Remove Fake Flash Player Mac Free Download

Learn how to remove fake Adobe Flash Player update virus from Mac and thereby prevent the browser from being redirected to rogue software installation websites.

Update: March 2020

Threat Profile
NameFake Adobe Flash Player update virus
CategoryMac browser hijacker, redirect/popup virus, Mac adware
DetectionAvast: MacOS:AMC-DK [PUP], Avira: PUA/OSX.GT32SupportGeeks.hflsn, BitDefender: Adware.MAC.Generic.12496, ESET: A Variant Of OSX/GT32SupportGeeks.B, Kaspersky: Trojan-Downloader.OSX.Shlayer.a, Microsoft: PUA:MacOS/AMCleaner.B!MTB, Sophos: AdvancedMacCleaner (PUA), Symantec: OSX.Trojan.Gen.2
DetectionAvast: MacOS:AMC-DK [PUP], Avira: PUA/OSX.GT32SupportGeeks.hflsn, BitDefender: Adware.MAC.Generic.12496, ESET: A Variant Of OSX/GT32SupportGeeks.B, Kaspersky: Trojan-Downloader.OSX.Shlayer.a, Microsoft: PUA:MacOS/AMCleaner.B!MTB, Sophos: AdvancedMacCleaner (PUA), Symantec: OSX.Trojan.Gen.2
Distribution TechniquesFreeware bundles, torrents, booby-trapped software updates, misleading popup ads
Severity LevelMedium
DamageInterference with browsing settings, harmful downloads, privacy issues due to Internet activity tracking, search redirects, malicious ads
RemovalScan your Mac with Combo Cleaner to detect all files related to the browser hijacker. Use the tool to remove the infection if found.

It’s unknown what malware may have been downloaded to your device, so you should remove Fake Adobe Flash Player install with the help of powerful security software. Getting rid of Flash Player virus on Mac operating system. To remove fake Adobe Flash update virus on Mac, you need to scan it with computer repair software.

Flash player 10 free download
  1. May 05, 2017  The file, named Install Adobe Flash, will appear to be an Adobe Flash installer (Say what you will about Flash, but there are still a lot of people that have to use it for school or work). From Malwarebytes: If the app is opened, it will immediately ask for an admin user password, which is typical behavior for a real Flash installer.
  2. How to Remove “Flash Player Update REQUIRED” Virus on Mac Here’s a thing: clicking the Cancel or Later button will not get rid of the Adobe Flash Player update prompt on Mac. It will keep on asking you to download the update and install it on your computer.

The Adobe Flash Player update virus is one of the common ways cybercriminals try to deposit additional harmful code onto a Mac. It usually operates in tandem with such threats as bogus system utilities that report non-existent problems and thus attempt to manipulate users into activating the licensed copy of the scareware. This type of a ruse can be used to promote such unwanted apps as Mac Auto Fixer, Mac Cleanup Pro or Easy Mac Care. These opportunistic infections will run phony scans of the host system and claim to detect hundreds of issues – ones that aren’t there for real. The targeted Mac users therefore deal with a double contamination scenario, where they first encounter recurrent and really annoying instances of browser rerouting and then suffer the consequences of counterfeit software activity. It’s the early stage of the brainwashing that is backed by the Adobe Flash Player update virus popups.

The reason why the architects of this trickery have added the Flash Player to the mix of their shenanigans is probably because it’s a commonly used program trusted by most users. The caveat is that a completely different piece of code is camouflaged as the explicitly stated software. This part of the incursion is usually isolated to the web browser, although there are rare cases where the misguiding popups appear when the browser is closed. The virus manifests itself through random redirects to a site that instantly displays a popup alert saying:

'Adobe Flash Player' is out of date
To continue using “Adobe Flash Player”, download an updated version.

Meanwhile, a prompt at the top of the page layout may wrongfully emphasize that “Latest version of Adobe Flash Player is required to encode and/or decode (Play) audio files in high quality”. Everybody likes quality multimedia content, so a lot of users end up falling for this trick.

