Mac Optimizer Adware uninstall solution

Question

Level 1

8 points

Mac Optimizer Adware uninstall solution

So, a coworker of mine was trying to find and download an application online, but ended up clicking one of those fake "Download" links that redirects to an ad site. From there, she clicked another link and downloaded an installer for Mac Optimizer, and proceeded to open and click through the entire install process before turning to me and and asking "hey… what's this?" I'll put aside the (big) user error for now, and focus on the issue.

Exasperated, I told her that could be a virus. Sure enough, a quick search told me it was. I quickly deleted the app from Applications, and ran an Avast (business license) scan. Nothing. Unfortunately, a few days later she mentioned that she'd been getting a popup maybe twice a day. It was a notification on the system level (not from a browser), asking to download something along the lines of "Adware Cleaner" because her computer was "at risk."

I did another search, and couldn't find a (correct) solution to get rid of it. They seem to have updated their software to place files in several places to ensure they wouldn't be found. Well, first I found the offending process: mohlp. Searching that process name online came up with zilch, so it must be fairly new. In any case, it shouldn't have been there. I dug through all the user Library folders, searching for suspicious content.

Here's my list of the files owned by Mac Optimizer, and what ultimately stopped the adware from performing further actions:

1. Remove any "mohlp" or "Mac Optimizer" directories or files in these places:

/Users/[user]/Library/Application Support

/Users/[user]/Library/Caches

/Users/[user]/Library/Logs

/Users/[user]/Library/Preferences

2. Remove "Mac" from the user login items. Yes, it's called Mac. You'll notice the icon is not Mac related though.

System Preferences > User Accounts > Login Items

...and that's it! No popups since, no more weird processes. Hope this is useful to someone. Again, I couldn't find anything on this particular piece of software, much less an uninstall process, so it must be rather new.

It must be said: Please look at what you're clicking!

MacBook Pro with Retina display, OS X El Capitan (10.11.4)

Posted on Apr 5, 2016 1:56 PM

Reply

Answer 1

AYRP

Level 1

4 points

Jan 19, 2017 9:19 AM in response to Karrow

HI Karrow, thank u so much for the info; however, my IMac doesn't let me do anything. The cursor moves but I cannot click anything in order to uninstall or delete anything. Is there anything I can do? :(

I called the MacOptimizer 800# when I realized nothing was moving, and they want to charge me $249 to solve the problem.

I tried downloading a free antivirus like u said, but I cannot access the internet or anything for that matter. :(

Reply

Answer 2

May 19, 2017 9:20 PM in response to Karrow

Thanks. I did find this. I was hoping though, to get an answer where the person had, had direct experience with this. If i read this correctly, this person (or maybe it's you) presents possibilites but isn't familiar with it.

Reply

Answer 3

geke108

Level 1

14 points

Sep 19, 2017 1:45 PM in response to Goldbek

Download Malware Bytes from here:
Malwarebytes | Free Cyber Security & Anti-Malware Software

It’s free. After the trial period, real-time security stops working unless you buy it ("upgrade") but scanning the Mac for malware continues to work.

Here’s a page with more details about removing Mac Optimizer stuff:

https://malwarefixes.com/remove-mac-optimizer/

Reply

Answer 4

Linc Davis

Level 10

209,667 points

Apr 5, 2016 2:10 PM in response to Karrow

"Avast" is much, much worse than "MacOptimizer."

Reply

Answer 5

Karrow Author

Level 1

8 points

Apr 5, 2016 2:32 PM in response to Linc Davis

Fair side-note, but pretty unrelated. Plus that wasn't my decision.

Reply

Answer 6

Linc Davis

Level 10

209,667 points

Apr 5, 2016 2:50 PM in response to Karrow

Regardless of who made the decision, you should realize that removing "MacOptimizer" is only a small step toward solving the real problem. Good luck and thanks for your contribution. Incidentally, "MacOptimizer" often, or perhaps always, installs a malicious Safari extension, and you don't mention checking for that.

Reply

Answer 7

Karrow Author

Level 1

8 points

Apr 5, 2016 3:00 PM in response to Linc Davis

Really? Thanks, I'll check next time I see her. Like I said, none of the solutions for MacOptimizer I found were relevant; the locations and names of the files they said to look for didn't show up in this case. I'll be sure to browse through her browsers' preferences and extensions though.

Reply

Answer 8

nalem92

Level 1

4 points

Apr 12, 2016 12:48 PM in response to Karrow

hi karrow,

i ran into the same issue. i have attempted to delete all things "mac optimizer" and "mohlp. i moved everything with those words into my trash bin, but when i go to empty the trash two items cannot be deleted because they are still in use. these items are:

com.techy.Mac-Optimizer.plist

com.techy.mohlp 1.54.52 PM.plist

a couple other things: there was nothing listed in my Login Items under my User Account. and i don't know if it is worth noting that mohlp was previously listed in my Activity Monitor, but i was able to quit it.

any ideas how i can remove these last two items? i will say i have not done a restart of my computer since deleting the other Mac Optimizer and mohlp items. yet. i fear they will all resurface if I restart.

thanks in advance for your help! these pop ups have been driving me nuts and i've had trouble finding a solution until i stumbled upon yours!

Reply

Answer 9

Karrow Author

Level 1

8 points

Apr 12, 2016 1:03 PM in response to nalem92

Off the top of my head, the only reason those would still be in use is because of the 'mohlp' process. Check to see if it's running again, stop it, and try deleting them again. If not, search Activity Monitor for processes like 'mo' or 'Mac Optimizer,' and repeat.

If this still doesn't work, AND you've made sure to remove "Mac" from your account's login items, restart the computer and try to delete those files again. Since the process is no longer supposed to start when you login, it shouldn't run and you can delete the files.

Reply

Answer 10

Sep 4, 2016 8:56 PM in response to Karrow

Thank you for posting! It was so helpful. I had downloaded the Mac Optimizer from a "legitimate" software download site (I think it was cnet). I had no idea it was malicious.

Reply

Answer 11

Sep 4, 2016 9:02 PM in response to Linc Davis

I called Apple and they recommended Malwarebytes. I ran it and it did find four additional directories/files where MacOptimizer was hiding, but Safari was not one of them. After reading your post, I opened my Safari extensions, but I did not find anything. You mentioned MacOptimizer "always" installs a malicious Safari extension. Why can't I find it? Thank you!

Reply

Answer 12

thomas_r.

Level 7

32,001 points

Sep 6, 2016 8:36 AM in response to Joleen D.

Joleen,

Linc is wrong. MacOptimizer itself does not install any Safari extensions. However, it is very frequently distributed in adware installers that will install MacOptimizer along with a bunch of other junk - often including Safari, Chrome and/or Firefox extensions, among other things.

Reply

Answer 13

Dec 28, 2016 3:46 PM in response to Karrow

Oh my gosh, cannot express enough gratitude for your in-depth suggestions here. I got zapped a few hours ago. UGH!

Thank you, thank you Karrow!

Reply

Answer 14

Dec 28, 2016 3:49 PM in response to Joleen D.

Hi Joleen,

I followed Karrow's tips and that seemed to have remedied the situation.

However, you mentioned that you found it in 4 other directories/files. May I ask where so that I may rid of it completely, please?

Thanks.

Reply

Answer 15

Dec 30, 2016 5:10 PM in response to Linc Davis

Thank you Linc.

Reply