ActionHow ads on Mac: what it is and how to remove it
ActionHow is the application that appears as a piece of software installed on the device, in most cases, out of nowhere because it falls into the category of potentially unwanted programs. You can often see this tool on promotional ads where developers advertise the app as a utility used to improve the browsing experience and provide faster searches, altered results. This page covers it on macOS.
Facts checked October 7, 2026. Removal steps checked against Apple's current documentation and the security vendors' reports. We have not run the malware on a Mac. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your Mac is infected.
Fortect for Mac scans for malware and unwanted programs, and its free scan shows what it finds before you decide anything.
If ActionHow keeps coming back after uninstalling, a scan can find what reinstalls it.
Do it yourself · free Remove ActionHow ads yourself 4 steps, about 12 minutes, no software needed.
Start the steps
ActionHow ads: summary
| Distribution | App gets included in software bundles and delivered automatically when the user skips through important steps or installed from promotional ads, sites when it is advertised as a helpful tool, and people fall for those claims |
|---|---|
| Damage | Application is related to ad-supported sites, other unwanted and possibly malicious programs, PUPs, so it can access, track and record information about users' habits and browsing online preferences, even personally identifiable data |
| Name | ActionHow |
| Type | Mac Virus/ Adware[2] |
| Affects | macOS running devices |
| Symptoms | The suspicious application appears on the machine out of nowhere and causes issues with the speed and performance of the device because various content triggers pop-ups and traffic reroutes. The program delivers advertising material without running any other processes or installing particular programs that could be uninstalled or removed |
| Removal | Scan the Mac with security software to find the malware and anything installed with it. Fortect for Mac scans for malware and unwanted programs. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 5 more facts
| Detection names | No Microsoft detection name is known |
|---|---|
| Evidence | 4 write-ups by security sites; details still limited |
| Program | ActionHow |
| First seen | 24 January 2020 |
| Facts checked | 7 October 2026 |
Is ActionHow ads dangerous?
From our report of Jan 2020 · not reviewed since
Mac system is not immune to PUPs or malware
Adware is one of many potentially unwanted programs that can easily infiltrate Windows devices and macOS running machines.
In most cases, the user is downloading the program from the internet because PUPs get included in installation setups for freeware and shareware.
Installers are not clearly displaying all the included apps, and when the person chooses the quick or recommended option, all the pre-packed programs get on the computer. The opportunity to block unwanted content of any bundled programs can appear when selecting Advanced or Custom installations.
When the list appears, you can uncheck any boxes of suspicious applications and get only the software you are sure about. Also, read disclaimers, privacy policy sections, and other information before trusting a freeware distribution page or software developer.
From our report of Jan 2020 · not reviewed since
More from our earlier report on ActionHow
- Adware removal should involve a proper system check using an anti-malware program that can find and delete traces of this questionable program
How ActionHow ads got into your browser
From our report of Jan 2020 · not reviewed since
ActionHow is the application that appears as a piece of software installed on the device, in most cases, out of nowhere because it falls into the category of potentially unwanted programs. You can often see this tool on promotional ads where developers advertise the app as a utility used to improve the browsing experience and provide faster searches, altered results.
However, this is the program that diminishes the quality of online browsing by delivering intrusive advertising campaigns and undesirable content. In addition to intrusiveness, ActionHow virus is a persistent app that keeps on running even when you think that you've uninstalled it already.
The program can access parts of the system, folders with system files, inject application or browser extensions and data to keep additional processes affecting the initial infiltration and persistence.
Also, all the materials related to commercial content, advertisements, and so on triggers the appearance of coupons, surveys, banners, and blinking boxes from third-party companies. This app is mainly designed to deliver redirects to dubious sites and keep users involved in questionable campaigns. However, page visits, clicks on ads, and views generate the pay-per-click revenue , which is how third-party companies profit from potentially unwanted programs.
Ads by ActionHow may appear on the screen before you even notice the adware installed on your system. Anything that is not ordinary should raise questions, especially when it comes to online content and redirects.
Even when it is believed that Mac devices are immune to malware, you should ignore those speculations and be aware that PUP developers and even malicious actors tend to create threats primarily geared towards this operating system.
