I have a pop up window whenever I'm in google chrome that says, "Recommended download, install mac adware cleaner" now to protect our mac device from malware, adware and other security threats. Is this a real pop up or an adware?
How do i get rid of it?
thanks
MacBook Pro, OS X Yosemite (10.10.5)
A
First, never use any kind of "anti-virus" or "anti-malware" software on a Mac. That's how you create problems, not how you solve them.
B
You may have installed a fake "utility" called "Advanced Mac Cleaner." Like any software that purports to automatically "clean up" or "speed up" a Mac, it's a scam, and some variants of it are ad-injection malware.
To remove it, please take the steps below. Some of the files listed may be absent in your case. Back up all data before proceeding.
Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.
If you paid for the software with a credit card, consider reporting the charge to the bank as fraudulent.
Step 1
Triple-click anywhere in the line below on this page to select it:
~/Library/LaunchAgents
Right-click or control-click the highlighted line and select
Services ▹ Open
from the contextual menu.* A folder named "LaunchAgents" may open. If it does, look inside it for files with a name that begins in either of these ways:
com.pcv.
com.WebShoppy
Move any such file to the Trash.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.
Step 2
Open this folder as in Step 1:
/Library/LaunchAgents
Inside it there may be one or more files with a name beginning in
com.WebTools
If so, move those files, and only those, to the Trash. You may be prompted for your administrator login password.
Don't delete the LaunchAgents folder or anything else inside it.
Log out or restart the computer.
Step 3
Open the Applications folder and move an item named "Advanced Mac Cleaner" (if it's present) to the Trash. Also remove any items with a name such as "Shoppy" or "WebShoppy." Empty the Trash.
Step 4
In the Extensions tab of the Safari preferences window, uninstall an extension named "XSearch" if it's present. Also remove any other extensions that you don't know you need. If in doubt, remove all of them. None is required for normal operation. You may have to do the equivalent in the Chrome and Firefox browsers, if you use either of those.
Step 5
The malware is now permanently inactivated, provided that you don't reinstall it. This step is optional.
Delete the following items, if they exist, as in Step 1:
/Library/Application Support/amc
~/Library/AdvancedMacCleaner
~/Library/Application Support/WebTools
There's no need to log out or restart after taking this step.
The problem may have started when you downloaded something, such as the application "FileZilla," from the "Sourceforge" website or some other Internet cesspit. Never visit that site again. All software should be downloaded only from the developer's website or from the Mac App Store, if applicable.
C
Links have been posted in this thread to the "macupdate" website. Do not follow the links, and never download anything from that site. It intentionally distributes OS X malware by packaging some free applications (such as "Firefox" and "Skype") in an unnecessary and malicious "installer."
All software should be downloaded directly from the developer's website or from the App Store. Don't trust any site such as "macupdate" that aggregates links.
A
First, never use any kind of "anti-virus" or "anti-malware" software on a Mac. That's how you create problems, not how you solve them.
B
You may have installed a fake "utility" called "Advanced Mac Cleaner." Like any software that purports to automatically "clean up" or "speed up" a Mac, it's a scam, and some variants of it are ad-injection malware.
To remove it, please take the steps below. Some of the files listed may be absent in your case. Back up all data before proceeding.
Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.
If you paid for the software with a credit card, consider reporting the charge to the bank as fraudulent.
Step 1
Triple-click anywhere in the line below on this page to select it:
~/Library/LaunchAgents
Right-click or control-click the highlighted line and select
Services ▹ Open
from the contextual menu.* A folder named "LaunchAgents" may open. If it does, look inside it for files with a name that begins in either of these ways:
com.pcv.
com.WebShoppy
Move any such file to the Trash.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.
Step 2
Open this folder as in Step 1:
/Library/LaunchAgents
Inside it there may be one or more files with a name beginning in
com.WebTools
If so, move those files, and only those, to the Trash. You may be prompted for your administrator login password.
Don't delete the LaunchAgents folder or anything else inside it.
Log out or restart the computer.