In all of these adverse situations, those who pay attention to detail will notice that there is something wrong with such a recommendation. First off, the URL of the website that generates these Adobe Flash Player update popups is a giveaway. Obviously, it has nothing to do with the genuine vendor, being clearly designed to mimic the legit update workflow. Furthermore, despite the fact that the alerts may provide a button to opt out, such as “Later” or “Cancel”, clicking it isn’t likely to close the dialogs for more than a few milliseconds. The pre-configured website script will relaunch the ads, so the victims may have to force quit Safari, Chrome, Firefox – or whatever browser is infected – to get the bogus notifications out of the way.

Special Offer
Fake Adobe Flash Player Update virus may re-infect your Mac multiple times unless you delete all of its fragments, including hidden ones. Therefore, it is recommended to download Combo Cleaner and scan your system for these stubborn files. This way, you may reduce the cleanup time from hours to minutes. Download NowLearn how ComboCleaner works. If the utility spots malicious code, you will need to buy a license to get rid of it.

A few examples of the spoofed promo pages massively reported by victims are, and The list of these malware serving domains is constantly expanding as old ones are being knocked offline in response to victims’ complaints or blacklisting on the browser end. Incidentally, the above-mentioned scam sites splashed onto the scene amidst a spike in the fake Flash Player update hoax in March 2020, which co-occurred with a very unsettling trend. Numerous Mac users claim to be redirected to these malware-riddled pages when on reputable resources with huge user audiences, including CNN and NY Times news outlets. One of the theories why this could be happening is that the criminals may have somehow injected malicious scripts into a number of popular websites so that the visitors end up being forwarded to unwanted landing pages.

A whole new attack mechanism with the fake Adobe Flash Player update popups at its core is distributing an emerging Mac threat codenamed Tarmac. Also known as OSX/Tarmac, this infection relies on another type of harmful code called Trojan:OSX/Shlayer. The latter is a notorious Mac Trojan whose objective is to set large-scale malvertising schemes in motion. Its original entry point is a phony alert about an out-of-date version of the Flash Player. Once inside, it reaches out to the Command and Control server and downloads a copy of Tarmac onto the host. The second-stage malware is code signed and leverages RSA encryption to camouflage the fishy gist of its payload, which allows the pest to fly below the radar of quarantine-aware software running on the Mac. As soon as OSX/Tarmac is launched, it attempts to elevate its privileges on the machine by generating a dialog that says, “Play wants to make changes”.

This popup asks for the administrator’s username and password, making it look like the request comes from Adobe Flash Player. Even if the victim is prudent enough to refrain from entering the credentials, Tarmac continues to run with fairly high permissions. Just like Shlayer, it can easily connect to its C&C server and download arbitrary code from it, such as rogue system utilities, adware, or even Mac ransomware. This recently discovered tandem of dangerous programs relying on counterfeit Flash Player update ads demonstrates that the campaign is evolving and assuming more unsettling characteristics.

In January 2020, security analysts unveiled some eyebrow-raising details about the scope of Shlayer wave that piggybacks on rogue Flash Player update popups. According to these findings, one of this Trojan’s iterations was the top Mac threat picked up by a popular antimalware solution last year. Aside from well-orchestrated social engineering trickery, its domination stems from the fact that the operators of this scam have been actively recruiting YouTube channel owners, Wikipedia writers, and bloggers with large subscriber audiences to post ads leading to the malware-riddled downloads. There is also a hefty number of malicious sites created specifically to spread the plague. Some of these trojanized links posted on various legit web outlets lead to domains that expired recently, and it appears that the crooks have bought and repurposed them to serve up the infection. As a result, Mac users who are looking up some trending terms on search engines, such as a new TV show episode or a live stream of a sports event, run the risk of visiting the wrong page that hosts the shady installer.

