How to Remove Savekeep

What is Save Keep?
Save Keep is an adware program, that displays extra  pop-up ads and advertisements on web pages that you visit. These advertisements will be shown as boxes containing various coupons that are available, as underlined keywords, pop-up ads or advertising banners.

How to remove Save Keep?
Scan your computer with Macware Adware Cleaner for Mac. Adware Cleaner will free your computer from annoying adware (e.g. Save Keep), malicious hijacker programs and unwanted toolbars.

How to manually remove Save Keep?
Locate and erase the following browser extensions: savekeep, suave keepo, save keep. Have in mind that there might be many extensions with similar names. We recommend that you remove all suspicious browser extensions.

Select your browser for more information on how to remove the malicous extension from your browser; Apple Safari Google Chrome or Mozilla Firefox

Also delete the following file if it exists;

/Applications/Savekeep.app

Afterwards, go through your browser’s preferences and adjust your search engine/homepage settings.

How to Remove Yontoo

What is Yontoo?
Yontoo is a web browser toolbar extension. It collects and stores information about your web browsing habits so they can suggest services or provide advertising. The program is typically bundled by 3rd party freeware applications as it is distributed through several monitization platforms.

How to remove Yontoo?
Scan your computer with Adware Cleaner for Mac. Adware Cleaner will free your computer from annoying adware, malicious hijacker programs and unwanted toolbars.

How to manually remove Yontoo?
You will need to remove the Yontoo extensions from the effected browser;

Uninstall Yontoo Safari Extension;
You can easily uninstall the Yontoo extension by selecting Safari > Preferences > Extensions > Uninstall. (See Remove Extensions from Safari for more detailed instructions)

Uninstall Yontoo Firefox Extension;
You can easily uninstall the Yontoo extension by selecting: Firefox > Tools > Add-ons > Extensions > Remove. (See Remove Extensions from Firefox for more detailed instructions)

Uninstall Yontoo Google Chrome Extension;
Google Chrome: You can easily uninstall the Yontoo  extension by selecting Window > Extensions > click the Trash Can icon. (See Remove Extensions from Chrome for more detailed instructions)

Remember to change the home page and search engine settings in your browser’s preferences.

How to Remove JollyWallet

What is JollyWallet?
Jollywallet is a browser plug-in created by Radyoos Media Ltd. It promises to save users money whilst shopping online (by recouping a percentage of any money spent). This browser add-on is not technically a computer virus or related to malware infections, however, computer users have recently reported that Jollywallet was installed on their computers without their consent. Many also complain that they feel annoyed by pop-ups ads generated by this browser add-on and prefer to shop online without the imposition of these offers. Unwilling or inadvertent installations such as these may occur as a result of Jollywallet’s use of a deceptive marketing method called bundling. Commonly, Internet users inadvertently install browser extensions such as these together with free software downloaded from the Internet.

How to automatically remove JollyWallet?
Scan your computer with Adware Cleaner for Mac. Adware Cleaner will free your computer from annoying adware (e.g. JollyWallet), malicious hijacker programs and unwanted toolbars.

How to remove JollyWallet?
Remove the JollyWallet extension from the effected browser;

(Also check for these related extensions; Online HD TV, PutLockerDownload, TornTV, Yontoo, 1ClickDown, 1ClickDownloader, FB Photo Zoom, GoPhoto.it, HDvid Codec, IB Updater, Incredibar Toolbar, OneClickDownload, OneClickDownloader)

Select your browser for more information on how to remove the JollyWallet extension from your browser; Apple Safari Google Chrome  or Mozilla Firefox

 

How to Remove Conduit

What is Conduit?
Conduit is a browser toolbar/hijacker that is usually installed without the user’s knowledge. Conduit is frequently bundled with freeware and shareware applications.

Conduit will change your browser homepage to search.conduit.com and default search engine to bing.com.

Apart from this unwanted browser changes, Conduit Search will add a toolbar on your browser and whenever your are doing a search, it will display on the first search results their own ads.

