How to Remove Mac malware manually

More and more Mac computers are becoming victims of malware. This is a fact. Mac malware has grown exceptionally in 2020. This is because the number of Mac users has also increased significantly, and cybercriminals focus on making the most victims.

There are a lot of useful applications that can detect and remove Mac malware. Malwarebytes and Anti-malware are the most well-known applications. However, there is also more interest in a method to manually remove Mac malware. Removing Mac malware without an application is not for everyone. Some technical knowledge is required.

To remove Mac malware manually, I have created this instruction. This instruction helps you to detect and remove Mac malware without an application. I go through several steps. Some are relevant for you, and others are less relevant.

I recommend you to complete all the steps.

How to remove Mac malware manually

Mac profile removal

Mac malware installs a profile to prevent specific Mac settings from being restored to their original value. Suppose the web browser homepage in Safari or Google Chrome has been modified. In that case, adware with a Mac profile tries to prevent you from restoring settings.

Click on the Apple icon in the top left corner. Click on System Preferences from the menu. Go to Profiles. Select a profile called “Chrome Profile,” “Safari Profile” or “AdminPref”. Then click the “-” sign to permanently remove the profile from your Mac.

Delete startup items

Open Finder. Click on the desktop to make sure you are in the Finder, choose “Go” and then click “Go to Folder”.

Type or copy/paste each of the paths below into the window that opens and then click “Go”.

/Library/LaunchAgents
~/Library/LaunchAgents
/Library/Application Support
/Library/LaunchDaemons

Look out for suspicious files (anything you don’t remember having downloaded or that doesn’t sound like a real program).

Here are some known malicious PLIST files: “com.adobe.fpsaud.plist” “installmac.AppRemoval.plist”, “myppes.download.plist”, “mykotlerino.ltvbit.plist”, “kuklorest.update.plist” or “com.myppes.net-preferences.plist”.

Click on it and choose delete. It is essential to perform this step correctly and check all PLIST files.

Remove malware applications

This step is standard but needs to be done correctly.

Open Finder. Click on Apps on the left side of the menu. Then click on the column “Date modified,” and sort installed Mac applications by date.

Check all installed applications you don’t know and drag new applications into the trash. You can also right-click on the Application and choose Remove from the menu.

Uninstall extension

If you are dealing with a hijacked home page or unwanted advertisements in the browser, you should also perform the next step.

Safari

Open the Safari browser. Click on the Safari menu at the top. Click on Preferences from the menu. Go to the Extensions tab and remove all unknown extensions. Click on the extension and choose Uninstall.

Go to the General tab and enter a new homepage.

Google Chrome

Open the Google Chrome browser. Click on the Chrome menu at the top right. Click on Settings from the menu. Click on Extensions on the left side of the menu and remove all unknown extensions. Click on the extension and choose Remove.

If you can’t remove an extension or setting in Google Chrome due to a policy, use the Chrome policy remover.

Download Chrome Policy Remover for Mac. If you cannot open the policy remover tool. Click on the Apple icon in the top left corner. Click on System preferences. Click on Privacy and Security. Click the lock icon, enter your password and click on “Open Anyway”. Make sure to bookmark this page in a text file, Google chrome is shutdown!

Read more on how to remove advertisements from Google Chrome.

If you need help, please use the comments at the end of this instruction.