remove Mac Cleaner

can I hop on the end here... I have been following along and using your info Linc, thanks... I have been at this for days after getting my computer back from the doctors after a major virus attack and then deciding to finally upgrade.. but the attack continued and I have been weeding out files and I am no geek I tell you.. so I include two screen shots and safari and google chrome have no rogue extensions... chrome however seems to be the one that keeps presenting with the adware popups that freeze the window.. so do I have any offending files in the remaining systems do you think... thanks for the help and to everyones input.... what would be do with out each other... lol.

this is the latest window on google chrome.. so it is not beaten yet obviously... any words of wisdom folks... I am having to do a force quit pretty much every time I try to use chrome... it has become the litmus test...

Just to note, you didn't need to create three separate replies to post three images. They all could have gone in one post. The easiest way to add images is to drag them into the reply field. Like this:

The screen grab doesn't pick up the mouse, but that's me dragging one of your images in. It will placed where the green box is. You can even drag in all three at the same time.

Per your screen shots. Like all the data mining Google's apps do in the background, the free version of Paragon NTFS for Mac (for Seagate drive owners) also does data mining. That's the trade-off for getting free software.

Couldn't find any reference for player.view.update.plist. No idea what installed that.

pcv.hlpramcn.plist is part of the scam software, Advanced Mac Cleaner. That's only one part. To fully remove it, I'd use MalwareBytes for Mac. It should be able to find and remove all pieces of it.

Thank you, your information provided worked! Removed unwanted application install from Finder and was surprised when popup continued. I had zip cloud in /Library/LaunchAgents. Deleted the 3 items. Your input saved me!

Hi Linc,

I use chrome. I downloaded a flash player and got the 'Safesearch' malware and 'advanced mac cleaner' downloaded. It set my browser to default to 'safesearch' so I went in to Chrome extensions to remove it. I hadn't done this for Safari until now. See below.I also removed the application from Applications folder in Finder. What happens now is this pop up about once a day: How do I delete it please?

As per your instruction:

Hi Linc,

I too inadvertently updated Flash Player from a non-adobe site. I have removed most of the adware per your instructions - Thanks!

But I'm still getting:

and here are the files in LaunchAgent:

Thanks for your help....Paul

Took shot of the Launchdaemons just in case you see something that's not supposed to be there.

This is all I needed to do, right? The MacCleaner is off, no longer in apps. The only thing is that one Java pls in the launch folder. My wife is taking a test online for work that requires Java, so she'll take it and then I'll remove asap since you or someone said it slows the system or isn't good for it.

Someone also mentioned that there is a Mac-friendly adware or malware remover, is that right?

Thanks for your help.

Nothing you have listed needs to be removed.

No, Java does not slow your system down. It's only needed (Oracle's version 8) to access web based Java sites. When your wife has completed her online tests, you can either disable, or remove it.

1. To disable Java, launch the System Preferences and click on the Java icon in the bottom row. When the Java control panel comes up, click on the Security tab and uncheck the top box, as shown here:

Click Apply (it's grayed out in this screen shot because I haven't changed any settings).

That's it. Java is now disabled for the web and can't do anything until you re-enable it.

2. If you want to remove it entirely, you simply need to remove two items from your drive.

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin

/Library/PreferencePanes/JavaControlPanel.prefPane

This is the root Library folder next to Applications and System when you double click the main startup drive icon on your desktop. DO NOT remove the entire Library folder. Open that folder, then each listed subfolder to remove the two color highlighted items within them.

com.updater.mcy and com.updater.watch.mcy both belong to MacKeeper. As does the much more obviously named com.mackeeper.MacKeeper.Helper.plist. Remove all of these.

pct.hipramcn.plist belongs to Advanced Mac Cleaner. Another scam cleaning app you likely picked up as adware.

You didn't find anything in the one search because you missed a letter. It's /Library/LaunchDaemons

There's no telling how much more junk you may have on your Mac, besides what we can already see. It would be far simpler to run MalwareBytes for Mac and let is properly remove MacKeeper, Advanced Mac Cleaner, and whatever other crap it finds.

I should say my upgrade was to el capitan from XOS 10.6.8 .. so there may have been some deeply embedded things but nothing showed up until I downloaded a flash player upgrade ... and woosh everything went to ****..

but nothing showed up until I downloaded a flash player upgrade ... and woosh everything went to ****.