Endless notifications interfere with the work and browsing on the internet functions, so you cannot benefit from keeping this program at all. The commercial material that continues to gather on the system also affects the security of the computer. You may get exposed to possibly malicious content and don't even notice.
More typical adware symptoms that also leads to the ActionHow infection:
Unfortunately, the article's culprit can directly or involve third-party companies and content track and record information about visitors and users. This is one of the features that people commonly consider malicious and intrusive, so AV detection tools also mainly form heuristic names that generally state the suspiciousness of the app without saying any specifics.
The application may appear installed after you clicked too many times on questionable ads or redirects. It is expected that such downloads happen automatically and quickly, so the user cannot notice the infiltration. However, besides installing the shady PUP, the process may also include additional files, programs, registry entries, folders, or files that keep the app running without interference.
Keep in mind that PUP developers are not responsible for the content that third-party commercial material creators deliver on your screen, so there might be malicious code injected on pop-ups, banners, and sites you get exposed to. All the publishers, including the company that makes and distributes ActionHow App, can access information that includes:
You should remove the article's culprit as soon as you notice anything suspicious regarding the program or any related or possibly associated applications, so the threat is terminated without causing any damage to your machine. If you leave it running longer, it can affect crucial functions of the system or install shady programs to ensure questionable behavior.
When it comes to ActionHow removal or any process that involves potentially unwanted programs, you should rely on professional help instead of tackling the intruder yourself. Anti-malware programs can check the system for malicious behavior and delete those intruders without causing problems.
There are tons of tools compatible with different operating systems that can offer system file check and fix functions. Don't interfere with system files and functions if you lack IT knowledge yourself.
- commercial content that appears in places it shouldn't be and gets injected on commonly visited sites;
- redirects to shady advertising services;
- applications installed without permission or even notice;
- unwanted browser-based applications keep coming back after uninstallation;
- changed appearance of web browsing tools, altered setting or preferences;
- the general slowness of the device;
- constant system freezes or crashes.
- IP addresses,
- Location,
- specifications of the device;
- most viewed items and visited sites.
How to remove ActionHow ads
How to remove ActionHow from a Mac
Remove the app and what starts it, then check the browsers.
Step 1: Delete apps and downloads you did not intend to install
Open the Applications folder and your Downloads folder. Drag any app you did not install, and any disk image (
.dmg), installer (.pkg) or archive (.zip) that came from ActionHow or a site you do not trust, to the Bin, then empty the Bin.Also check
~/Library/Application Supportfor a folder with the same name as the app you removed.Step 2: Remove unknown login items and background items
Open System Settings > General > Login Items & Extensions. Under Open at Login and Allow in the Background, switch off or remove anything you do not recognize, especially items whose developer is shown as an unknown name or that appeared on the day you ran the command.
Then open Finder, choose Go > Go to Folder and check
~/Library/LaunchAgents,/Library/LaunchAgentsand /Library/LaunchDaemons for property list (.plist) files you did not add. Drag suspicious ones to the Bin, then restart the Mac.Step 3: Check the browsers for extensions and changed settings
In Safari open Settings > Extensions and General (homepage). In Chrome open
chrome://extensions, in Firefoxabout:addons.Remove any extension you did not add, and reset the homepage and search engine if they changed. Browsers hold saved passwords and cookies, which is why the password step comes first.
Step 4: Quit what is running that you do not recognize
Open Activity Monitor (in Applications > Utilities, or search for it with Command + Space).
In the CPU or Network tab, look for a process you did not install or whose name is random, select it, click the stop button (the octagon with an X) and choose Quit or Force Quit.
Note the name first: you will look for the same name in the next steps. Malware that comes back after a restart is handled in the next two steps.
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Remove from Google Chrome
Delete malicious extensions from Google Chrome:
- Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
- In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.
Clear cache and web data from Chrome:
- Click on Menu and pick Settings.
- Under Privacy and security, select Clear browsing data.
- Select Browsing history, Cookies and other site data, as well as Cached images and files.
- Click Clear data.
Change your homepage:
- Click menu and choose Settings.
