How to remove BestForMac ads

BestForMac adware is distributed via fake Flash Player installers for Mac users

If you have found BestForMac running on your device, you have installed a version of Adload adware^[1] onto your Mac – it is among the most prominent threats in recent years. This app belongs to a category of potentially unwanted programs, which is not considered to be malware, although it has plenty of malicious features that we will discuss below.

The questionable deeds of the app begin with its distribution – users are often tricked into installing it via fake Flash Player update prompts. Alternatively, it might be spread in software bundles downloaded from torrent, crack, and similar insecure websites. As soon as it is installed, the BestForMac virus makes alternations to the way the operating system works in order to stay installed as long as possible. Note that most users don't even know that it is installed in the first place since they don't do it purposely.

However, you should soon notice that the homepage of your browser is swapped to a different one (typically, Safe Finder), and an unknown extension is installed without permission. You are also likely to be exposed to browser redirects through Yahoo or Akamaihd, which will contribute to excessive ads you'd be forced to see everywhere.

If you have spotted these changes on your device, do not delay and clean your computer appropriately – check our tips and information about removing this unwanted guest for good.

Adware and Macs: a problem that won't go away

The number of Mac users is slowly but steadily increasing over the past years. This increase was not unnoticed in the cybercriminal world, hence we see statistics like Mac malware outpacing Windows malware in 2020.^[2] Of course, most of the infections are not as treacherous as ransomware from Windows, for example, but they are not a welcome addition to any user's computer.

While most threats are categorized as browser hijackers and adware, some of these apps can be really malicious. In fact, the most dangerous parasites on Macs, such as Shlayer Trojan, are closely associated with adware apps, including versions of Adload.

Just as many other variants of the strain (TypeCharacter, NetInput, or ScalableRemote), BestForMac is detected by multiple anti-malware solutions. According to the Virus Total report, you can find it under the following names:^[3]

• Adware.MAC.Generic.23019
• A Variant Of OSX/TrojanDownloader.Adload
• MacOS:Adload-AD [Trj]
• MacOS/Adload.A.gen!Camelot
• RDN/Generic.osx, etc.

There is a reason why so many security apps recognize this potentially unwanted program – and many of them even use a Trojan in their detection names. As already mentioned, the app is not distributed fairly, as users are tricked into installing it with the help of one of the most prevalent malware distribution techniques out there – fake updates. Additionally, software cracks and pirated program installers also fall into that category.

The bad things begin when the app is installed on the system, however. It implements a browser extension that uses a district icon (a magnifying glass in green/teal background). While extensions are usually harmless, this is not the case. Users will soon see that their browsing experience is changed due to redirects to potentially dangerous websites and an increased number of ads.

To make matters worse, some versions of this adware family are capable of harvesting sensitive information as long as they remain installed on the system. We have previously found the permissions that are given to the extension within the web browser environment, which reads:

XXX 1.0

Permissions for “XXX”:

Webpage contents
Can read sensitive information from webpages, including passwords, phone numbers, and credit cards on all webpages

Browsing history
Can see when you visit all webpages

While it is common for potentially unwanted and legitimate apps to gather a limited amount of anonymous data, this is not the case at all. There is no need for this app to gather your passwords or phone numbers – it can result in a serious privacy breach. You can also find yourself being a target of further fraud campaigns.

Manual and automatic BestForMac removal explained

If you try to remove the BestForMac application and extension from your system, you are likely to fail. Thanks to specific functions and elevated permissions upon installation, the virus might create new entries within the Login items and Profiles section within the computer – this is precisely what stops you from uninstalling the app easily.

This is done deliberately in order for crooks to profit from the advertisement campaigns and sponsored content that is constantly being shoved to users as soon as they open their web browsers. In the meantime, web browsing routines can be completely ruined, and finding relevant information might be much more complicated – altered search results and ads are the main contributors to that.

To stop this, you should remove these items from your system. Of course, you can always choose automatic adware removal with SpyHunterCombo Cleaner, MalwarebytesMalwarebytes, or another reputable security software – you can then avoid all the tedious steps of elimination below. Also, this is the perfect option for those who are less tech-savvy.

First of all, we need to shut down all the processes related to the app:

• Open Applications folder
• Select Utilities
• Double-click Activity Monitor
• From there, look for BestForMac and other suspicious processes – shut them down with the Force Quit option

Once the app is no longer running, you should be able to eliminate the app itself via the Applications folder:

• From the menu bar, select Go > Applications.
• In the Applications folder, look for all related entries.
• Click on the app and drag it to Trash.

To clean the remnants of the app, you need to delete the all the unwanted entries in Preferences > Accounts > Login items folder, as well as all the suspicious profiles from System Preferences > Users & Groups > Profiles. Finally, you should also look for the remaining entries:

• Click on Go > Go to Folder
• Enter /Library/Application Support and delete the following items:
  Library/Application Support/BestForMac/BestForMac
  Library/Application Support/com.BestForMacDaemon/BestForMac
• Delete the following in the LaunchDaemons location:
  Library/LaunchDaemons/com.BestForMacDaemon.plist
• Delete the unwanted LaunchAgents:
  Library/LaunchAgents/com.BestForMac.plist.

Final steps: clean your web browsers

Potentially unwanted programs usually operate within the web browser environment, so it is not uncommon for them to insert various components there. If you have removed the PUP manually or automatically, as we explained in the previous chapter, you should now care for your web browsers. The below steps can also be done automatically with FortectIntego maintenance utility.

First of all, you should look for the BestForMac extension, although you should look out for everything else that looks suspicious – especially if you have not installed it yourself. Additionally, it is important to clean web browsing data and cookies, as these can be used to insert ads or track you even after the app's removal. Follow the detailed guide below.