How to automatically remove Conduit?
Scan your computer with Macware Adware Cleaner for Mac. Adware Cleaner will free your computer from annoying adware, malicious hijacker programs and unwanted toolbars (e.g. Conduit).

How to manually remove Conduit?
Start by deleting these installed browser extensions (Conduit, Trovi, Search Protect, or myBrand) and the so-called Community Toolbars (for instance, Genealogy Gems Podcast, Wise Convert, MovieBario, SB Tool Bar, Game Master 1.1, Elf 1.15, and others extensions you do not recognize).

Select your browser for more information on how to remove the extensions from your browser; Apple Safari Google Chrome  or Mozilla Firefox

Locate and delete the following files;

/Library/InputManagers/CTLoader/
/Library/LaunchAgents/com.conduit.loader.agent.plist
/Library/LaunchDaemons/com.perion.searchprotectd.plist
/Library/Application Support/SIMBL/Plugins/CT2285220.bundle
/Library/Application Support/Conduit/
/Applications/SearchProtect.app
/Applications/SearchProtect/
~/Library/Application Support/Conduit/
~/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
~/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin
~/Conduit/
~/Trovi/

Some of the items can not be  removed without the administrator access.

If you have Firefox installed, go to the following folder:

~/Library/Application Support/Firefox/Profiles/

Inside that folder, you will find another folder whose name begins with a series of random characters and ends with “.default”. Open that folder. Inside this folder, remove the following items:

abstraction.js
takeOverNewTab.txt
searchplugins/[any file with "Conduit" in the name].xml
searchplugins/MyBrand.xml

Finally, be aware that some variants of Conduit are known to modify the Firefox application itself. If you have Firefox installed, there is no easy remedy to this except to delete the Firefox application entirely and download it again from mozilla.org.

If you found the CT2285220.bundle SIMBL plugin earlier, you will probably want to remove SIMBL as well, unless you had it installed for a specific purpose. To remove SIMBL, move the following items to the trash:

/Library/Application Support/SIMBL/
/Library/LaunchAgents/net.culater.SIMBL.Agent.plist
/Library/ScriptingAdditions/SIMBL.osax

Restart your computer. After it starts back up, empty the trash to delete all the removed files.

You may also need to change the home page and search engine settings in your browser’s preferences.

How to Remove Genieo

What is Genieo?
Genieo (known also as InstallMac) is probably one of the most prevalent adware programs in recent years. It was introduced by a well-known Israeli company who distributed it on the web.

Genieo is a “content recommendation engine,” which is installed on a local system to allow custom searches and targeted advertising to be presented on a homepage, managed through a browser extension. In essence, it tracks what you do and guides your searches and activity to relevant commercial sites and deals.

genieo_original
Genieo Homepage

This is somewhat similar to home pages like Google, Bing, Yahoo, or Facebook that offer their own recommendations, offers, ads, and other details based on your internet activity; however, while these do so from you logging into an online account, Genieo does so from being installed on your computer.

The Genieo engine and installer are openly available at the Genieo Website, and while the intention behind Genieo may have started as a legitimate effort, the engine has been used in a number of ways and has a couple of behaviors associated with it that have been suspicious:

  1. Genieo has been found in fake Flash Player installers and other disguised packages, which is a tell-tale sign of malicious distribution of the software.
  2. Genieo has not been easy to remove. While the program comes with an uninstaller, using this has proven to be ineffective for clearing the system of installed files.
  3. Genieo uses unconventional modifications to the operating system to tag its services onto existing applications.

One of the major problems that Genieo faces, is it promises developers a distribution and monetization platform through its sister effort called “InstallMac.” While intended to be somewhat like the Mac App Store in ways, any developer can package their software with InstallMac and get paid for each installation. Therefore, simply by downloading and installing a relatively unknown and un-vetted application, you could have installed the Genieo framework, plug-ins, and applications on your Mac.

Automatic Genieo Removal?
Scan your computer with Macware Adware Cleaner for Mac. Adware Cleaner will free your computer from annoying adware, malicious hijacker programs and unwanted toolbars.