This troublemaking scenario tends to be bolstered by a malicious browser plugin or extension. The fake helper object modifies Internet settings, such as the homepage or search defaults, and may even interfere with the DNS server preset. This is what causes the redirects in the first place. What happens if you click “OK” and actually download the pseudo Adobe Flash Player update is a whole new attack layer. The affiliated harmful program will establish persistence on the Mac by adding itself to Login Items and utilizing antivirus evasion mechanisms. Then, it will start launching scans of the macOS, purporting to find numerous memory issues and security problems each time. Again, this routine is aimed at pressuring the victim into making a hasty decision to pay for the cyber-impostor’s licensed version. So much for the tactic. Speaking of the fix for the Adobe Flash Player update virus activity, the only method is to spot the components of the pest on the Mac and remove them. See below to learn how it’s done.

Fake Adobe Flash Player update virus manual removal for Mac

The steps listed below will walk you through the removal of this malicious application. Be sure to follow the instructions in the order specified.

  • Open up the Utilities folder as shown below
  • Locate the Activity Monitor icon on the screen and double-click on it
  • Under Activity Monitor, find an entry that appears suspicious and shouldn’t be among the running processes, select it and click Quit Process
  • A dialog should pop up, asking if you are sure you would like to quit the troublemaking process. Select the Force Quit option
  • Click the Go button again, but this time select Applications on the list. Find the malicious entry on the interface, right-click on it and select Move to Trash. If user password is required, go ahead and enter it
  • Now go to Apple Menu and pick the System Preferences option
  • Select Accounts and click the Login Items button. The system will come up with the list of the items that launch when the computer is started up. Locate the likely culprit that doesn’t belong there and click on the “-“ button

Get rid of fake Adobe Flash Player update popups in web browser on Mac

To begin with, settings for the web browser that got hit by the Adobe Flash Player update Mac virus should be restored to their default values. The overview of steps for this procedure is as follows:

  1. Reset Safari
    • Open the browser and go to Safari menu. Select Preferences in the drop-down list
    • Once the Preferences screen appears, hit the Privacy tab at the top. Find the option that says Remove All Website Data and click on it
    • The system will display a confirmation dialog that also includes a brief description of what the reset does. Specifically, you may be logged out of some services and encounter other changes of website behavior after the procedure. If you’re okay with that, go ahead and click the Remove Now button
    • In order to selectively clear data generated by certain websites only, not all of them, hit the Details button under the Privacy section of Safari Preferences
    • This feature will list all websites that have stored potentially sensitive data, including cache and cookies. Select the one, or ones, that might be causing trouble and click the appropriate button at the bottom (Remove or Remove All). Click the Done button to exit.
  2. Reset Google Chrome
    • Open Chrome, click the More (⁝) icon in the top right-hand part of the window, and select Settings in the drop-down
    • When on the Settings pane, select Advanced
    • Scroll down to the Reset settings section. Under the Restore settings to their original defaults option, click the Reset settings button
    • Confirm the Chrome reset on a dialog that will pop up. When the procedure is completed, relaunch the browser and check it for malware activity.
  3. Reset Mozilla Firefox
    • Open Firefox and select HelpTroubleshooting Information
    • On the page that opened, click the Reset Firefox button

Get rid of Adobe Flash Player update virus using Combo Cleaner removal tool

The Mac maintenance and security app called Combo Cleaner is a one-stop tool to detect and remove Fake Adobe Flash Player Update virus. This technique has substantial benefits over manual cleanup, because the utility gets hourly virus definition updates and can accurately spot even the newest Mac infections.

Furthermore, the automatic solution will find the core files of the malware deep down the system structure, which might otherwise be a challenge to locate. Here’s a walkthrough to sort out the Fake Adobe Flash Player Update issue using Combo Cleaner:

  1. Download Combo Cleaner installer. When done, double-click the combocleaner.dmg file and follow the prompts to install the tool onto your Mac.

    By downloading any applications recommended on this website you agree to our Terms and Conditions and Privacy Policy. The free scanner checks whether your Mac is infected. To get rid of malware, you need to purchase the Premium version of Combo Cleaner.

