Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Question:

Question: addware removal

After running a scan I seem to have addware. What is the best way to remove this? I have copied the report and pasted it here.


EtreCheck version: 4.1 (4A162)

Report generated: 2018-03-01 18:13:42

Download EtreCheck from https://etrecheck.com

Runtime: 2:54

Performance: Excellent


Problem: Computer is too slow


Major Issues:

Anything that appears on this list needs immediate attention.


Adware - Adware detected.


Adware:

Launchd: ~/Library/LaunchAgents/Arcahol.btvlit.plist

Reason: Adware name match

Executable: ~/Library/Application Support/Arcahol/Arcahol.app/Contents/MacOS/AppIR -trigger ltvbit -isDev 0 -installVersion 688 -firstAppId 1467728656410632 -identity Arcahol

Launchd: ~/Library/LaunchAgents/Arcahol.disable.plist

Reason: Adware name match

Executable: ~/Library/Application Support/Arcahol/Arcahol.app/Contents/MacOS/AppIR -trigger disable -isDev 0 -installVersion 688 -firstAppId 1467728656410632 -identity Arcahol

Launchd: ~/Library/LaunchAgents/pronto.notification.plist

Reason: Adware name match

Executable: ~/Library/Application Support/ProntoApp/ProntoApp.app/Contents/MacOS/ProntoApp -trigger notification -app_name ProntoApp -emid 3c392420ea203826b8d39e8e9ff9eaea

Launchd: ~/Library/LaunchAgents/pronto.update.plist

Reason: Adware name match

Executable: ~/Library/Application Support/ProntoApp/ProntoApp.app/Contents/MacOS/ProntoApp -trigger update -app_name ProntoApp

Launchd: ~/Library/LaunchAgents/Arcahol.uadpte.plist

Reason: Adware name match

Executable: ~/Library/Application Support/Arcahol/Arcahol.app/Contents/MacOS/AppIR -trigger update -isDev 0 -installVersion 688 -firstAppId 1467728656410632 -identity Arcahol -sig ILAN_RAMBAM_SIGNATURE -agentUpdate 0

Launchd: ~/Library/LaunchAgents/Arcahol.dolnwoad.plist

Reason: Adware name match

Executable: ~/Library/Application Support/Arcahol/Arcahol.app/Contents/MacOS/AppIR -trigger download -isDev 0 -installVersion 688 -firstAppId 1467728656410632 -sig ILAN_RAMBAM_SIGNATURE -identity Arcahol

Launchd: ~/Library/LaunchAgents/Smokyashan.update.plist

Reason: Adware name match

Executable: ~/Library/Application Support/Smokyashan/Smokyashan.app/Contents/MacOS/AppNOS -trigger update -isDev 0 -installVersion 607 -firstAppId 1434976216979282 -identity Smokyashan -sig NOSIGNATURE_SIGNATURE -agentUpdate 2

Launchd: ~/Library/LaunchAgents/Arcahol.AppVemoral.plist

Reason: Adware name match

Executable: ~/Library/Application Support/Arcahol/Arcahol.app/Contents/MacOS/AppIR -trigger AppRemoval -isDev 0 -installVersion 688 -firstAppId 1467728656410632 -identity Arcahol

Safari Extension: Arcahol

Reason: Adware name match


Unsigned Files:

Launchd: /Library/LaunchDaemons/com.adobe.fpsaud.plist

Executable: /Library/Application Support/Adobe/Flash Player Install Manager/fpsaud

Details: Exact match found in the whitelist - probably OK

Launchd: ~/Library/LaunchAgents/com.valvesoftware.steamclean.plist

Executable: ~/Library/Application Support/Steam/SteamApps/steamclean

Details: Exact match found in the whitelist - probably OK

Posted on

Reply

Mar 1, 2018 6:41 PM in response to Meadiocre In response to Meadiocre

Hello Meadiocre,

In the main EtreCheck 4.1 user interface, there should be a "Remove" button under each of those items in the Adware section. Just click the button for each.


You didn't post your entire EtreCheck report. If those two Unsigned Files are the only two Unsigned Files you have, then they are fine. Don't remove them. But given all the bona-fide adware you do have, it seems logical that you should have some adware listed under Unsigned Files too. Usually the "Details" entry is pretty accurate. You can always eliminate the mystery by posting the entire EtreCheck report.

Mar 1, 2018 6:41 PM

Reply Helpful
User profile for user: Meadiocre

Question: addware removal