Macintosh Adware Removal
Revision as of 17:42, 13 November 2014 by Tami(talk | contribs)(Additional Help)

Symptoms of Macintosh Adware Presence

  • Troubles accessing web pages in Safari or Chrome (browser hijacking)
  • Abnormal picture ads on google.com main page and search results.

Basic Removal Steps

The Technology Helpline staff is available to help with malware removal from personally owned Macintosh computers during regular hours. Institutionally owned Macintosh computers that are infected will be re-imaged.

Malware removal involves deleting files from both the System Library and the User Library.

Accessing the System Library

The System Library is the Library folder at the root of the Macintosh HD. To find the System Library:

  • in Finder
  • from the Go Menu select Computer
  • double-click Macintosh HD
  • you should see a Library folder at this location.

Accessing the User Library (~/Library)

The User Library (typically denoted ~/Library) is the the Library folder in root of your user directory. To find the User Library:

  • in Finder
  • Hold down Option key (holding the option key shows the user library in the Go menu - without the option key - it won't show.
  • from the Go Menu
  • select Library

Removal

  • From the System Library (Macintosh HD\Library)
  • Check the Launch Agents, LaunchDaemons and Application Support folders
  • remove any files with zeobit, MacKeeper, 911 or 911bundle, Vsearch, or MPlayerX in their names.

  • From the User Library (~\Library)
  • Check the Application Support and Launch Agents folders
  • remove any files with zeobit, MacKeeper, 911 or 911bundle, Vsearch, or MPlayerX in their names.

  • Also check all browsers for suspicious extensions
  • Reboot computer

Additional Help

Here is a helpful web page that has been proven to work multiple times to guide you through removing pesky Macintosh Adware.


Please only delete those files that have the words ‘zeobit’, ‘MacKeeper’, ‘911’ or ‘911bundle’, or 'Vsearch'.

The directions on the website don't mention anything about Vsearch, but any file that says Vsearch treat it the same, delete or kill the file/process.

Another resource -

Other

  • Try removing the website data in Safari. Safari menu, Reset Safari, Remove website data.