Step 3
Open the Applications folder and move an item named "Advanced Mac Cleaner" (if it's present) to the Trash. Also remove any items with a name such as "Shoppy" or "WebShoppy." Empty the Trash.
Step 4
In the Extensions tab of the Safari preferences window, uninstall an extension named "XSearch" if it's present. Also remove any other extensions that you don't know you need. If in doubt, remove all of them. None is required for normal operation. You may have to do the equivalent in the Chrome and Firefox browsers, if you use either of those.
Step 5
The malware is now permanently inactivated, provided that you don't reinstall it. This step is optional.
Delete the following items, if they exist, as in Step 1:
/Library/Application Support/amc
~/Library/AdvancedMacCleaner
~/Library/Application Support/WebTools
There's no need to log out or restart after taking this step.
The problem may have started when you downloaded something, such as the application "FileZilla," from the "Sourceforge" website or some other Internet cesspit. Never visit that site again. All software should be downloaded only from the developer's website or from the Mac App Store, if applicable.
C
Links have been posted in this thread to the "macupdate" website. Do not follow the links, and never download anything from that site. It intentionally distributes OS X malware by packaging some free applications (such as "Firefox" and "Skype") in an unnecessary and malicious "installer."
All software should be downloaded directly from the developer's website or from the App Store. Don't trust any site such as "macupdate" that aggregates links.
I have this question also. I am waiting for a reply.
Remove Browser Pop-up Problems
Malwarebytes Anti-Malware 1.0.1.7
Adblock Plus 1.8.9, GlimmerBlocker, or AdBlock
Remove adware that displays pop-up ads and graphics on your Mac
How to remove the FlashMall adware from OS X
Helpful Links Regarding Malware Problems
If you are having an immediate problem with ads popping up see The Safe Mac » Adware Removal Guide, remove adware that displays pop-up ads and graphics on your Mac, and MalwareBytes for Mac. If you require anti-virus protection Thomas Reed recommends using ClamXAV. (Thank you to Thomas Reed for this recommendation.) You might consider adding this Safari extensions: Adblock Plus 1.8.9.
Open Safari, select Preferences from the Safari menu. Click on Extensions icon in the toolbar. Disable all Extensions. If this stops your problem, then re-enable them one by one until the problem returns. Now remove that extension as it is causing the problem.
The following comes from user stevejobsfan0123. I have made minor changes to adapt to this presentation.
Fix Some Browser Pop-ups That Take Over Safari.
Common pop-ups include a message saying the government has seized your computer and you must pay to have it released (often called "Moneypak"), or a phony message saying that your computer has been infected, and you need to call a tech support number (sometimes claiming to be Apple) to get it resolved. First, understand that these pop-ups are not caused by a virus and your computer has not been affected. This "hijack" is limited to your web browser. Also understand that these messages are scams, so do not pay any money, call the listed number, or provide any personal information. This article will outline the solution to dismiss the pop-up.
Quit Safari
Usually, these pop-ups will not go away by either clicking "OK" or "Cancel." Furthermore, several menus in the menu bar may become disabled and show in gray, including the option to quit Safari. You will likely have to force quit Safari. To do this, press Command + option + esc, select Safari, and press Force Quit.
Relaunch Safari
If you relaunch Safari, the page will reopen. To prevent this from happening, hold down the 'Shift' key while opening Safari. This will prevent windows from the last time Safari was running from reopening.
This will not work in all cases. The shift key must be held at the right time, and in some cases, even if done correctly, the window reappears. In these circumstances, after force quitting Safari, turn off Wi-Fi or disconnect Ethernet, depending on how you connect to the Internet. Then relaunch Safari normally. It will try to reload the malicious webpage, but without a connection, it won't be able to. Navigate away from that page by entering a different URL, i.e. www.apple.com, and trying to load it. Now you can reconnect to the Internet, and the page you entered will appear rather than the malicious one.
I agree. In fact, I was having the same problem. I followed the steps someone shared here, but I was still getting popups. Yesterday, I came across and, with cautious optimism, downloaded and installed Malwarebyte (it's free). I ran the scan operation and it discovered another 22 files identified as malware. I deleted them (some required restarted my MBP) and haven't had a popup since.