- Look for a suspicious site in the On startup section.
- Click on Open a specific or set of pages and click on three dots to find the Remove option.
Reset Google Chrome:
If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:
- Click on Menu and select Settings.
- In the Settings, scroll down and click Advanced.
- Scroll down and locate Reset and clean up section.
- Now click Restore settings to their original defaults.
- Confirm with Reset settings.
Remove from Mozilla Firefox (FF)
Remove dangerous extensions:
- Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
- Select Add-ons.
- In here, select the unwanted extension and click Remove.
Reset the homepage:
- Click three horizontal lines at the top right corner to open the menu.
- Choose Settings.
- Under Home, set your preferred homepage and new tab settings.
Clear cookies and site data:
- Click Menu and pick Settings.
- Go to Privacy & Security section.
- Scroll down to locate Cookies and Site Data.
- Click on Clear Data...
- Select Cookies and Site Data and Temporary cached files and pages, then click Clear.
Reset Mozilla Firefox
If clearing the browser as explained above did not help, reset Mozilla Firefox:
- Open Mozilla Firefox browser and click the Menu.
- Go to Help and then choose Troubleshooting Information.
- Under Give Firefox a tune up section, click on Refresh Firefox...
- Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.
Delete from Safari
Remove dangerous extensions:
- Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
- Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.
Clear history and website data:
- Click Safari in the menu and pick Clear History.
- Set Clear to all history and confirm with Clear History.
Reset Safari:
- Click Safari in the menu and select Preferences > Advanced.
- Enable Show Develop menu in menu bar.
- From the menu bar, click Develop and select Empty Caches.
Delete from macOS
You need to get rid of the suspicious program, so follow these steps
Remove the unwanted application:
- From the menu bar, select Go > Applications.
- In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).
Delete leftover files and folders:
- Select Go > Go to Folder.
- Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
- Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.
- Finally, empty the Trash to permanently remove the leftovers.
Protect your privacy - employ a VPN
There are several ways how to make your online time more private - you can access an incognito tab.
However, there is no secret that even in this mode, you are tracked for advertising purposes. There is a way to add an extra layer of protection and create a completely anonymous web browsing practice with the help of VPN. This software reroutes traffic through different servers, thus leaving your IP address and geolocation in disguise.
Besides, it is based on a strict no-log policy, meaning that no data will be recorded, leaked, and available for both first and third parties. The combination of a secure web browser and VPN will let you browse the Internet without a feeling of being spied or targeted by criminals.
No backups? No problem. Use a data recovery tool
If you wonder how data loss can occur, you should not look any further for answers - human errors, malware attacks, hardware failures, power cuts, natural disasters, or even simple negligence.
In some cases, lost files are extremely important, and many straight out panic when such an unfortunate course of events happen. Due to this, you should always ensure that you prepare proper data backups on a regular basis.
If you were caught by surprise and did not have any backups to restore your files from, not everything is lost. is one of the leading file recovery solutions you can find on the market - it is likely to restore even lost emails or data located on an external device.
From our report of Jan 2020 · not reviewed since
ActionHow should be deleted ASAP
Even though calling this application a virus is not correct, people still think about the stealthy intruder as malware due to intrusive and strange behavior.
A potentially unwanted program is not installing a particular program that causes other symptoms or appears running on the machine, so you can find and remove it.
Unfortunately, to remove ActionHow, you need to terminate the potentially unwanted program that triggers all the adware-type symptoms and redirects system issues. Cleaning the machine fully helps to get rid of the application and all other intruders that may be running.
The removal is best when performed with anti-malware tools. Programs designed to fight viruses can thoroughly check the system and indicate what needs to be eliminated. You cannot find all the related files and programs that interfere with the performance of your device yourself, so that AV tools can do that for you.
Questions about ActionHow ads
What is ActionHow and why is it on my PC?
ActionHow is a program that was installed on the PC, most likely together with something else you downloaded. Free software sites and many installers add extra programs on setup pages with pre-ticked boxes, so the extra install looks like your choice even though nobody read the page.