  2. Open the app from your Launchpad and let it run the update of malware signature database to make sure it can identify the latest threats.
  3. Click the Start Combo Scan button to check your Mac for malicious activity as well as performance issues.
  4. Examine the scan results. If the report says “No Threats”, then you are on the right track with the manual cleaning and can safely proceed to tidy up the web browser that may continue to act up due to the after-effects of the malware attack (see instructions above).
  5. In case Combo Cleaner has detected malicious code, click the Remove Selected Items button and have the utility remove Fake Adobe Flash Player Update threat along with any other viruses, PUPs (potentially unwanted programs), or junk files that don’t belong on your Mac.
  6. Once you have made doubly sure that the malicious app is uninstalled, the browser-level troubleshooting might still be on your to-do list. If your preferred browser is affected, resort to the previous section of this tutorial to revert to hassle-free web surfing.


Whereas Adobe Flash Player is useful software that enhances your online experience in plenty of ways, it can as well be a source of vulnerabilities exposing your Mac to cyber-attacks. Furthermore, many users simply don’t catch up with the frequent patches rolled out by the publisher, inadvertently turning their computers into low-hanging fruit.

It comes as no surprise that many users end up disabling the Flash plugin in their web browser at some point. This tool can be safely turned off at the browser level without the need to uninstall it from a Mac altogether. Here is how to disable it in popular browsers:

  • In Safari menu bar, select Preferences
  • Select the Security tab, spot the Internet Plug-ins area, and click Plug-in Settings
  • Remove the checkmark next to Adobe Flash Player in the subsequent screen
  • Click Done
Google Chrome:
  • Type chrome://settings/content in Chrome’s URL bar
  • Scroll down and find the Flash entry on the page. Click it
  • Spot the Allow sites to run Flash option and toggle it off using the adjacent slider

Adobe Flash Player Mac

Mozilla Firefox:
  • Type about:addons in the URL bar and hit Enter
  • Select Plugins in the left-hand navigation bar
  • Find the Flash Player plugin and expand the appropriate menu
  • Choose between Ask to Activate and Never Activate options. The latter is preferable if you don’t want to see annoying popup dialogs during web surfing.

In case the regular Flash Player update popups are interrupting your activities, there is a way to get them out of sight. Be advised that by clicking the Remind Me Later button on these notifications you simply postpone the process, and the irritating message will reappear in an hour. Here’s how to prevent these messages from appearing on your Mac for good:

  • Go to the Finder and select System Preferences
  • Click the Flash Player icon
  • When on the Flash Player screen, hit the Updates tab in its upper part
  • You will see the following options to choose from: Allow Adobe to install updates, Notify me to install updates, and Never check for updates
  • Enable a radio button next to the Never check for updates option. You can alternatively allow Adobe to install updates – in that case, Flash Player will be updated on its own without producing any popups

If a malicious app is already on board your system, then a macOS update isn’t likely to fix the problem. That being said, updating your Mac does address known security vulnerabilities so that you are protected against common exploits and mainstream viruses further on. Another benefit of applying the updates as soon as they are available is that your Mac will be optimized to ensure smooth performance. Keep in mind that human error might undermine the built-in Mac defenses no matter how top-notch they are.

No, you can’t – as long as you diligently keep Flash Player up to date and all the new versions are installed from the official source. In a vast majority of incidents where this utility is exploited to deposit malware onto Macs, the victims neglect the update hygiene and use very old versions of the product with multiple unpatched security loopholes in them.

Flash updates pushed via popup alerts on rogue websites are a completely different story. The installation clients in this case include bundled malware. If you happen to opt for this kind of an offer, a contamination is pretty much inevitable. The article above highlights the common infection scenarios through fake Adobe Flash Player update notifications. Note that Mac users are typically redirected to these landing pages because their browsers have been hijacked. Therefore, removal of the underlying virus is a prerequisite of addressing the predicament.


How to remove 'Fake Software Update' from Mac computers

What is 'Fake Software Update'?

Fake Software Update refers to a deceptive pop-up window, which claims that the Adobe Flash Player is outdated and requires an update. This scam promotes various rogue applications (e.g., browser hijackers and adware) and other potentially malicious content via fake Flash Player updaters/installers. These pop-ups are usually displayed by deceptive/scam websites that are rarely accessed intentionally - most visitors to them are redirected by Potentially Unwanted Applications (PUAs) or intrusive advertisements.