The files mentioned were there as well as many other folders/files under the library general area (look around and open all dropdowns). Here are some I found as of 11/28/16:
/awc
/mac adware cleaner
/mac adware cleaner 3.02.56PM
/mac file opener
/hlpramc
/hlprawc
The Malwarebytes (with an "s," which I erroneously left off before) software scanned and listed them as well as the location of each file. In addition, Malwarebytes had each one checked to be deleted. I didn't record any of that information - I just clicked the "delete" option. I still haven't had any popups.
Finding adware in the Applications folder is a rarity. Usually, they're either an extension in Safari, or they've been installed to the LaunchAgents and/or LaunchDaemons folders in your user account. And don't expect them to be easy to spot names.
MalwareBytes for Mac is by far the easiest way to remove adware.
Malwarebytes Anti-Malware 1.0.1.7
Happy, this is the scanning that was actually suggested for this issue by Apple Support. It was
easy and it worked. I have decided to remove Adware Medic since Apple doesn't support it,
and use Malwarebytes to scan for malware instead, since Apple supports this application,
as far as I know.
Thanks! This "Mac cleaner" is a pain. I also found more files pertaining to Advanced Mac Cleaner in these locations:
~/Library/Cookies
~/Library/Mac Adware Cleaner
~/Library/Preferences
com.PCvark.Advanced-Mac-Cleaner.plist
Best just to go to the Library folder and do a spotlight search for "PCvark" "Cleaner" or "Advanced"
You say: ... In these circumstances, after force quitting Safari, turn off Wi-Fi or disconnect Ethernet, depending on how you connect to the Internet. Then relaunch Safari normally. It will try to reload the malicious webpage, but without a connection, it won't be able to.
So you are saying to turn off the wifi and with the wifi off, relaunch Safari --is that correct?
then you say: Navigate away from that page by entering a different URL, i.e. www.apple.com, and trying to load it. Now you can reconnect to the Internet, and the page you entered will appear rather than the malicious one.
At what point does one turn the wifi back on? I don't find it clear from your description.
I read it as turn wifi off, relaunch Safari (and since wifi off it can't connect malicious webpage)...........but then what: keep wifi of and put in a trustworthy site like apple.com --------or at that point turn wifi back on and then go to apple.com?
You should easily remove it. Just go to Finder and find your applications folder. You will see something like Mac Adware. Move it to trash. Hope this works.
Have you tried a restart?
The responses I got here; are they from Apple support people?
Absolutely not. The name of the site is very misleading. The responses you get here could come from anyone at all, and are not endorsed by Apple. Never forget that.
From my experience, you aren't suppose to put anything on the mac especially anit virus or anti spyware programs.
You couldn't be more right. The problem was caused by installing unknown, unnecessary software for no good reason. As long as you don't make that mistake, you'll be fine. Only install software that directly helps you to do something useful with the computer, such as a word processor, video editor, game, or the like. You didn't buy a computer so that you could "clean" it or scan it for malware, and you never need software to help you do that.
I deleted Adware Mac Cleaner with no problem, but in my activity monitor I found 'helperamc' deeply buried in my computer. Every time I try to delete the file, it says I can't because it's open. Went to activity monitor to force quit it, but it just doesn't respond. Not sure what to do. ;(
Any tips?
I've had this same problem for ~18 months right after I downloaded Adobe Flash Player (a recent version 18 months ago) and I've deleted the obvious files, multiple times. It could be a coincidence if the code related to the ad was downloaded unbeknownst to me, via another update, etc. Non of the download/update dates matched. I uninstalled Adobe Flash Player maybe six months ago, then downloaded the most recent free version directly from Adobe. Within a couple weeks the pop up ads were back. I deleted any obvious files again several times, but a different looking ad just popped up today and is similar to previous versions of the pop up, so I knew what it was. And I can't find the files anywhere to delete them.
Another contributor mentioned downloading something Adobe-related. Maybe that's the root?
Tomorrow after a back up, I will let you know which of the suggestions in this string still work as of today.
how to remove mac adware cleaner pop up window
