Remove Malware From Mac: Step-by-Step Guide

This guide walks you through removing malware from a Mac, covering browser hijackers, adware, and more serious infections. You’ll learn how to identify suspicious activity, delete malicious files, and prevent future infections. Before starting, ensure you have a backup (Time Machine or other) and a stable internet connection for the latest security updates.

What You’ll Need

• Administrator access to your Mac (you’ll need to enter your password)
• A current backup (Time Machine or clone) in case something goes wrong
• Internet connection to download security tools and updates
• Patience – some steps require restarts and multiple scans

Step-by-Step

1. Disconnect from the internet. Turn off Wi-Fi and unplug Ethernet. This stops malware from communicating with its command server or spreading further.
2. Boot into Safe Mode. Restart your Mac and hold the Shift key immediately after the startup chime (Intel) or press and hold the power button until “Loading Safe Mode� appears (Apple silicon). Safe Mode prevents malware from auto-launching and loads only essential extensions.
3. Check Activity Monitor. Open Activity Monitor (in /Applications/Utilities). Sort by CPU and Memory. Look for processes you don’t recognize – names like “MacDefender,� “SearchHelper,� or random strings. Note the exact name, then quit it (click the X). If it won’t quit, force quit.
4. Review Login Items. Go to System Settings > General > Login Items & Extensions. Remove anything suspicious by selecting it and clicking the minus (–) button. Pay attention to items with unknown publishers.
5. Remove malicious profiles. Open System Settings > General > Device Management (or Profiles). If you see a profile you didn’t install, select it and click the minus (–) to remove it. Malware often installs profiles to control browser settings.
6. Check browser extensions. For Safari: Safari > Settings > Extensions. Remove any unknown extensions. For Chrome: Chrome > Settings > Extensions. For Firefox: Firefox > Add-ons and themes > Extensions. Delete anything you didn’t install.
7. Reset browser homepages and search engines. In each browser, go to settings and reset the homepage and default search engine to your preferred ones (e.g., Google or Bing). Look for “Managed by your organization� – if present, a profile is forcing settings; remove it in Step 5.
8. Clear browser cache and cookies. In Safari: Settings > Privacy > Manage Website Data > Remove All. In Chrome: Settings > Privacy and security > Clear browsing data. This removes tracking scripts and stored malicious payloads.
9. Delete suspicious applications. Open Finder > Applications. Look for apps you don’t recognize, especially ones with generic icons or names like “MacKeeper,� “Advanced Mac Cleaner,� or “Search.� Drag them to Trash, then empty the Trash. Also check ~/Library/Application Support and ~/Library/LaunchAgents for folders or files with those names.
10. Remove launch agents and daemons. Open Finder and press Cmd+Shift+G. Type ~/Library/LaunchAgents and press Enter. Look for plist files with suspicious names (e.g., com.malware.agent.plist). Drag them to Trash. Repeat for /Library/LaunchAgents and /Library/LaunchDaemons (you may need admin password).
11. Run a reputable malware scanner. Download and install a trusted tool like Malwarebytes for Mac (free version is fine). Run a full scan. Follow its instructions to remove any threats it finds. Then run a second scan to confirm nothing remains.
12. Update macOS and all apps. Go to System Settings > General > Software Update and install any available updates. Also update your browsers and other apps from the App Store or their official websites. Updates patch security holes that malware exploits.
13. Restart normally. Exit Safe Mode by simply restarting your Mac without holding any keys. Log in and observe if the symptoms (pop-ups, redirects, slow performance) are gone.
14. Change your passwords. If malware was serious, change your Apple ID password, email passwords, and banking passwords from a different device. Enable two-factor authentication if you haven’t.
15. Restore from backup if needed. If the infection persists, erase your Mac (via Recovery Mode) and restore from a backup made before the infection. This is the most thorough solution.

Common Mistakes

• Only deleting the app but not its launch agents – the malware relaunches on reboot.
• Ignoring browser extensions – the main source of redirects and pop-ups.
• Not resetting browser settings – the homepage and search engine stay hijacked.
• Using “free cleanerâ€� apps that are themselves adware – stick to reputable security tools.
• Forgetting to check the Library folders – many malware files hide there.
• Skipping the backup – if you need to erase, you lose everything.

Tips

• Keep macOS and all software updated – most malware exploits known vulnerabilities.
• Only download apps from the App Store or official developer websites.
• Use a standard (non-admin) account for daily use – malware needs admin rights to install deeply.
• Enable Gatekeeper (default) – it blocks unsigned apps from running.
• Regularly review your login items and browser extensions – monthly check is enough.
• Use a content blocker in Safari to reduce malicious ads.

Troubleshooting

Malware returns after reboot. You missed a launch agent or daemon. Re-run the scan, and check ~/Library/LaunchAgents again. Also look in ~/Library/Application Support for folders with random names.

Safe Mode won’t start. On Apple silicon, press and hold the power button until you see “Loading Safe Mode.� On Intel, hold Shift immediately after the chime. If it fails, try again – sometimes it takes a couple of attempts.

Browser says “Managed by your organization.� This is a profile. Go to System Settings > General > Device Management and remove any unknown profile. Then reset browser settings again.

Malware scanner finds nothing, but symptoms persist. The infection may be in another user account. Check other accounts by logging out and logging into a different user. Also, some malware hides in the Recovery partition – a full erase and restore is needed.

You can’t delete a file because it’s in use. Quit the app (Cmd+Q), then try again. If it still won’t delete, restart in Safe Mode and delete it there.

After removing malware, your Mac is slow. This is normal – the malware may have used resources. Give it a day, and run a disk utility repair (Disk Utility > First Aid). If still slow, consider a clean install.

Frequently Asked Questions

Can Macs get viruses? Yes, though less common than Windows. Macs are vulnerable to adware, spyware, and trojans, especially if you download from untrusted sources.

Is Safe Mode necessary? It’s highly recommended because it stops malware from auto-launching, making it easier to delete files that are normally locked.

Will I lose my files during removal? No, the steps above don’t delete personal files. However, if you need to erase and restore, you’ll lose files created after your last backup.

How do I know if I have malware? Common signs: sudden browser redirects, pop-ups, new toolbars, homepage changes, unexplained CPU usage, or new apps you didn’t install.

Can I prevent malware without buying software? Yes. Keep macOS updated, use a standard account, and be cautious with downloads. macOS has built-in XProtect that blocks known malware.

What if the malware is in my Time Machine backup? If you restore from a backup that contains malware, you’ll re-infect. Make sure to scan the backup with a malware scanner before restoring.

Related

• Intranet vs VPN: How They Differ and Work Together
• Double-Finger Scroll Not Working on Windows 10?
• Prevent Apps From Installing and Uninstalling on Android