Announcement: Get Ready for macOS Mojave


With features like Dark Mode, Stacks, and four new built-in apps, macOS Mojave helps you get more out of every click. Prepare for macOS Mojave > https://support.apple.com/macos/mojave

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Question:

Question: how to remove mac adware cleaner pop up window

I have a pop up window whenever I'm in google chrome that says, "Recommended download, install mac adware cleaner" now to protect our mac device from malware, adware and other security threats. Is this a real pop up or an adware?

How do i get rid of it?

thanks

MacBook Pro, OS X Yosemite (10.10.5)

Posted on

Reply
Question marked as Helpful

Aug 23, 2016 8:24 PM in response to Linc Davis In response to Linc Davis

I deleted Adware Mac Cleaner with no problem, but in my activity monitor I found 'helperamc' deeply buried in my computer. Every time I try to delete the file, it says I can't because it's open. Went to activity monitor to force quit it, but it just doesn't respond. Not sure what to do. ;(

Any tips?

Question marked as Helpful

Dec 31, 2015 8:45 AM in response to Supermom66 In response to Supermom66

A

First, never use any kind of "anti-virus" or "anti-malware" software on a Mac. That's how you create problems, not how you solve them.

B

You may have installed a fake "utility" called "Advanced Mac Cleaner." Like any software that purports to automatically "clean up" or "speed up" a Mac, it's a scam, and some variants of it are ad-injection malware.

To remove it, please take the steps below. Some of the files listed may be absent in your case. Back up all data before proceeding.

Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

If you paid for the software with a credit card, consider reporting the charge to the bank as fraudulent.

Step 1

Triple-click anywhere in the line below on this page to select it:

~/Library/LaunchAgents

Right-click or control-click the highlighted line and select

Services Open

from the contextual menu.* A folder named "LaunchAgents" may open. If it does, look inside it for files with a name that begins in either of these ways:

com.pcv.

com.WebShoppy

Move any such file to the Trash.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

Step 2

Open this folder as in Step 1:

/Library/LaunchAgents

Inside it there may be one or more files with a name beginning in

com.WebTools

If so, move those files, and only those, to the Trash. You may be prompted for your administrator login password.

Don't delete the LaunchAgents folder or anything else inside it.

Log out or restart the computer.

Step 3

Open the Applications folder and move an item named "Advanced Mac Cleaner" (if it's present) to the Trash. Also remove any items with a name such as "Shoppy" or "WebShoppy." Empty the Trash.

Step 4

In the Extensions tab of the Safari preferences window, uninstall an extension named "XSearch" if it's present. Also remove any other extensions that you don't know you need. If in doubt, remove all of them. None is required for normal operation. You may have to do the equivalent in the Chrome and Firefox browsers, if you use either of those.

Step 5

The malware is now permanently inactivated, provided that you don't reinstall it. This step is optional.

Delete the following items, if they exist, as in Step 1:

/Library/Application Support/amc

~/Library/AdvancedMacCleaner

~/Library/Application Support/WebTools

There's no need to log out or restart after taking this step.

The problem may have started when you downloaded something, such as the application "FileZilla," from the "Sourceforge" website or some other Internet cesspit. Never visit that site again. All software should be downloaded only from the developer's website or from the Mac App Store, if applicable.

C

Links have been posted in this thread to the "macupdate" website. Do not follow the links, and never download anything from that site. It intentionally distributes OS X malware by packaging some free applications (such as "Firefox" and "Skype") in an unnecessary and malicious "installer."

All software should be downloaded directly from the developer's website or from the App Store. Don't trust any site such as "macupdate" that aggregates links.

There’s more to the conversation

Read all replies

Page content loaded

Dec 30, 2015 11:50 PM in response to Supermom66 In response to Supermom66

Remove Browser Pop-up Problems


Malwarebytes Anti-Malware 1.0.1.7

Adblock Plus 1.8.9, GlimmerBlocker, or AdBlock

Remove adware that displays pop-up ads and graphics on your Mac

How to remove the FlashMall adware from OS X

Helpful Links Regarding Malware Problems


If you are having an immediate problem with ads popping up see The Safe Mac » Adware Removal Guide, remove adware that displays pop-up ads and graphics on your Mac, and MalwareBytes for Mac. If you require anti-virus protection Thomas Reed recommends using ClamXAV. (Thank you to Thomas Reed for this recommendation.) You might consider adding this Safari extensions: Adblock Plus 1.8.9.