How to manually remove Genieo?

1. On the Apple menu bar, in the top-right corner, click the Genieo icon and then select Quit.

Genieo_Apple_Menu

2. From the dock, launch Finder.

3. In the top-right corner of the Finder window, in the search box / spotlight search, type launchd.conf and press return.

4. To modify the search criteria and look for Genieo files in system files, click the Add (+) icon.

5. From the toolbar that appears under Search: This Mac, click Kind and then from the drop-down menu, select Other.
Genieo_Apple_Menu_2

6. In the Select a search attribute dialog box, scroll-down and check the box next to System files, and then click OK.

7. When the search criteria is set to System files, from the drop-down menu, select are included.

Search results are modified and system files with the keyword being searched is displayed.

8. Select launchd.conf from the search results, and move it to Trash.

If you cannot find "launchd.conf", do not delete ".dylib" files in Step 9. Follow the instructions carefully, deleting any inappropriate file can cause your computer to freeze and probably it may not restart.

9. On the Apple menu bar, click Go and then select Go to Folder.

/Applications/Genieo
/Applications/InstallMac
/Applications/Uninstall Genieo
/Applications/Uninstall IM Completer.app
~/Library/Application Support/com.genieoinnovation.Installer/
~/Library/Application Support/Genieo/
~/Library/LaunchAgents/com.genieo.completer.download.plist
~/Library/LaunchAgents/com.genieo.completer.update.plist
/Library/LaunchAgents/com.genieoinnovation.macextension.plist
/Library/LaunchAgents/com.genieo.engine.plist/Library/LaunchAgents/com.genieo.completer.update.plist
/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist
/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client
/usr/lib/libgenkit.dylib
/usr/lib/libgenkitsa.dylib
/usr/lib/libimckit.dylib
/usr/lib/libimckitsa.dylib

Where “.app”, “.plist”, and “.dylib” are all system files for Genieo. Move all the listed files to trash and then empty the Trash.

10. Remove the Omnibar extension from your browser. Detailed instructions can be found here.

11. Restart your computer.

How to Remove Vidx

What is Vidx?
Created by a company called VidX Project Ltd., Vidx is a potentially unwanted application, which installs on browsers (Safari, Google Chrome, and Mozilla Firefox) together with free software downloaded from the Internet. Developers of this browser add-on claim that Vidx creates a noticeably superior digital video viewing experience. In fact, this add-on is categorized as a potentially unwanted application, since it installs on Internet browsers without users’ consent and generates intrusive ads.

After Vidx installation, users continually observe various banners and coupon ads whilst browsing the Internet. Furthermore, this adware tracks users’ browsing activity by recording pages visited, users’ approximate geo-locations, IP addresses, browser types, time zones, operating systems, default search providers, browser languages, operating system languages, and other information. This plug-in adds no significant value, diminishes Internet browser performance, and its presence on your system may lead to serious malware infections and privacy issues. Users who observe intrusive online ads displaying “Ads by Vidx” and “Powered by Vidx” should eliminate this adware from their Internet browser/s.

How to remove Vidx?
Scan your computer with MacWare Adware Cleaner for Mac. Adware Cleaner will free your computer from annoying adware (e.g. Vidx), malicious hijacker programs and unwanted toolbars.

How to manually remove Vidx?
Locate and delete any browser extension that has one of these names:

  • Vidx (or versions such as Vidox, ViddX, ViiDDx and Viidax)
  • MacVx (or version such as MacVox or MacVax)
  • MacPriceCut
  • MacCaptain
  • Mac Global Deal
  • MacDeals
  • Save on Mace
  • Shop Brain (or versions such as SShoP or Braaiin)
  • MacXcoupon
  • MacMin (or variants such as MacMMin or MaucMino)
  • MacCostDon’t be surprised if there is more than one

Select your browser for more information on how to remove the extensions from your browser; Apple Safari Google Chrome or Mozilla Firefox

Also remove the following files;

/Applications/Vidx.app
/Applications/MacMin.app
/Library/Application Support/VidToMP3
/Library/Application Support/fa4e8.94b.550d413f
~/Library/Application Support/osxDownloader

(If you locate files with the same name in other folders remove them as well.)