There are several variants of the Fake Software Update. One of these variants firstly displays a pop-up window claiming that Adobe Flash Player is out-of-date. Its second pop-up states that, due to this, the current version does not have the latest security updates and cannot be used until it is updated. It shows another window in the bottom right corner of the web page, which urges users to install the updates to continue using the Flash Player. The background page states that the newest updates are necessary to encode and/or decode audio files for the best experience (i.e., play them effectively). It also adds that Adobe Flash Player is a vital browser plug-in, allowing users to view content ranging from videos and animation to playing games online. Since the software it outdated, it has supposedly been blocked and will not perform any functions. As with the pop-up windows, this page also has several buttons for downloading the alleged Flash Player updates. Another variant of the scam shows a pop-up window informing users that Adobe Flash Player may be out of date. Additionally, the installed version might not have the latest security updates, and therefore might not be currently operational. This pop-up reassures users that these updates do not require a system reboot. Despite a legitimate appearance, these alerts are bogus and fake. Clicking the 'update/download' buttons leads to download of the supposed updates. The installation setup bears many similarities to the genuine Flash Player updater, however, it is fake. Any content installed through these false set-ups is rogue and possibly even malicious. You are strongly advised to ignore such alerts and immediately leave any web page displaying them. Should that be impossible by closing the browser tab/window (some scam sites prevent users from doing so), use the activity monitor to terminate the browser process. When the browser is reopened, do not restore the previous browsing session, otherwise the deceptive web page is also reopened (or the website that redirected to it).

PUAs can infiltrate the Fake Software Update scam into the system. These applications appear normal and offer a broad array of 'useful' and 'beneficial' features to lure users to install. The functions rarely work as advertised and, in most cases, are nonoperational. PUAs generate redirects to deceptive/scam pages and various sale-based, untrustworthy, compromised, or even malicious websites. They can deliver intrusive ad campaigns by employing tools to enable third party graphical content to be displayed on any site, thereby delivering unwanted and harmful ads, which diminish the browsing experience, cause redirects to likewise dangerous web pages, and stealthily download/install other PUAs. Other types can make unauthorized changes to browsers (hijack them) and promote fake search engines. PUAs commonly have data tracking capabilities. They record browsing activity (browsing and search engine histories) and collect users' personal information (IP addresses, geolocations and other details). This sensitive data is then shared with third parties (potentially, cyber criminals) seeking to misuse it for financial gain. In summary, PUAs present on devices can lead to browser and system infiltration/infections, financial loss, serious privacy issues, and even identity theft. To ensure device and user safety, remove all suspicious applications and browser extensions/plug-ins immediately upon detection.

Threat Summary:
NameFake Software Update pop-up
Threat TypePhishing, Scam, Mac malware, Mac virus.
Fake ClaimScam claims that the Adobe Flash Player is outdated and recommends that it is updated.
Detection NamesAvast (Other:Malware-gen [Trj]), BitDefender (Adware.MAC.Bundlore.DPS), AVG (Other:Malware-gen [Trj]), Kaspersky (HEUR:Trojan-Downloader.OSX.Shlayer.a), Full List (VirusTotal)
SymptomsYour Mac becomes slower than normal, you see unwanted pop-up ads, you are redirected to dubious websites.
Distribution methodsDeceptive pop-up ads, free software installers (bundling), fake Flash Player installers, torrent file downloads.
DamageInternet browser tracking (potential privacy issues), display of unwanted ads, redirects to dubious websites, loss of private information.

To eliminate malware infections our security researchers recommend scanning your Mac with Combo Cleaner.
▼ Download Combo Cleaner for Mac
Free scanner checks if your computer is infected. To remove malware, you have to purchase the full version of Combo Cleaner.

The Internet is rife with deceptive websites. Scams similar to Fake Software Update include 'Your Mac/iOS may be infected with 5 viruses!', 'Your Mac OS Might Be Infected', 'You-Have-1-Message-About-Your-Device', and many others. They typically use scare tactics to tempt visitors into downloading/installing and/or purchasing untrustworthy applications. For example, they warn users that a crucial piece of software is outdated and offer updates for it. These web pages can also show alarms claiming that the device is infected and promote certain apps for elimination of the fake problem. Note that no site can find threats/issues on an operating system. Any that make such claims are deceptive and must not be trusted. The same extends to the software they advertise. You are advised against downloading/installing/purchasing content endorsed on these pages.

