How to Remove Adware

• September 9, 2016
• Adware Cleaner

Removing adware is relatively simple.

The hard part is looking for the specific key files to delete and keeping up to date with the latest adware information and knowing which key files to look for and delete.

This guide will help walk you through removing the most common adware for free. 🙂

If you want a useful Mac app that will do this for you with the click of 1-button, then it’s worth checking out Adware Cleaner on the Mac App Store. These instructions may seem daunting, so some people may want to take the easier road using the app.

1. Check Your Browser Extensions

It is very common for Adware to hide in your browser extensions and/or add-ons. Look at your extensions you have installed in your browser:

• Safari – From the Safari menu, go to Preferences -> Extensions, near the right side of the row of icons along the top of the window.
• Chrome – From the Chrome menu, go to Preferences -> Extensions item in the list on the left side of the window.
• Firefox – Go to Add-ons from the Tools menu, then look at both the Extensions and Plugins lists in the window that opens.

There are lots of good browser extensions out there, but be careful which ones you decide to install. If you see extensions that you don’t remember installing, it is most likely adware. Below is a list of some common Adware that you might see installed.

• Omnibar, GoldenBoy, Texiday, Listchack, InKeepr, Nariabox, Celipsow
  • See Genieo Removal https://support.norton.com/sp/en/us/home/current/solutions/v103415336_EndUserProfile_en_us
• savekeep, saVe keeep, suave keepo, or anything similar
  • Delete all of the following browser extensions that you find: savekeep, saVe keeep and suave keepo.
• jollywallet cash back
  • Delete the “jollywalet cash back” browser extension.
• Vidx, Viddxx, Vidox, Viidax, ViiDDx, MacVX (and variants like MacVaX), MacCaptain, MacPriceCut, SaveOnMac, Mac Global Deals or MacDeals, MacSter, MacXcoupon, Shop Brain (or variants like SShoP Braaiin), MacMin (and variants like MacMMin, MaucMino, etc)
  • Delete any browser extensions with the following names:

    Vidx (or variants such as ViddX, Vidox, Viidax and ViiDDx)
    MacVx (or variants such as MacVax or MacVox)
    MacCaptain
    MacPriceCut
    SaveOnMac
    Mac Global Deals
    MacDeals
    MacSter
    MacXcoupon
    Shop Brain (or variants such as SShoP Braaiin)
    MacMin (or variants such as MacMMin or MaucMino)
    MacCost

    Move the following items to the trash.

    /Applications/Vidx.app
    /Applications/MacMin.app
    /Library/Application Support/VidToMP3
    /Library/Application Support/fa4e8.94b.550d413f
    ~/Library/Application Support/osxDownloader

• MacMin (and variants like MacMMin, MaucMino, etc) – see Vidx removal
• Awesome Screenshot
  • Remove this extension
• Shopy Mate, PalMall, FlashMall, Cinema-Plus Pro (and variants like Cinema + HD, Cinema + Plus + or Cinema Ploos)
  • Delete all of the following browser extensions that you find: Shopy Mate, FlashMall, Cinema-Plus Pro(and variants like CinemaPlus, CinemaPro, Cinema + HD, Cinema + Plus + or Cinema Ploos).

    Move the following items to the trash.

    /Applications/WebTools.app
    /Applications/WebShopper.app
    ~/Applications/WebTools.app
    ~/Applications/WebShopper.app
    /Library/cinemapro1-2/
    ~/Library/cinemapro1-2/
    ~/Library/WebTools/
    ~/Library/Application Support/webHelperApp/
    ~/Library/Application Support/WebShopper/
    ~/Library/LaunchAgents/WebServerSocketApp
    ~/Library/LaunchAgents/UpdateDownloder
    ~/Library/LaunchAgents/com.webhelper.plist
    ~/Library/LaunchAgents/com.webtools.update.agent.plist
    ~/Library/LaunchAgents/com.webtools.uninstaller.plist

• Search App by Ask
  • Delete any extension called something like Search App by Ask.

    Move the following items to the trash.

    ~/Library/Application Support/Sponsors.framework

• MacShop, MacSmart, News Ticker Remover, Shopper Helper Pro, Photo Zoom, Best YouTube Downloader, ArcadeYum, Extended protection, Video download helper, FlashFree, RecipeHub, iLivid, CustomSearchForSafari, Media Player, MusixLib, GoMovix, MovixHub, AdBlock Super, Webpage Screenshot, NewTabTV, WalletBee
  • Remove these extensions
• PremierOpinion
  • See removal guide https://www.pcrisk.com/removal-guides/8226-premier-opinion-surveys
• Opti-Page, Toppy
  • Delete all of the following browser extensions that you find: Opti-Page, Toppy.

    Move the following items to the trash.

    ~/Library/Application Support/Google/Chrome/Default/chromex
    ~/Library/Application Support/Google/Chrome/Default/chromexdm
    ~/Library/Application Support/mediahm
    ~/Library/LaunchDaemons/com.mediahm.operator.update.plist

• Codec-M
  • Delete the Codec-M browser extension.
    Move the following items to the trash.