Check the following folder too: /Library/LaunchDaemons/
In this folder look for files with nonsensical names (for instance, ‘IKoJCcOml.plist’) If you find any nonsensical files delete them immediately. Delete nothing else from this folder!

Vidx can also attach malicious JavaScript codes to your browser preferences (both Firefox and Chrome). The effect is not detrimental, but we still advise you to remove those particular files:

Chrome’s preferences are located here:
~/Library/Application Support/Google/Chrome/Default/Preferences

Firefox preferences can be found inside the following folder:
~/Library/Application Support/Firefox/Profiles/

Once you have located the folder, there will be another folder named with random characters and the word ‘default’. Open this folder and locate the file named prefs.js. Once found delete it.

How to Remove GoPhoto.it

What is GoPhoto.it?
GoPhoto.It is a program and browser extension designed for viewing zoomable thumbnails as a high quality images for photoalbums and profiles on a Facebook, Flickr, and other websites. It offers sharing and applying various effects to these images. However, GoPhoto.It is packed with adware developed for displaying ads in your Chrome, Firefox, and Internet Explorer. Attractive features facilitate the installation, but GoPhoto.It is often deceptively installed with other free programs. Adware runs activities that can compromise your security and privacy. GoPhoto.It tracks your web browsing and collects various information about your computer system, location, and websites that you visit. This information is commonly shared among promoters and is eventually accessed by third parties that can use it with malicious purpose. As a result, your identity might be stolen and used for thieft and other illegal activities.

gophoto.it-adware

How to remove GoPhoto.it?
Scan your computer with Adware Cleaner for Mac. Adware Cleaner will free your computer from annoying adware (e.g. GoPhoto.it), malicious hijacker programs and unwanted toolbars.

How to manually remove GoPhoto.it?
Remove toolbars, plugins, extensions, add-ons from the effected browser.

Uninstall GoPhoto.it Safari Extensions;
You can easily uninstall the GoPhoto.it extensions by selecting Safari > Preferences > Extensions > Find the GoPhoto.it extension (It may be listed as another name) > Uninstall

Uninstall GoPhoto.it Firefox Extensions;
You can easily uninstall the the SGoPhoto.it by selecting: Firefox > Tools > Add-ons > Extensions > Find the GoPhoto.it extension (It may be listed as another name) > Remove

Uninstall GoPhoto.it Google Chrome Extensions;
Google Chrome: You can easily uninstall the GoPhoto.it by selecting Window > Extensions > Find the GoPhoto.it extension (It may be listed as another name) > click the Trash Can icon.

 

 

How to Remove Spigot

What is Spigot?
Spigot is a term used to describe potentially unwanted applications developed by Spigot Inc. Adware created by this company installs together with free software using a deceptive software marketing method called ‘bundling’. Commonly, computer users install such unwanted applications whilst downloading free software. Today, most freeware download websites (including download.com, soft32.com, softonic.com, etc.) use deceptive ‘download clients’, which manage the download process of free software – these small programs are also used to monetize the free downloads by offering installation of promoted browser plugins.

How to quickly remove Spigot?
Scan your computer with Adware Cleaner for Mac. Adware Cleaner will free your computer from annoying adware (e.g. Spigot), malicious hijacker programs and unwanted toolbars.

How to manually remove Spigot?