Open Safari, select Preferences from the Safari menu. Click on Extensions icon in the toolbar. Disable all Extensions. If this stops your problem, then re-enable them one by one until the problem returns. Now remove that extension as it is causing the problem.


The following comes from user stevejobsfan0123. I have made minor changes to adapt to this presentation.


Fix Some Browser Pop-ups That Take Over Safari.


Common pop-ups include a message saying the government has seized your computer and you must pay to have it released (often called "Moneypak"), or a phony message saying that your computer has been infected, and you need to call a tech support number (sometimes claiming to be Apple) to get it resolved. First, understand that these pop-ups are not caused by a virus and your computer has not been affected. This "hijack" is limited to your web browser. Also understand that these messages are scams, so do not pay any money, call the listed number, or provide any personal information. This article will outline the solution to dismiss the pop-up.


Quit Safari


Usually, these pop-ups will not go away by either clicking "OK" or "Cancel." Furthermore, several menus in the menu bar may become disabled and show in gray, including the option to quit Safari. You will likely have to force quit Safari. To do this, press Command + option + esc, select Safari, and press Force Quit.


Relaunch Safari


If you relaunch Safari, the page will reopen. To prevent this from happening, hold down the 'Shift' key while opening Safari. This will prevent windows from the last time Safari was running from reopening.


This will not work in all cases. The shift key must be held at the right time, and in some cases, even if done correctly, the window reappears. In these circumstances, after force quitting Safari, turn off Wi-Fi or disconnect Ethernet, depending on how you connect to the Internet. Then relaunch Safari normally. It will try to reload the malicious webpage, but without a connection, it won't be able to. Navigate away from that page by entering a different URL, i.e. www.apple.com, and trying to load it. Now you can reconnect to the Internet, and the page you entered will appear rather than the malicious one.

Dec 30, 2015 11:50 PM

Reply Helpful (3)
Question marked as Helpful

Dec 31, 2015 8:45 AM in response to Supermom66 In response to Supermom66

A

First, never use any kind of "anti-virus" or "anti-malware" software on a Mac. That's how you create problems, not how you solve them.

B

You may have installed a fake "utility" called "Advanced Mac Cleaner." Like any software that purports to automatically "clean up" or "speed up" a Mac, it's a scam, and some variants of it are ad-injection malware.

To remove it, please take the steps below. Some of the files listed may be absent in your case. Back up all data before proceeding.

Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

If you paid for the software with a credit card, consider reporting the charge to the bank as fraudulent.

Step 1

Triple-click anywhere in the line below on this page to select it:

~/Library/LaunchAgents

Right-click or control-click the highlighted line and select

Services Open

from the contextual menu.* A folder named "LaunchAgents" may open. If it does, look inside it for files with a name that begins in either of these ways:

com.pcv.

com.WebShoppy

Move any such file to the Trash.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

Step 2

Open this folder as in Step 1:

/Library/LaunchAgents

Inside it there may be one or more files with a name beginning in

com.WebTools

If so, move those files, and only those, to the Trash. You may be prompted for your administrator login password.

Don't delete the LaunchAgents folder or anything else inside it.

Log out or restart the computer.

Step 3

Open the Applications folder and move an item named "Advanced Mac Cleaner" (if it's present) to the Trash. Also remove any items with a name such as "Shoppy" or "WebShoppy." Empty the Trash.

Step 4

In the Extensions tab of the Safari preferences window, uninstall an extension named "XSearch" if it's present. Also remove any other extensions that you don't know you need. If in doubt, remove all of them. None is required for normal operation. You may have to do the equivalent in the Chrome and Firefox browsers, if you use either of those.

Step 5

The malware is now permanently inactivated, provided that you don't reinstall it. This step is optional.

Delete the following items, if they exist, as in Step 1:

/Library/Application Support/amc

~/Library/AdvancedMacCleaner

~/Library/Application Support/WebTools

There's no need to log out or restart after taking this step.

The problem may have started when you downloaded something, such as the application "FileZilla," from the "Sourceforge" website or some other Internet cesspit. Never visit that site again. All software should be downloaded only from the developer's website or from the Mac App Store, if applicable.