    ~/Library/Application Support/Codec-M
    ~/Library/LaunchAgents/com.codecm.uploader.plist
    /Applications/Codec-M.app

• Yontoo and/or Torrenthandler
  • Delete the Yontoo and Torrenthandler browser extensions.
• Anything claiming to be Adobe Flash Player
  • Delete any Safari extensions claiming to be Adobe Flash Player. The real Flash Player does not use a browser extension.
• ChatZum
  • Delete the ChatZum browser extension.
    Move the following items to the trash.

    /Applications/ChatZumUninstaller.pkg
    /Library/Application Support/SIMBL/Plugins/SafariOmnibar.bundle
    /Library/Internet Plug-Ins/uid.plist
    /Library/Internet Plug-Ins/zako.plugin

• Conduit, MyBrand, Trovi, Search Protect, SP, or anything ending with Community Toolbar
  • Delete any Conduit, MyBrand, Trovi or Search Protect browser extensions that you find, as well as any with a name ending in “Community Toolbar.” (e.g. Genealogy Gems Podcast Community Toolbar, SB Tool Bar Community Toolbar, WiseConvert Community Toolbar, MovieBario Community Toolbar, etc)
    Move the following items to the trash.

    /Library/InputManagers/CTLoader/
    /Library/LaunchAgents/com.conduit.loader.agent.plist
    /Library/LaunchDaemons/com.perion.searchprotectd.plist
    /Library/Application Support/SIMBL/Plugins/CT2285220.bundle
    /Library/Application Support/Conduit/
    /Applications/SearchProtect.app
    /Applications/SearchProtect/
    ~/Library/Application Support/Conduit/
    ~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
    ~/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin
    ~/Conduit/
    ~/Trovi/

• Searchme, Slick Savings, Amazon Shopping Assistant, Ebay Shopping Assistant, Domain Error Assistant
  • Delete all of the following browser extensions that you find: Searchme, Slick Savings, Amazon Shopping Assistant, Ebay Shopping Assistant, Domain Error Assistant.

    Move the following items to the trash.

    ~/Library/LaunchAgents/com.spigot.SearchProtection.plist
    ~/Library/LaunchAgents/com.spigot.ApplicationManager.plist
    ~/Library/Application Support/Spigot/

• Set Search Settings, searchtab, any extension with a name like xxsearch (where “xx” can be anything), such as jbsearch or mtsearch, and any extension with a person’s name, such as JeffKekkoor BrianDeer
  • Delete all of the following browser extensions that you find: Set Search Settings, searchme, searchtab, and any extension with a name like xxsearch (where “xx” can be anything), such as jbsearch or mtsearch. In addition, extensions whose names are a person’s name, such as JeffKekko or BrianDeer, should be disabled.
• GoPhoto.it
  • Delete the GoPhoto.it and jollywallet cash back browser extensions.

2. Check Your Libraries
Adware can install “LaunchAgents” to keep running in the background 24/7. Look in two different LaunchAgents folders to see a file matching the description. If you do, it’s Adware.

~/Library/LaunchAgents

• com.codecm.uploader.plist
  • Delete the Codec-M browser extension.
    Move the following items to the trash.

    ~/Library/Application Support/Codec-M
    ~/Library/LaunchAgents/com.codecm.uploader.plist
    /Applications/Codec-M.app

• anything with the word “genieo” in it
  • Genieo removal – https://support.norton.com/sp/en/us/home/current/solutions/v103415336_EndUserProfile_en_us
• a set of three files, each with names starting with the same text and ending in “.download.plist”, “.ltvbit.plist” and “.update.plist”
  • Genieo removal – https://support.norton.com/sp/en/us/home/current/solutions/v103415336_EndUserProfile_en_us
• Safari Security, files ending in “_enabler.plist”, “_enabler.sh”, “_updater.plist”, “_updater.sh”. WebSocketServerApp, com.webhelper.plist, com.webtools.update.agent.plist, anything starting with com.crossrider.wss. UpdateDownloader, anything similar to com.extensions.updater69337.agent.plist or com.extensions.updater69337.ver
  • Delete all of the following browser extensions that you find: Shopy Mate, FlashMall, Cinema-Plus Pro(and variants like CinemaPlus, CinemaPro, Cinema + HD, Cinema + Plus + or Cinema Ploos).

    Move the following items to the trash.

