How To Uninstall Spyware and Adware from Mac OS X

Are you seeing strange pop-ups and overlay ads while browsing the web? Companies like Offers4U will secretly install spyware and adware programs on your computer that harass you with ads and watch what you do online. How did this crap get installed on your computer? Sometimes you’re tricked into installing it, or it gets piggybacked installed with other useful software without your knowledge. For example, even though I paid $30 for it, the app YTD (YouTube Downloader) installs apps like “Advanced Mac Cleaner” and a Safari extension called InternetAssistant by Cosmina Beteringhe.

The Offers4U adware really makes me mad. It’s the second time I’ve found it on my computer. If you’re seeing pop-up ads that say “Powered by Offers4U” or “Brought by Offers4U” then you’re unfortunately having the same issue as me.

This tutorial will help you uninstall and remove most types of adware and spyware from Mac OS X.

Requirements:

• Mac OS X
• 10 minutes of your time

01) Search for Suspect Apps

If you know the name of the spyware or adware app that you need to delete, then you can try searching for it in the Finder. Most creators of adware and spyware programs will try to hide their software and make it hard for you to find and remove. It’s a longshot, but worth a try.

1. Open a new window in the Finder
   • Finder > New Finder Window
2. Type in the name of the app in the search box in the top right of the Finder window.
3. Click on the + button a couple times to include both invisible and System files in your search.
4. If you find something, just drag it to the trash. Don’t worry if you don’t find anything. Continue reading.

02) Remove Internet Extensions: Safari

Another place where adware apps like to hide is inside web browser extensions.

Safari > Preferences > Extensions

1. From your menu bar, click on the Safari menu.
2. Select Preferences… from the drop down list.
3. Click on the Extensions tab.
4. Make a list in case you make a mistake, but click on “Uninstall” for everything that sounds suspicious. You can always reinstall them later if needed.

Spammy sounding extension names like Slick Savings and Searchme are obvious. But extensions like Internet Assistant 1.1, Amazon Shopping Assistant and Ebay Shopping Assistant might sound legit, but they are also adware. If you look closely at the light gray colored text, it says the extension was made by a company or individual named “Spigot, Inc.” or Cosmina Beteringhe, not Apple, Amazon or Ebay.

03) Remove Internet Extensions: Chrome

To uninstall unwanted Chrome browser extensions….

Google Chrome > Preferences > Extensions

1. From your menu bar, click on Chrome.
2. Select Preferences… from the drop down list.
3. Select Extensions.
4. Click on the small Trash icon to delete extensions.

04) Remove Internet Extensions: Firefox

To uninstall adware plug-ins like Searchme, Savings Slider, Ebay Shopping Assistant, Amazon Shopping Assistant, go to the Extensions window and click on the remove button next to each item.

Firefox > Tools > Add-ons > Extensions

05) Clean Up Your Internet Plug-Ins Folder

Another place to look for spyware and adware is in the “Internet Plug-Ins” folder in both the Library folder for your computer as well as your user folder. Go item by item and search for information for each plug-in on the Internet before you delete them. For example, I had a plug-in called “o1dbrowserplugin.plugin” that I didn’t know what it did or who made it. But I found a conversation on Reddit that identified Google as the creator of the plug-in and suggested that the plug-in was old and should be deleted.

06) Delete Apps

One of the apps I use to download YouTube videos called YTD, informed me it had an update. So I updated the app. But immediately after the install completed, an adware app called Advanced Mac Cleaner automatically opened itself and ran a scan on my computer. If you ever see this app, you should delete it immediately. You can also use a free program called AppTrap to remove any associated files as well.

07) Use Activity Monitor

If you see a suspicious pop-up or application running on your Mac, then you can use Activity Monitor to help find and identify the culprit.

I recently saw a Mac OS X pop-up bragging about being able to save hard drive space on my computer. It wasn’t an Apple alert and felt fishy. So I skimmed what applications were currently active in Activity Monitor and found an app called “helperamc”. Look closer at the name and it’s “Helper Mac” but Mac in intentionally misspelled to prevent you from finding it and deleting it (method #1 in this article).

1. Open Activity Monitor
   • Macintosh HD > Applications > Utilities > Activity Monitor
2. Browse for suspicious Process Names
3. Select a Process then Sample it
   • Activity Monitor > View > Sample Process
4. The sample should provide you with the location of the file on your hard drive. Find the app and delete it. For example, the file I was investigating was here. I deleted the AMC folder:
   • /Users/YourName/Library/Application Support/amc/helperamc.app

07) That’s It!

Congratulations! Your computer should now be adware and spamware free! If you have any questions, please tweet us at @methodshop or leave a comment below.