How did potentially unwanted applications install on my computer?

Some PUAs have 'official' download pages, however, they can also be installed together with other products. This deceptive marketing method of packing regular software with unwanted or malicious content is called 'bundling'. Rushing download/installation processes (e.g. ignoring terms, skipping steps and sections, etc.) increases the risk of unintentionally allowing bundled applications onto devices. Once clicked, intrusive ads can execute scripts designed to download/install PUAs without users' consent.

How to avoid installation of potentially unwanted applications

Research content carefully before downloading/installing. Use only official and verified download channels. Peer-to-Peer sharing networks (BitTorrent, eMule, Gnutella), unofficial and free-file hosting websites, third party downloaders and similar sources are untrusted and should be avoided. Use tools/functions provided by legitimate developers to update software. Treat download/Installation processes with caution. Read the terms, study available options, use the 'Custom/Advanced' settings to decline downloading/installing additional apps, tools, features, etc. Intrusive ads may not seem suspicious, however, when clicked they redirect to dubious sites (e.g. gambling, pornography, adult-dating and others). If you encounter ads/redirects of this kind, inspect the device and remove all suspicious applications and/or browser extensions/plug-ins without delay. If your computer is already infected with PUAs, we recommend running a scan withCombo Cleaner Antivirus for macOS to automatically eliminate them.

Screenshot of the initial pop-up window:

Text displayed in the pop-up windows:

Initial pop-up:

Update to the latest version of Flash Player. Your current Adobe Flash Player version is out of date.


Second pop-up:

“Adobe Flash Player” is out-of-date

The version of this plug-in on your computer doesn't include the latest security updates. Flash cannot be used until you download an update from Adobe.Update Download Flash..


Bottom-right pop-up:

Flash Player Update
Install latest version of Adobe Flash Player in order to continue watching.

Screenshot of the background page:

Text displayed in this page:

Latest version of Flash Player is required to encode and/or decode (Play) audio files in high quality. - Click here to update for latest version.

Software update
Adobe Flash Player
Install the latest update
Update Now

'Adobe Flash Player' is an essential plugin for your browser that allows you to view everything from video to games and animation on the web. The version of “Adobe Flash Player' on your system does not include the latest security updates and has been blocked.

To continue using “Adobe Flash Player', download an updated version.
UpdateDownload Flash...
Software update

Screenshot of another variant of the Fake Software Update scam pop-up:

Text presented in this pop-up window:

Software update

Software Update
This update is recommended and no restart is needed

macOS Catalina Beta
10.15 - 6.45 GB

Your Adobe Flash Player may be out of date

The version of this plug-in on your computer might not include the latest security updates. Flash might not work until you download an update

Screenshots of the fake Adobe Flash Player installer promoted via Fake Software Update pop-up scam:

Instant automatic Mac malware removal:Manual threat removal might be a lengthy and complicated process that requires advanced computer skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of Mac malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner for MacBy downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. Free scanner checks if your computer is infected. To remove malware, you have to purchase the full version of Combo Cleaner.

Quick menu:

  • STEP 1. Remove PUA related files and folders from OSX.
  • STEP 2. Remove rogue extensions from Safari.
  • STEP 3. Remove rogue add-ons from Google Chrome.
  • STEP 4. Remove potentially unwanted plug-ins from Mozilla Firefox.

Video showing how to remove adware and browser hijackers from a Mac computer:

Potentially unwanted applications removal:

Remove potentially unwanted applications from your 'Applications' folder:

Click the Finder icon. In the Finder window, select 'Applications'. In the applications folder, look for 'MPlayerX','NicePlayer', or other suspicious applications and drag them to the Trash. After removing the potentially unwanted application(s) that cause online ads, scan your Mac for any remaining unwanted components.

