How do I remove adware from my 2017 MacBook Pro?

Question

Level 1

12 points

How do I remove adware from my 2017 MacBook Pro?

Hi!

I have a 15 inch 2017 MacBook Pro; iOS 10.13.5; Processor is 2.9 Ghz intel core i7: Memory 16 GB

Adware is redirecting my Safari and Chrome browsers. I have included a screen shot from Safari where it defaults as the search engine and I am unable to delete or reset it. There are no extensions listed for either browser when I go to those files.

I have just run EtreCheck and it reported the following adware:

Adware:

Launchd: ~/Library/LaunchAgents/com.MyMacUpdater.agent.plist

Reason: Adware name match

Executable: /Users/***/Applications/MyMacUpdater/MyMacUpdater -guid QzAyV1EyUDRIVEQ2Cg http:/request.macmymacupdater.com/macCheckForUpdates -brand MyMacUpdater -current

At the end of the report it says:

Clean up:

~/Library/LaunchAgents/com.apple.CSConfigDotMacCert-***@***-SharedServices.Agent .plist

/System/Library/Frameworks/CoreServices.framework/Frameworks/OSServices.framewor k/Versions/CSConfigDotMacCert

Executable not found

Can someone help me get rid of this Adware please?

Posted on Jun 23, 2018 8:20 PM

Reply

Answer 1

Top-ranking reply

eveellen Author

Level 1

12 points

Jun 24, 2018 2:41 PM in response to babowa

Just wanted to update you that I found a way to remove the adware from my computer. Since Malwarebytes did not detect a problem, yet a problem clearly existed, I posted in the Malwarebytes forum and asked for help. Someone named Alvarnell suggested I look in Systems Preferences to see if there was a "Profiles" pane located there. Sure enough, there was--and it had two unsigned files--one for Chrome and one for Safari. They had been placed there at the time that the adware had invaded my computer. I deleted both files and the problem was solved. YAY!

Reply

Answer 2

babowa

Level 9

78,568 points

Jun 23, 2018 9:27 PM in response to eveellen

First, etrecheck is really only helpful if you post the entire thing; usually, there is an option that you can click "clean up". If there isn't, you can download Malwarebytes for Mac and it will get rid of it for you.

Reply

Answer 3

marybc

Level 1

8 points

Jul 6, 2018 4:40 PM in response to eveellen

I had a similar problem.

First I found MyMacUpdater in home/applications. Moved to trash and emptied that.

Then I reinstalled my OSX software. To do this, restart and hold down Command R. Follow the prompts. This worked for me! Good luck

Reply

Answer 4

eveellen Author

Level 1

12 points

Jun 24, 2018 5:05 PM in response to babowa

Thank you for the tips. I will uninstall AV software. And I will follow your suggestion for the etrecheck if I ever do it again. I appreciate your taking the time to help me! EveEllen

Reply

Answer 5

eveellen Author

Level 1

12 points

Jun 23, 2018 9:45 PM in response to babowa

Thank you for your reply, babowa. I have run Malwarebytes and the first time it detected two files and put them in quarantine. I deleted (cleared) them. Subsequently, I have run Malwarebytes three more times and it detects nothing.

I did use the option "clean up" an etrecheck and I still have the problem. Here is my entire etrecheck report:

EtreCheck version: 4.3.2 (4D034)

Report generated: 2018-06-23 14:53:22

Download EtreCheck from https://etrecheck.com

Runtime: 3:33

Performance: Good

Problem: Other problem

Description:

Malware hijacked my Safari and Chrome Browsers. Made itself default browser and I cannot remove Major Issues:

Anything that appears on this list needs immediate attention.

Time Machine backup out-of-date - The last Time Machine backup is over 10 days old.

Adware - Adware detected.

Minor Issues:

These issues do not need immediate attention but they may indicate future problems.

Configuration profiles present - This machine has configuration profiles. These are sometimes and malware.

Clean up - There are orphan files that could be removed.

Unsigned files - There is unsigned software installed. They appear to be legitimate but should be System modifications - There are a large number of system modifications running in the background.

Encrypting - A drive is currently encrypting. The computer may run more slowly than normal until finishes.

32-bit Apps - This machine has 32-bits apps that may have problems in the future.

Hardware Information:

MacBook Pro (15-inch, 2017)

MacBook Pro Model: MacBookPro14,3

1 2.9 GHz Intel Core i7 (i7-7820HQ) CPU: 4-core

16 GB RAM - Not upgradeable

BANK 0/DIMM0 - 8 GB LPDDR3 2133 ok

BANK 1/DIMM0 - 8 GB LPDDR3 2133 ok

Battery: Health = Normal - Cycle count = 3

Video Information:

Intel HD Graphics 630 - VRAM: 1536 MB

Color LCD

Radeon Pro 560 - VRAM: 4096 MB

Drives:

disk0 - APPLE SSD SM0512L 500.28 GB (Solid State - TRIM: Yes)

Internal PCI-Express 8.0 GT/s x4 NVM Express

disk0s1 - EFI [EFI] 315 MB

disk0s2 499.96 GB

disk1s1 - Macintosh HD (APFS) 499.96 GB (102.67 GB used)

disk1s2 - Preboot (APFS) [APFS Preboot] 499.96 GB (22 MB used)

disk1s3 - Recovery (APFS) [Recovery] 499.96 GB (518 MB used)

disk1s4 - VM (APFS) [APFS VM] 499.96 GB (1.07 GB used)

Mounted Volumes:

disk1s1 - Macintosh HD 499.96 GB (395.52 GB free)

APFS

Mount point: /

Encrypting: 17% done

disk1s4 - VM [APFS VM] 499.96 GB (395.52 GB free)

APFS

Mount point: /private/var/vm

Network:

Interface ZTEUSBDIAGPort_: ZTEUSBDIAGPort

Interface ZTEUSBATPort_: ZTEUSBATPort

Interface ZTEUSBModem_: ZTEUSBModem

Interface Bluetooth-Modem: Bluetooth DUN

Interface en0: AirPort

802.11 a/b/g/n/ac

One IPv4 address

Interface en5: Bluetooth PAN 2

Interface bridge0: Thunderbolt Bridge

iCloud Quota: 1.96 GB available

System Software:

macOS High Sierra 10.13.5 (17F77)

Time since boot: Less than an hour

System Load: 1.32 (1 min ago) 1.35 (5 min ago) 1.27 (15 min ago)

Configuration Profiles:

com.google.Chrome - NewTabPageLocation
com.google.Chrome - DefaultSearchProviderSearchURL
com.google.Chrome - HomepageIsNewTabPage
com.google.Chrome - HomepageLocation
com.google.Chrome - DefaultSearchProviderEnabled

Security:

System Status

Gatekeeper Mac App Store and identified developers

System Integrity Protection Enabled

Adware:

Launchd: ~/Library/LaunchAgents/com.MyMacUpdater.agent.plist

Reason: Adware name match

Executable: /Users/***/Applications/MyMacUpdater/MyMacUpdater -guid QzAyV1EyUDRIVEQ2Cg http:/request.macmymacupdater.com/macCheckForUpdates -brand MyMacUpdater -current_version Unsigned Files:

Launchd: /Library/LaunchDaemons/com.avira.antivirus.dbcleaner.plist

Executable: /Applications/Avira.app/Contents/MacOS/dbcleaner