C

Links have been posted in this thread to the "macupdate" website. Do not follow the links, and never download anything from that site. It intentionally distributes OS X malware by packaging some free applications (such as "Firefox" and "Skype") in an unnecessary and malicious "installer."

All software should be downloaded directly from the developer's website or from the App Store. Don't trust any site such as "macupdate" that aggregates links.

Dec 31, 2015 8:45 AM

Reply Helpful (34)

Dec 31, 2015 8:56 AM in response to Supermom66 In response to Supermom66

If what it's saying is "Recommended download, install mac adware cleaner" then you haven't installed anything. So no need to be alarmed. Follow Kappy's good advice, you need only concern yourself with getting rid of the pop-up window.

Dec 31, 2015 8:56 AM

Reply Helpful (3)

Dec 31, 2015 1:10 PM in response to Linc Davis In response to Linc Davis

Hi! Thanks for your step by step. I did find a com.pvc file and moved it to trash. My daughter said she may have accidentally installed "advanced mac cleaner app" when closing the darn pop up. Then realized it got installed when the pop up came on screen asking to "make mac faster". She deleted the "advanced mac cleaner" from the applications folder. She didn't see the "make your mac faster window pop up anymore." Then the other pop up came in which I inquired about. Thanks so much for your help. I checked the extensions on Chrome and will double check on safari but I rarely use that one.

The responses I got here; are they from Apple support people? Or is this community people who may have an answer or not. I'm wondering because the first reponse I got to this question, they were advising to install the programs to find the adware, then you said you should never do that. I agree with you. From my experience, you aren't suppose to put anything on the mac especially anit virus or anti spyware programs. Apple has that covered with it's awesome product.

I hope the fix I did works. Thanks again!

Dec 31, 2015 1:10 PM

Reply Helpful

Dec 31, 2015 1:23 PM in response to Supermom66 In response to Supermom66

The responses I got here; are they from Apple support people?

Absolutely not. The name of the site is very misleading. The responses you get here could come from anyone at all, and are not endorsed by Apple. Never forget that.

From my experience, you aren't suppose to put anything on the mac especially anit virus or anti spyware programs.

You couldn't be more right. The problem was caused by installing unknown, unnecessary software for no good reason. As long as you don't make that mistake, you'll be fine. Only install software that directly helps you to do something useful with the computer, such as a word processor, video editor, game, or the like. You didn't buy a computer so that you could "clean" it or scan it for malware, and you never need software to help you do that.

Dec 31, 2015 1:23 PM

Reply Helpful

Dec 31, 2015 1:24 PM in response to Supermom66 In response to Supermom66

There are no Apple support people here. Everyone is just a user like yourself including the person whose advise you chose to use. Note that he often expresses only personal opinions many of which have no special proof and are not Apple approved any more than other advice you find here.


There is nothing inherently wrong with installing programs on your computer to locate and remove adware. They save a lot of time in ridding your computer of malware. You don't NEED anti-malware software, but that does not mean the same thing as "never install." If Apple's awesome product had it covered, then you wouldn't have a problem with adware. Don't simply be conned into believing a long post that sounds authoritative is necessarily best advice.

Dec 31, 2015 1:24 PM

Reply Helpful (2)
Question marked as Helpful

Aug 23, 2016 8:24 PM in response to Linc Davis In response to Linc Davis

I deleted Adware Mac Cleaner with no problem, but in my activity monitor I found 'helperamc' deeply buried in my computer. Every time I try to delete the file, it says I can't because it's open. Went to activity monitor to force quit it, but it just doesn't respond. Not sure what to do. ;(

Any tips?

Aug 23, 2016 8:24 PM

Reply Helpful (60)

Aug 24, 2016 1:47 PM in response to Meremyth In response to Meremyth

You might want to start your own post since this one is from last year. A new post would be much more visible. You can link to this one.

Trash – Empty When File is Locked or in Use


Trash FAQ


Trash won’t empty

Try booting into the Safe Mode to see if you can delete it.


Safe Mode - About


Safe Mode - Yosemite

Aug 24, 2016 1:47 PM

Reply Helpful
User profile for user: Supermom66

Question: how to remove mac adware cleaner pop up window