How to remove ApplicationWork

ApplicationWork is an adware that tries to access personal banking details

ApplicationWork

ApplicationWork is suspicious software that affects Mac users exclusively. Most started to complain about the app in March, so it is most likely have been launched since then. Nevertheless, they do not remember installing it – this is due to a rogue installation method called software bundling where multiple apps are compiled into one installer.

Unlike most adware applications, however, this one seems to be extremely intrusive, as it attempts to download and insert a browser extension for Safari automatically. Apparently, it also tries to gain access to read and log banking transactions and passwords for the accounts.^[1] Without a doubt, such behavior should never be allowed, as it would grant cybercriminals access to your sensitive information.

Additionally, you might start suffering from invasive pop-ups, deals, coupons, banners, in-text links, sponsored search results, redirects, and other unwanted content that would plague your not only Safari, but also Google Chrome, Mozilla Firefox, Opera, or any different browser that is installed on macOS. Thus, if you noticed the suspicious behavior, you should remove ApplicationWork virus immediately.

Name	ApplicationWork
Type	Adware
Targeted systems	Mac OS X, macOS
Symptoms	Attempts to download an extension on Safari and read banking details, displays ads, redirects to suspicious sites, etc.
Risk factors	Personal information disclosure, installation of dangerous software, malware infections, etc.
Distribution	Software bundling, third-party websites, shady ads
Elimination	Use security software or use our manual guide below
Optimization	Scan your Mac with Fortect Intego to make sure your system is running well

Adware is ad-supported software, which means that it focuses on generating ad revenue by exposing users to all types of ads on all websites that they visit. This dramatically impacts the ability to find relevant information and even the content of the site you are trying to access.

Additionally, Application.Work might lead to spoofing, tech support scam, or phishing sites. If not encountered before, these hoaxes can be particularly dangerous. Spoofed sites might extort your banking details or other credentials, tech support and other scams might lead to the installation of bogus software or even malware, as well as money loss.

The article's culprit might automatically track a variety of non-personally identifiable information, in addition to banking information if the Safari extension is installed. Such data includes:

IP address
ISP
Geolocation
Technical details of the device
Sites visited
Search queries
Cookies
Links clicked
Bookmarks added, etc.

This information is later compiled and used for promotional campaigns that target your interests but alter the way you shop online, as the PUP will lead you to affiliates' sites. All in all, we suggest you proceed with ApplicationWork removal as soon as possible. To do that, you need to delete suspicious extensions, profiles, LaunchAngents, etc.

To do that automatically, please download and install a security application, such as SpyHunter Combo Cleaner or Malwarebytes Malwarebytes. After you complete the process, you should also reset each of the installed browsers and scan your Mac with Fortect Intego to fix the damage done by the adware.

ApplicationWork virus

Stay away from third-party app stores and beware of bundled software

Official app stores are considered to be safe for a reason – every app that enters is scrutinized in order to pass through built-in security scanners. Despite the best efforts, some malicious apps still manage to bypass the safety measures and infect millions of users with malware, as happened with iOS malware XcodeGhost.^[2]

Thus, if such industry giants like Apple or Google cannot fully protect users from malware, guess what is happening on third-party sites? Another danger lies in the fact that some of such websites allow practically anyone to upload apps, which makes the practice exceptionally susceptible to malware infestation. Therefore, watch where your apps are coming from. Do not click on suspicious links on social media or dubious sites, and stick to official app stores.

Additionally, you should watch the installation process of the shareware and freeware you are installing. Always read through the installation instructions carefully and opt for Advanced or Custom mode when prompted. Then, remove all the add-ons, PDF converters, media players, and other useless bloatware from the final installation.

Terminate ApplicationWork virus to stay safe online

Until you remove ApplicationWork virus from your computer, it is not safe for work. Be aware that many processes might be launched in the background without you knowing anything about them. Therefore, you should make the best effort to delete the unwanted program and all its elements from your macOS.

To do that, you will have to delete all adware entries which are hidden under Profiles, LaunchAgents, LaunchDaemons, and Application Support folder. If you are not that familiar with computers and their operation, security experts^[3] recommend picking the automatic ApplicationWork removal method.