Flash Player 10 Free Download

Free scanner checks if your computer is infected. To remove malware, you have to purchase the full version of Combo Cleaner.

Remove fake software update pop-up related files and folders:

Click the Finder icon, from the menu bar. Choose Go, and click Go to Folder...

Check for adware-generated files in the /Library/LaunchAgents folder:

In the Go to Folder... bar, type: /Library/LaunchAgents

In the “LaunchAgents” folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - “installmac.AppRemoval.plist”, “”, “mykotlerino.ltvbit.plist”, “kuklorest.update.plist”, etc. Adware commonly installs several files with the same string.

Check for adware generated files in the /Library/Application Support folder:

In the Go to Folder... bar, type: /Library/Application Support

In the “Application Support” folder, look for any recently-added suspicious folders. For example, “MplayerX” or “NicePlayer”, and move these folders to the Trash.

Check for adware-generated files in the ~/Library/LaunchAgents folder:

In the Go to Folder bar, type: ~/Library/LaunchAgents

Remove Fake Flash Player Mac Free Download Windows 7

In the “LaunchAgents” folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - “installmac.AppRemoval.plist”, “”, “mykotlerino.ltvbit.plist”, “kuklorest.update.plist”, etc. Adware commonly installs several files with the same string.

Check for adware-generated files in the /Library/LaunchDaemons folder:

In the Go to Folder... bar, type: /Library/LaunchDaemons

In the “LaunchDaemons” folder, look for recently-added suspicious files. For example “”, “”, '”, “com.avickUpd.plist”, etc., and move them to the Trash.

Scan your Mac with Combo Cleaner:

If you have followed all the steps in the correct order you Mac should be clean of infections. To be sure your system is not infected run a scan with Combo Cleaner Antivirus. Download it HERE. After downloading the file double click combocleaner.dmg installer, in the opened window drag and drop Combo Cleaner icon on top of the Applications icon. Now open your launchpad and click on the Combo Cleaner icon. Wait until Combo Cleaner updates it's virus definition database and click 'Start Combo Scan' button.

Combo Cleaner will scan your Mac for malware infections. If the antivirus scan displays 'no threats found' - this means that you can continue with the removal guide, otherwise it's recommended to remove any found infections before continuing.

After removing files and folders generated by the adware, continue to remove rogue extensions from your Internet browsers.

Fake Software Update pop-up removal from Internet browsers:

Remove malicious extensions from Safari:

Remove fake software update pop-up related Safari extensions:

Open Safari browser, from the menu bar, select 'Safari' and click 'Preferences...'.

In the preferences window, select 'Extensions' and look for any recently-installed suspicious extensions. When located, click the 'Uninstall' button next to it/them. Note that you can safely uninstall all extensions from your Safari browser - none are crucial for normal browser operation.

  • If you continue to have problems with browser redirects and unwanted advertisements - Reset Safari.

Remove malicious plug-ins from Mozilla Firefox:

Remove fake software update pop-up related Mozilla Firefox add-ons:

Open your Mozilla Firefox browser. At the top right corner of the screen, click the 'Open Menu' (three horizontal lines) button. From the opened menu, choose 'Add-ons'.

Choose the 'Extensions' tab and look for any recently-installed suspicious add-ons. When located, click the 'Remove' button next to it/them. Note that you can safely uninstall all extensions from your Mozilla Firefox browser - none are crucial for normal browser operation.

  • If you continue to have problems with browser redirects and unwanted advertisements - Reset Mozilla Firefox.

Remove malicious extensions from Google Chrome:

Remove fake software update pop-up related Google Chrome add-ons:

Open Google Chrome and click the 'Chrome menu' (three horizontal lines) button located in the top-right corner of the browser window. From the drop-down menu, choose 'More Tools' and select 'Extensions'.

In the 'Extensions' window, look for any recently-installed suspicious add-ons. When located, click the 'Trash' button next to it/them. Note that you can safely uninstall all extensions from your Google Chrome browser - none are crucial for normal browser operation.

  • If you continue to have problems with browser redirects and unwanted advertisements - Reset Google Chrome.