How can I get rid of Mac Tonic malware?

This app just appeared on my computer today. I have no idea how it got there.

Here's what I did to (hopefully) remove and stop it:

• Find it in the Applications folder and put Mac Tonic in the trash
• To to the Library folder and find the 2 library files associated with it. Sorry, I can't remember what they are named, but they are not hard to recognize.
• Go to the Activity Monitor and find "Tonic Tasks," select it and click on the "x" in the upper left hand corner of the window to delete it.
• Empty the trash.

You can test it by trashing any defunct applications on your computer and see if Mac Tonic pops up when you go to empty the trash. So far, on my computer, it has stopped popping up.

Good luck!

Have you tried Etrecheck or MalwareBytes?

http://www.etrecheck.com/

Free Antivirus Replacement & Anti-Malware Tool | Malwarebytes

Etrecheck isn't specifically designed to find and remove Adware, but it does have that capability.

MalwareBytes is designed to remove Adware.

It is a PUA (potential unwanted application) developed by PCVARK. You don't need to install any other apps to remove this PUA, please read my blog to remove it manually: Remove Mac Tonic from Mac OS X - SecureMacOS

<Disclaimer: this post contains links to my own website from which I may derive some form of compensation. My website does not contain 3rd party ads. This disclaimer is required by ASC Terms of Use whenever linking to one's own site or product.>

I'm glad, but you may need to search more extensively on your Mac to find other files to delete. I thought it was gone, but after a few minutes it popped back up. I went through every file in the Library folder ("Finder," "Go"-while holding down the option key, "Library.")

I also went to Users (we have multiple users), my name, and found a couple of files there. I deleted everything I could find that was associated (MacTonic and MacTask, etc.).

I found a couple of other obviously suspicious folders of similar programs and deleted those as well (after Googling the names to be sure). I had to go back to the Activity Monitor a number of times and repeat the action I mentioned in my previous post.

You should also go into "Users and Groups" from the Systems Preference folder and see if it shows up in your Login Items. If so, delete it.

Finally, after trashing all I could find, I upgraded my OS. I haven't seen hide nor hair of Mac Tonic since. I did not install any malware removal apps (not yet, anyway).

Hope that helps!

How come it get download without authorization ?

Someone had to have authorized it. It comes on a package installer that requires elevated privileges to install. Someone may have been tricked into authorizing it, but some user on your Mac authorized it.

Uninstall Mac Tonic from Mac .

Click on finder from the dock .

Click on Applications - Mac Tonic

Downloads - mtc_site.pkg

Enter in user library : Click on finder and take cursor on top menu bar and hold option key - click on library .

( a ) Application Support - folders mtc , Mac Tonic

( b ) Cookies - com.techyutil.Mac - Tonic.binarycookies

( c ) in the user library column itself - folders hlprmtc and Mac Tonic

( d ) LaunchAgents - folder com.techyutil.tonictasks.plist

( e ) Logs - folders Mac.Tonic.tasks.log , tonictasks.log

( f ) Saved Application State - folder com.techyutil.Mac - Tonic.savedState

( g ) Caches - folder - com.techyutil.Mac - Tonic , com.techyutil.tonictasks

Open system preferences > users and groups , authenticate the admin name and password to open the lock and click on login items - Mac Tonic - select the box of it and click on subtract sign to delete .

Used Malwarebytes anti malware for Mac ( free version ) and scanned it .It showed .

( a ) PUP.PCVARK

( b ) /Applications/MacTonic.app

( c ) /Users/ your user name / Library/Application Support /Mac Tonic

( d ) /Users/ your user name / LaunchAgents /com.techyutil.tonictasks.plist

( e ) /Users/ your user name/Library/MacTonic

It prompts to restart the Mac , after restarting click on start scan - congratulations you are clean .

But when again enter in user library and searched the below folders , the contents of Mac tonic were still there .

( a) Caches - com.techtyutil.Mac - Tonic , com.techtyutil.tonic.tasks

( b ) Cookies - com.techyutil.Mac - Tonic.binarycookies

( c ) The folder - hlprmtc exists in user library column .

( d ) Saved Application State - com.techyutil.Mac - Tonic.savedState

Again deleted the contents manually , restarted the Mac and finally emptied the trash .

This app just appeared on my computer today. I have no idea how it got there.

It is usually something like this:

How to install adware

Did you do an Adobe Flash update?

Thank you for posting this! When I try to quit or force quit by clicking the "x", it won't do anything. It won't move to the trash. Any suggestions? Thanks again.

This worked. Thank you!!

No, but it's gone now. I found it in multiple files after an extensive search, trashed them all and then updated my OS. So far, so good.

They are so sly. It is very unethical and creepy to have people creating programs to invade your private computer. Please see my response to admarte. Maybe it will help you.

Thanks for this. I went to the mtc folder and yep there was Mac tonic sitting there. How on earth do you find out where it is hiding? Many thanks for taking the time to help us out!

How on earth do you find out where it is hiding?

You look inside the installer to find out what it installs where.