Uninstall Spigot Safari Extensions;
You can easily uninstall the Searchme, Savings Slider, Ebay Shopping Assistant, Amazon Shopping Assistant extensions by selecting Safari > Preferences > Extensions > Uninstall

spigot-1

(Remove Extensions from Safari  detailed instructions)

Uninstall Spigot Firefox Extensions;
You can easily uninstall the the Searchme, Savings Slider, Ebay Shopping Assistant, Amazon Shopping Assistant extensions by selecting: Firefox > Tools > Add-ons > Extensions > Remove

spigot-2

(Remove Extensions from Firefox detailed instructions)

Uninstall Spigot Google Chrome Extensions;
You can easily uninstall the Searchme, Domain Error Assistant, Ebay Shopping Assistant, Amazon Shopping Assistant, Savings Slider extensions by selecting Window > Extensions > click the Trash Can icon.

spigot-3
(Remove Extensions from Chrome detailed instructions)

 

Locate and delete the following files;

~/Library/LaunchAgents/com.spigot.SearchProtection.plist
~/Library/LaunchAgents/com.spigot.ApplicationManager.plist
~/Library/Application Support/Spigot/

Afterwards, go through your browser’s preferences and adjust your search engine and homepage settings.

How to Remove Premier Opinion

What is PremierOpinion?
PremierOpinion is a spyware infection with adware techniques and has root components that allow PremierOpinion to start up automatically whenever the victim tries to shut PremierOpinion down.

PremierOpinion is often contained in a fake screensaver for Mac OS X computer. Also, known as OpinionSpy, PremierOpinion can also be contained in various infected applications systems.

How to remove PremierOpinion?
Scan your computer with Adware Cleaner for Mac. Adware Cleaner will free your computer from annoying adware, malicious hijacker (e.g. PremierOpinion) programs and unwanted toolbars.

How to manually remove PremierOpinion?
Unfortunately, security companies have no full insight on all Premier Option’s malicious capacities. The older version was known to give creators a backdoor to access infected systems, a trick which is very likely present in the new version too.

The safest thing to do is to erase all data from the hard drive and to install OSX again. In the following paragraph, we will provide some directions for those who want to remove Premier Opinion without removing everything else.

Firstly, erase the browser extension caused by Premier Opinion. Locate all unknown extensions and place them in the trash. Also remove files/folders located at ;

/Applications/PremierOpinion
/Library/LaunchDaemons/PremierOpinion.plist

Remember that in order to delete, you should be logged in as the administrator. After the procedure is finished, restart your Mac and empty the trash.

We also recommend you to adjust your search engine and homepage settings.

How to Remove VSearch

What is VSearch?
VSearch is a relatively popular adware program, met mostly under the cover of a video-streaming installers. Some of you may recognise it under the name of Downlite, a scam torrent-downloader which has not been present on the web recently. VSearch can be easily recognised-once you’re trying to open a particular page, it redirects you to another search engine, or it simply causes unrelated pop-up advertisement to appear on your screen. VSearch was a pioneer among adware apps to be identified as malicious by Apple. The program was blocked, but the threat remains.

How to remove VSearch?
The following things should be eliminated. Have in mind that for some of them you should have administrator access, so check whether you’re actually logged in through your Mac’s admin account. If you are not, it is very likely that you will be unable to delete some items. Further on, remember that we are only discussing the known VSearch items, which doesn’t encompass all of them. If you are not able to find a specific file using the path below, read something on locating files from paths.
/Library/Application Support/VSearch /Library/LaunchAgents/com.vsearch.agent.plist /Library/LaunchDaemons/com.vsearch.daemon.plist /Library/LaunchDaemons/com.vsearch.helper.plist /Library/LaunchDaemons/Jack.plist /Library/PrivilegedHelperTools/Jack /System/Library/Frameworks/VSearch.framework /System/Library/Frameworks/v.framework

Files can also appear under the following names (‘xxx’ can replace any word):

/Library/LaunchAgents/com.xxx.agent.plist
/Library/LaunchDaemons/com.xxx.daemon.plist
/Library/LaunchDaemons/com.xxx.helper.plist

As we mentioned, ‘xxx’ can stand for any word. What is important to remember is that the particular word in a system will repeat itself in all files on that system.Therefore, if you recognise the word in any of your files-delete them!

Additionally, check the LaunchAgent and LaunchDemons files and look for specific ‘xxx’ locations:

/Library/Application Support/xxx
/System/Library/Frameworks/xxx.framework

Once you’re done with eliminating known VSearch files, restart your computer and empty the trash.