Check the install date in Settings, Apps, Installed apps: the program you installed that day is the probable carrier. If you do not need ActionHow, uninstall it. If it belongs to your hardware or to a program you use, search its exact name and publisher first, because drivers and their tools can have unfamiliar names.
How do I stop programs like ActionHow from being installed again?
Most unwanted programs arrive through installers, so the fix is in how you install software. Download programs from their official sites or the Microsoft Store, not from download portals or ads above search results. During setup, choose Custom or Advanced installation and untick every extra offer, including browsers, toolbars and optimizers.
Decline update prompts that appear inside other programs unless you know them. In Windows Security, turn on reputation-based protection and potentially unwanted app blocking. These steps would most likely have stopped ActionHow before it reached the app list.
Did ActionHow collect my data?
Adware typically collects what it needs to choose ads:
- the sites you visit
- search terms
- approximate location
- browser and system details
Extensions with permission to read and change data on all websites can technically see everything on those pages, including forms. That is a privacy problem rather than proof of theft.
If you typed card details or passwords while it was active, changing the most important passwords is a reasonable precaution. Clearing cookies after removal ends the tracking sessions it may have started.
Why is my browser so slow since the ads started?
Each page now does extra work. An adware extension reads the page, decides where to put ads, loads them from ad servers and reports your visit, and that happens on every tab. Ad-supported programs add their own background activity.
Removing the extension or program usually makes the browser fast again at once. If it stays slow, open the browser's own task manager with Shift+Esc in Chrome or Edge and look for extensions using a lot of memory or processor time.
I let a "support technician" from an ad connect to my PC. What should I do?
Act quickly but calmly. Disconnect the PC from the internet first, so the connection ends. Uninstall the remote access tool they asked you to install and check Installed apps for anything else added during the call.
Run a Microsoft Defender full scan and offline scan. From another device, change your e-mail and banking passwords and sign out of all sessions.
If you paid by card, bank transfer or gift card, contact your bank or the card issuer immediately, and report the scam to the police. Do not answer if they call back.
My scan found nothing, but the ads continue. Why?
Because the source may not be a file a scanner looks for. Browser notifications are a permission stored in the browser, and many adware extensions are not flagged because they come from an official store.
Some ad-supported programs are only reported if you enable detection of potentially unwanted apps. So a clean scan does not mean the job is done. Check each browser's notification permissions and extension list by hand, and turn on Potentially unwanted app blocking in Windows Security before scanning again.
Can an adware pop-up infect my PC just by appearing?
No. A pop-up, a notification or a new tab is only a web page or a message. It cannot run programs on Windows by itself, provided the browser and Windows are up to date. Infection needs a step from you:
- running a downloaded file
- installing an extension
- giving a stranger remote access
That is why scam pages work so hard to make you click. Close such pages with the tab's X or by closing the browser, not with buttons inside the page, which may start a download.
Is ActionHow a virus?
Not in the strict sense: ActionHow is unwanted software, classed here as an adware extension, not a self-copying virus. Our report lists this damage: Application is related to ad-supported sites, other unwanted and possibly malicious programs, PUPs, so it can access, track and record information about users' habits and browsing online preferences, even personally identifiable data.
Security programs often label such software as adware, a potentially unwanted program or a browser hijacker. It still needs removal, because it changes browser settings, shows ads and can lead you to unsafe pages.
Will Fortect remove ActionHow?
Fortect for Mac scans for malware and unwanted programs, and its free scan shows what it finds on your Mac before you decide anything.
For ActionHow, follow the plan on this page as well: removing a launch item or an app is done in macOS itself, and a scanner cannot undo what was typed or entered on the infected Mac, such as saved passwords that were copied.
Change your passwords from another device first, and if the page tells you to erase the Mac, a scan is not a substitute. The free scan costs nothing and the full-featured product needs a license.
Sources
- Wikipedia: pay-per-click (read October 7, 2026)
- CSOonline: What is adware and how it works (read October 7, 2026)
- Virustotal: Detection rate of the application (read October 7, 2026)
- Google Chrome Help: Use notifications to get alerts (no longer online) (read October 7, 2026)
- FTC: How to recognize, remove and avoid malware (read October 7, 2026)