For this, you should download and install a robust anti-malware tool and perform a full system scan. It will detect and delete all the malicious components automatically. Nevertheless, you should still reset each of the installed browsers to make sure the infection activities are stopped completely.

Delete from macOS

Remove the unwanted application:

From the menu bar, select Go > Applications.
In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).

Delete leftover files and folders:

Select Go > Go to Folder.
Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.
Finally, empty the Trash to permanently remove the leftovers.

Remove from Microsoft Edge

Delete unwanted extensions from MS Edge:

Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
From the list, pick the extension and click on the Gear icon.
Click Remove.

Clear cookies and other browser data:

Click on the Menu (three horizontal dots at the top-right of the browser window) and select Settings > Privacy, search, and services..
Under Clear browsing data, pick Choose what to clear.
Select Cookies and other site data and Cached images and files. (apart from passwords, although you might want to include Media licenses as well, if applicable) and click on Clear.

Restore new tab and homepage settings:

Click the menu icon and choose Settings.
Then find On startup section.
Click Remove next to any suspicious startup page.

Reset MS Edge if the above steps did not work:

Press on Ctrl + Shift + Esc to open Task Manager.
Click on More details arrow at the bottom of the window.
Select Details tab.
Now scroll down and locate every entry with Microsoft Edge name in it. Right-click on each of them and select End Task to stop MS Edge from running.

Instructions for Chromium-based Edge

Delete extensions from MS Edge (Chromium):

Open Edge and click select Settings > Extensions.
Delete unwanted extensions by clicking Remove.

Clear cache and site data:

Click on Menu and go to Settings.
Select Privacy, search and services.
Under Clear browsing data, pick Choose what to clear.
Under Time range, pick All time.
Select Clear now.

Reset Chromium-based MS Edge:

Click on Menu and select Settings.
On the left side, pick Reset settings.
Select Restore settings to their default values.
Confirm with Reset.
This will disable extensions and reset startup pages but will not delete bookmarks, saved passwords, or browsing history.

Remove from Mozilla Firefox (FF)

Remove dangerous extensions:

Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
Select Add-ons.
In here, select the unwanted extension and click Remove.

Reset the homepage:

Click three horizontal lines at the top right corner to open the menu.
Choose Settings.
Under Home, set your preferred homepage and new tab settings.

Clear cookies and site data:

Click Menu and pick Settings.
Go to Privacy & Security section.
Scroll down to locate Cookies and Site Data.
Click on Clear Data...
Select Cookies and Site Data and Temporary cached files and pages, then click Clear.

Reset Mozilla Firefox

If clearing the browser as explained above did not help, reset Mozilla Firefox:

Open Mozilla Firefox browser and click the Menu.
Go to Help and then choose Troubleshooting Information.
Under Give Firefox a tune up section, click on Refresh Firefox...
Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.

Remove from Google Chrome

Delete malicious extensions from Google Chrome:

Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.

Clear cache and web data from Chrome:

Click on Menu and pick Settings.
Under Privacy and security, select Clear browsing data.
Select Browsing history, Cookies and other site data, as well as Cached images and files.
Click Clear data.

Change your homepage:

Click menu and choose Settings.
Look for a suspicious site in the On startup section.
Click on Open a specific or set of pages and click on three dots to find the Remove option.

Reset Google Chrome:

If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:

Click on Menu and select Settings.
In the Settings, scroll down and click Advanced.
Scroll down and locate Reset and clean up section.
Now click Restore settings to their original defaults.
Confirm with Reset settings.

Delete from Safari

Remove dangerous extensions:

Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.

Clear history and website data:

Click Safari in the menu and pick Clear History.
Set Clear to all history and confirm with Clear History.

Reset Safari:

Click Safari in the menu and select Preferences > Advanced.
Enable Show Develop menu in menu bar.
From the menu bar, click Develop and select Empty Caches.

Delete the adware Profile:

Click on Preferences and then pick Profiles
Select AdminPrefs and remove it by pressing a “—” button

You have to go to LaunchAgents, LaunchDaemons, and Application Support folders in order to delete all the entries there. To do that, please follow these steps:

Select Go and click on Go to Folder…
Type in /Library/LaunchAgents and press Go
Terminate all the suspicious entries

Now do the same in the LaunchDaemons and Application Support folders.