And that was the mistake. I would have to presume some web site insisted Flash needed to be updated with a popup, and you then downloaded and installed a file from that site.

Never, never, ever download anything a web site tells you to install. Unless it's directly from Adobe, a file a site claims is a Flash player update will always be fake. And will always contain adware, or worse.

The only place to download the Flash Player is directly from Adobe. Ignore any other site prompting you to download Flash, Shockwave, a codec, or anything else they claim you need to view or use the site.

Just from the little I can see, you have a LOT of garbage on your Mac. Avast actually being one of the worst things you have installed. Get rid of it and never install any AV software again. They are all useless and are virtually all known to make your Mac run worse instead of better.

You have at least four different types of adware installed, and from the sounds of things regarding Chrome (only happens there), you have at least one Chrome plugin causing a lot of ads to be displayed, and possibly also that fake warning insisting you call a number for help. DO NOT CALL THEM! They are crooks. There's nothing to fix because there's nothing wrong. Chrome is simply caught in a JavaScript loop. You dismiss the popup, and the JavaScript action displays it again.

Do this the easy way. Download and run MalwareBytes for Mac. It will locate and offer to remove any adware, rogue browser plugins and other junk it finds. Since this junk is changing daily, it may not find everything, but it will at least be a start at removing a lot of it. And to repeat, get rid of Avast.

Hi Kurt... thanks for your reply, firstly, my tech put avast on in the process of trying to get rid of the many viruses it seems I had accumulated unknowingly over a period of time. It has so far continued to pick up several a day while I have managed to follow instructions like these to weed out the rest. since taking the pic yesterday, while waiting for someone to tell me which of the beasties in my file was not needed, ( which you didn't do just told me all the same don't do this, don't do that that there is already pages of discussion about here ... thanks) actual info of rogue files would be more useful. I read through Lincs directions to others and also because I know the pops ups so well now managed to spot some fairly well hidden folders just sitting there in the apps library waiting to re infect. Sooo. long story short, so far so good, a whole evening with no pop up windows and no chrome freezing. I have no extra plugins on my chrome. I don't call anyone but apple unless I have to and following the discussion here there is debate about whether they know what to do or not. I would just like to say thanks to people like Linc who offer real solutions....not dire warnings that gee... by now we have all pretty much figured out if we have ended up here but cheers, thanks for the info. 😁 oh and by the way you are advocating using a program that others say is just as bad and creates it's own problems, so surely it is a matter of horses for courses my dear.

my tech put avast on in the process of trying to get rid of the many viruses it seems I had accumulated unknowingly over a period of time.

If it found any actual viruses at all, they would be for Windows. There is not, and has yet to be a virus that affects the Mac OS. Lot's of Trojans, which is something that can only get on your system if you install it, such as the adware you installed from the fake Flash installer. Those and social engineering. Not any kind of malware at all, but things like fake emails saying things like your Apple account has been locked and you need to go to some faked "Apple" site to enter your ID and password.

To repeat. AV software is useless for your Mac. It can only help in catching Windows malware as email attachments so you don't accidentally forward them to Windows users. AV software isn't doing anything for you other than slowing your Mac down.

Linc's directions were very useful - when they were written. Adware and other Mac malware (such as emerging ransomware threats) are way past what those instructions can help with. Apple used to have their own manual removal instructions, but have removed the page because, 1) they were sorely out of date, 2) the page would have to be a mile long to even attempt to keep up with what's been introduced since then.

not dire warnings

What dire warnings? All you have to do is read any of hundreds of recent posts where essentially every long time user will tell you in the blink of an eye to get rid of any AV software.

oh and by the way you are advocating using a program that others say is just as bad and creates it's own problems

And who are these "others"? With the exception of, literally, ONE person who railed against using such software, there is not one other person on these forums who would tell you not to use MalwareBytes for Mac. We all recommend it because it's safe, and it works. Apple's own Genius staff uses it in the Apple Stores, and Apple's phone support will send callers to the site to download and use it. Does that sound like bad software to you?

Linc hasn't posted in the ASC for several months. You might want to consider starting a new discussion. Since this one is a couple of years old, less people are likely to look at it. A new post would be much more visible. You can link to this one.

Uninstall Sophos. It tends to interfere with the computer's operation while providing minimal to no benefit.

Sophos Un-install

Hi Ron, which launch agents should I remove?... I suppose MacKeeper, but ... anything else? Thanks!!!!

Step 1

Step 2

Step 3

Step 4