    /Applications/WebTools.app
    /Applications/WebShopper.app
    ~/Applications/WebTools.app
    ~/Applications/WebShopper.app
    /Library/cinemapro1-2/
    ~/Library/cinemapro1-2/
    ~/Library/WebTools/
    ~/Library/Application Support/webHelperApp/
    ~/Library/Application Support/WebShopper/
    ~/Library/LaunchAgents/WebServerSocketApp
    ~/Library/LaunchAgents/UpdateDownloder
    ~/Library/LaunchAgents/com.webhelper.plist
    ~/Library/LaunchAgents/com.webtools.update.agent.plist
    ~/Library/LaunchAgents/com.webtools.uninstaller.plist

/Library/LaunchAgents

• anything with the word “genieo” or “texiday” in it, or with a name starting with “com.installer.completer”
  • Genieo removal – https://support.norton.com/sp/en/us/home/current/solutions/v103415336_EndUserProfile_en_us
• com.conduit.loader.agent.plist
  • Delete any Conduit, MyBrand, Trovi or Search Protect browser extensions that you find, as well as any with a name ending in “Community Toolbar.” (e.g. Genealogy Gems Podcast Community Toolbar, SB Tool Bar Community Toolbar, WiseConvert Community Toolbar, MovieBario Community Toolbar, etc)
    Move the following items to the trash.

    /Library/InputManagers/CTLoader/
    /Library/LaunchAgents/com.conduit.loader.agent.plist
    /Library/LaunchDaemons/com.perion.searchprotectd.plist
    /Library/Application Support/SIMBL/Plugins/CT2285220.bundle
    /Library/Application Support/Conduit/
    /Applications/SearchProtect.app
    /Applications/SearchProtect/
    ~/Library/Application Support/Conduit/
    ~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
    ~/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin
    ~/Conduit/
    ~/Trovi/

• com.vsearch.agent.plist (There are a number of variants that substitute other random words for “vsearch” in this file name)
  • Move the following items to the trash.

    /Library/Application Support/VSearch
    /Library/LaunchAgents/com.vsearch.agent.plist
    /Library/LaunchDaemons/com.vsearch.daemon.plist
    /Library/LaunchDaemons/com.vsearch.helper.plist
    /Library/LaunchDaemons/Jack.plist
    /Library/PrivilegedHelperTools/Jack
    /System/Library/Frameworks/VSearch.framework
    /System/Library/Frameworks/v.framework

    You may also find files with the following names, where “xxx” can be any word:

    /Library/LaunchAgents/com.xxx.agent.plist
    /Library/LaunchDaemons/com.xxx.daemon.plist
    /Library/LaunchDaemons/com.xxx.helper.plist

/Library/LaunchDaemons

• Jack.plist, com.vsearch.daemon.plist or com.vsearch.helper.plist
  • Move the following items to the trash.

    /Library/Application Support/VSearch
    /Library/LaunchAgents/com.vsearch.agent.plist
    /Library/LaunchDaemons/com.vsearch.daemon.plist
    /Library/LaunchDaemons/com.vsearch.helper.plist
    /Library/LaunchDaemons/Jack.plist
    /Library/PrivilegedHelperTools/Jack
    /System/Library/Frameworks/VSearch.framework
    /System/Library/Frameworks/v.framework

    You may also find files with the following names, where “xxx” can be any word:

    /Library/LaunchAgents/com.xxx.agent.plist
    /Library/LaunchDaemons/com.xxx.daemon.plist
    /Library/LaunchDaemons/com.xxx.helper.plist

• com.perion.searchprotectd.plist
  • Delete any Conduit, MyBrand, Trovi or Search Protect browser extensions that you find, as well as any with a name ending in “Community Toolbar.” (e.g. Genealogy Gems Podcast Community Toolbar, SB Tool Bar Community Toolbar, WiseConvert Community Toolbar, MovieBario Community Toolbar, etc)
    Move the following items to the trash.

    /Library/InputManagers/CTLoader/
    /Library/LaunchAgents/com.conduit.loader.agent.plist
    /Library/LaunchDaemons/com.perion.searchprotectd.plist
    /Library/Application Support/SIMBL/Plugins/CT2285220.bundle
    /Library/Application Support/Conduit/
    /Applications/SearchProtect.app
    /Applications/SearchProtect/
    ~/Library/Application Support/Conduit/
    ~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
    ~/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin
    ~/Conduit/
    ~/Trovi/

• PremierOpinion.plist
  • See removal guide https://www.pcrisk.com/removal-guides/8226-premier-opinion-surveys

/Library/Internet Plug-Ins

• zako.plugin
  • Delete the ChatZum browser extension.
    Move the following items to the trash.

    /Applications/ChatZumUninstaller.pkg
    /Library/Application Support/SIMBL/Plugins/SafariOmnibar.bundle
    /Library/Internet Plug-Ins/uid.plist
    /Library/Internet Plug-Ins/zako.plugin

Still No Adware Found?

Check your symptoms to make sure you have adware or spyware. You might just be experiencing popup ads that can be blocked using the useful adblock browser extension – https://getadblock.com

Hopefully this isn’t the case, but you could possibly have Malware. BitMedic is a great AntiVirus app available on the Mac App Store for removing Malware.

Don’t forget to see our guide on How to PREVENT more adware.

If you have any questions, feel free to email us at support@pocketbitsllc.com.