.” Isn’t going to happen. You will find thousands of nefarious sounding log entries. None of them will be malware.

Check with whoever is maintaining your local network, and see if local DNS has been configured in the DHCP server. That might be part of the ISP gateway / firewall / router box, or might be some other local network gear. That can deliver customized DNS settings.

Also check whether local DNS settings were overridden in macOS network settings:

Change DNS settings on Mac - Apple Support

And if you have any add-on VPN clients, any add-on security apps, or otherwise, remove those per the vendors’ instructions.

Failing that, time to look at some configuration details… Download and run EtreCheck, and share the generated results to the clipboard. Then open a new reply here, and press the Additional Text button that looks like a printed pate to get a text input box big enough to paste the hardware and software configuration report here, and paste and post that report here.

epsilon-11 wrote:

i ran the uninstall terminal command, and, it uninstalled browser extentions i didnt know i had...? how is this not picked up by malwarebytes and avast? and the process is still running. plus i wiped this computer around may 22. also, the app .com.apple.ctcatergories is listed as unknown obtained from. and Library/Application Scripts/group.is.workflow.my.app. also unknown. adguard is not listed.

Uninstall AVAST and post the etrecheck report as suggested by MrHoffman above.

I have a difficult time distinguishing Avast from malware, given their history.

This whole area of add-on security tooling is problematic, given how anti-malware ties into the platform, given how poorly too much of the add-on anti-malware around is maintained, and particularly given how some add-on anti-malware has a history of stealing and selling personally-identified metadata.

That's before we discuss the vulnerabilities that add-on anti-malware can add—yes, anti-malware tooling itself can be a target for malware and espionage—and the corruptions and crashes and instabilities and performance-degradation that can arise with add-on anti-malware tooling. And seemingly, for little benefit over the built-in tooling.

Not only is too much of the add-on anti-malware ineffective or problematic or corruption-causing or all to noisy and fond of self-aggrandizing and spurious messages, but some steals and sells.

There have been various cases of the built-in tooling preventing the add-on anti-malware tooling from corrupting macOS itself, too. Cases which usually end up with users of the add-ons demanding the deletion of some part of macOS itself due to a false positive in the add-on, at least until the add-on anti-malware vendor corrects their detection to suppress the false positive.

Remove the add-on anti-malware per the vendors' instructions, and then please post the Etrecheck report.

Some background on the anti-malware market for swiping your metadata, and about Avast selling personally-identified metadata specifically:

https://www.vice.com/en/article/qjdkq7/avast-antivirus-sells-user-browsing-data-investigation

epsilon-11 wrote:

and avast?

There your problem. You got more than you bargained for.

Third party AntiVirus is not recommended— it typically does nothing but add issues to the macOS and competes directly with Apple’s own built in security:

macOS antivirus - Protecting against malware in macOS - Apple Support

macOS - Security - Apple  macOS - Security - Apple

Apple Platform Security - Apple Apple Platform Security - Apple Support

epsilon-11 wrote:

did not install adguard, yet found this in zsh history \

\

sudo rm -R "/Library/Application Support/AdGuard Software/com.adguard.mac.adguard"\

rm -R "$HOME/Library/Application Support/com.adguard.mac.adguard"\

rm $HOME/Library/Preferences/com.adguard.mac.adguard.plist\

rm -R "$HOME/Library/Group Containers/TC3Q7MAJXF.com.adguard.mac"\

find "$HOME/Library/Application Support" -name "com.adguard.browser_extension_host.nm.json" -delete\

sudo rm /Library/LaunchDaemons/com.adguard.mac.adguard.adguard-pac.daemon.plist\

sudo rm /Library/LaunchDaemons/com.adguard.mac.adguard.adguard-tun-helper.daemon.plist\

sudo rm /Library/Logs/com.adguard.mac.adguard/com.adguard.mac.adguard.adguard-pac.daemon.log\

sudo rm /Library/Logs/com.adguard.mac.adguard/com.adguard.mac.adguard.adguard-tun-helper.daemon.log\

\

\

sudo rm -R "/Library/Application Support/AdGuard Software/com.adguard.mac.adguard"\

rm -R "$HOME/Library/Application Support/com.adguard.mac.adguard"\

rm $HOME/Library/Preferences/com.adguard.mac.adguard.plist\

rm -R "$HOME/Library/Group Containers/TC3Q7MAJXF.com.adguard.mac"\

find "$HOME/Library/Application Support" -name "com.adguard.browser_extension_host.nm.json" -delete\

sudo rm /Library/LaunchDaemons/com.adguard.mac.adguard.adguard-pac.daemon.plist\

sudo rm /Library/LaunchDaemons/com.adguard.mac.adguard.adguard-tun-helper.daemon.plist\

sudo rm /Library/Logs/com.adguard.mac.adguard/com.adguard.mac.adguard.adguard-pac.daemon.log\

sudo rm /Library/Logs/com.adguard.mac.adguard/com.adguard.mac.adguard.adguard-tun-helper.daemon.log\

\

\

any ideas why?

those are al the remove (RM) command—remove directory entries

ref: https://adguard.com/kb/adguard-for-mac/installation/

epsilon-11 wrote:

i'm stupid. forgot i ran that bc adguard was showing up blocking things on my mac. when i try to go to some pages it says the certificate is from dns.adguard.com (blocking websites) never installed adguard. HELP please. why is there adguard dns on my mac?

If you you ever ran a VPN(?) might be a good guess...

or use the ad blocker as an add-on or extension in a browser

A little ditty from a well Respected Contributor 😎 who does make an appearance in this, your question

Avast AntiVirus

FTC Order Will Ban Avast from Selling Browsing Data for Advertising Purposes, Require It to Pay $16.5 Million Over Charges the Firm Sold Browsing Data After Claiming Its Products Would Block Online Tracking 

FTC says despite its promises to protect consumers from online tracking, Avast sold consumers' browsing data to third parties

https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-ban-avast-selling-browsing-data-advertising-purposes-require-it-pay-165-million-over

epsilon-11 wrote:

nope, i just wiped the computer. and i dont install extentions. router possibly?

You did say you installed AVAST and Malwarebytes however. What else have you installed?