Mac OS X - Adware removal procedure (popup ads, banners,...)

October 2016

Mac OS X - Adware removal procedure (popup ads, banners,...)

When you browse the internet on Safari or any other web browser, you notice the presence of of advertising links (text highlighted in green), popup ads and banners!
It is most probable that your Mac has been infected by an adware. An adware is not a virus, but it is still considered as being harmful!
Learn how to clean your Mac:

Some free tools

To remove adware from your Mac, download and install the following tools:

Manual disinfection

In some situations the free tools may fail to disinfect your Mac (a new adware not listed by disinfection tool).
You can proceed to a manual removal procedure, which is similar for most adwares (Tblsearch, Vsearch, iMesh, searchme, Hide Ad, Open Ad, Nav-Link, navlink,...):
  • Go to Safari > Preferences > Extensions
  • Uninstall all unknown or suspicious extensions:
    • spigot
    • search
    • ebay
    • amazon
    • VSearch
    • Searchme
    • Nav Link
    • NavLink
    • Searchme
    • Slick Savings
    • Amazon Shopping
    • Assistant and Ebay Shopping Assistant
    • Nav-Link
    • NavLink
    • Genieo

Download and install EasyFind which allows for extensive search across your HDD.
EasyFind is a free software that can be downloaded from the AppStore or from this link:
  • Close Safari or any other browser.
  • Go to the main library of the Mac, specifically in the "Application Support" folders:
    • Hard Drive/Library/Application Support/
  • Also check in your personal library"
  • Users/Your username/Library/Application Support/

NB: As from Mac OS 10.7, your personal library is hidden, you access it from the Finder or the Go menu.
  • Search and delete the following folders:
    • VSearch or spigot
  • Once done, empty the trash (secured mode).
  • Delete the following files or folders:
    • /Library/LaunchAgents/com.vsearch.agent.plist
    • /Library/LaunchDaemons/com.vsearch.daemon.plist
    • /Library/LaunchDaemons/com.vsearch.helper.plist
    • /Library/LaunchDaemons/Jack.plist
    • /Library/PrivilegedHelperTools/Jack
  • Go to the Library, which is located in the System folder
  • /System/Library/Frameworks/VSearch.framework
  • Always inspect the files below:
    • Hard Drive/Library/LaunchDaemons
    • Hard Drive/System/Library/LaunchDaemons

  • These folders contain the daemons that run automatically at startup. Inspect thoroughly and remove suspicious items.
  • NB: There is a free utility and very useful to identify daemons or extensions running on the Mac.

Check if any suspicious item still remains on your system:
  • Launch EasyFind and search for the terms mentioned above.
  • If EasyFind find items related to these adware, right click > "Show in Finder".
  • Delete the file.

Restart your Mac, and download MacScan:
MacScan can detect trojans and other malwares.

Avoid getting infected

The below extension can help you to stay away from questionable sites:
Some recommendations:
  • Download software/plugins/extensions only from official sources (official websites).
  • Do not be tempted to install unknown free application.
  • Avoid illegal download sites, pirated software sites, porn sites, torrents (films, music, software..)

Get an antivirus for your Mac:
  • Free: Sophos
  • Paid: Kaspersky, VirusBarrier

Related :

This document entitled « Mac OS X - Adware removal procedure (popup ads, banners,...) » from CCM ( is made available under the Creative Commons license. You can copy, modify copies of this page, under the conditions stipulated by the license, as this note appears clearly.