Remove PowerLift (Virus Removal Guide)

PowerLift is a Mac virus that specializes in generating revenue by showing users malicious ads

PowerLift

PowerLift is an adware^[1] infection on Mac operating systems that seeks to display pop-up ads, in-text links, tech support scams and other potentially dangerous content on Google Chrome, Safari, Mozilla Firefox, or another web browser. Additionally, potentially unwanted application often collect data related to user web browsing activities, which sometimes may leak personal information as well, rendering PowerLift a security threat.

PowerLift adware is usually installed along other free applications from third-party websites, usually with another Mac parasite – MacPerformance. This happens due to bundling – well-established PUP distribution technique that tries to hide optional components within software installers purposely.

While most users are unaware that PowerLift virus infiltrated their computers, they can soon recognize symptoms of adware infection – the disruptive ads and redirects are among the first signs that Mac is affected by adware. The activity might result in users landing on scam or even malware-laden sites, where they can be exposed to online hazards like data or money loss.

To stop the unwanted behavior, users will have to remove PowerLift, all its components, as well as other installed potentially unwanted applications from macOS. We provide detailed instructions at the bottom of the article for manual and automatic elimination methods.

Name	PowerLift
Type	Adware
Infiltration means	Adware is usually installed from third-party sources after clicking on an attractive advertisement or when downloading free applications that are bundled in single software packages; users might also install unwanted software after being tricked by a fake Flash update pop-up
Often installed with	Users may also see MacPerformance or other potentially unwanted programs installed on their machines
Symptoms	Intrusive pop-ups, deals, offers, coupons, and other advertisements show up on all visited websites; redirects lead to insecure, spam, tech support scam, and similar sites; browsers and the computer may become slow during its operation
Risk factors	Adware employs a variety of tracking technologies in order to collect data about users' web browsing habits, and it might sometimes contain personal information – this can might be leaked to unknown parties or cybercriminals; installation of other potentially unwanted applications or even malware; money loss to scam schemes and useless software, etc.
Termination	Check out our removal guide at the bottom section of the article or employ anti-malware software to eliminate the threat automatically
Recovery	PowerLift may alter various system files that will need recovery. If you want to achieve the best results after the infection, we suggest using Fortect Intego

PowerLift adware is a deceptive software that specializes in advertising. While, initially, there is nothing wrong about monetizing on affiliated content, the fraudulent methods used by ad-supported software are the ones that try to mislead users deliberately and even put their online safety and computer security at risk.

Some adware apps might not be as deceptive, while others seek to hide their presence and employ tactics that are more comparable to malware. Unfortunately, PowerLift adware uses persistence and operation techniques that are more resemble the latter – users are often unaware that the PUP is causing the unwanted activities on the web browsers. For that reason, many might start calling it “PowerLift virus,” although, technically, the term is not entirely correct.^[2]

A virus is a piece of malicious software that infects files on the machine to propagate – such infections are basically non-existent on Mac computers. PowerLift, in the meantime, installs its own files into various places on the system to perform its activities – a typical sign of malware.

Finally, you should be aware that PowerLift is most likely tracking information about your web browsing habits. For example, the following data might be collected about you:

IP address and geolocation
Search queries
Bookmarks added
Technical device information and OS version
Duration of visits, links clicked, etc.

PowerLift adware

Because the developer of the PowerLift adware app is unknown, it is also unknown what type of gathered information protection the responsible parties are using. Due to this, the information might include personal details like email address, home address, name, and last name, etc. In some cases, the data might even end up in cybercriminals' hands and be used for malicious purposes.

However, PowerLift removal might be a bit more complicated if you decide to eliminate the PUP manually. For that reason, you might employ anti-malware to detect and remove it for you. After that, we also suggest you scan your machine with Fortect Intego in order to fix virus damage.

Keeping adware and malware away from Mac can be easy

Not so long time ago, users believed that Mac malware does not exist due to sophisticated built-in tools like GateKeeper. Essentially, the built-in scanner stops all the incoming software from being installed if it is not approved by Apple. For that reason, the installation of an untrustworthy app is hardly possible, unless you allow the app to be installed in the first place. This is where the protection of Gatekeeper ends, as users might be tricked into granting permissions to malicious apps. Other means, such as a built-in anti-virus and sandbox environment, helps users to defend themselves for aggressive threats.

However, multiple malware campaigns proved that Macs are not immune to malware – especially adware. In most of the cases, users get tricked by fake Flash updates or download apps from insecure websites (such as torrents where pirated software is hosted). While even the App Store might sometimes let through malicious apps,^[3] it is best to stick to official sources when installing new applications and avoid third-party sites. If you absolutely have to, however, make sure you read a review about the app, check relevant documents, pick Advanced/Custom settings and delete all the checkmarks that are pre-selected during the installation process.

Additionally, uninstall Adobe Flash player altogether – regular users do not need the plugin, as its functionality is embedded within most modern browsers. Adobe also announced that Flash would no longer be supported after December 31, 2020.^[4]

PowerLift redirects

Get rid of PowerLift adware

In most cases, you can remove PowerLift virus manually as per our instructions below. However, in some cases, the infection might install components into various places on the system, so dragging the unwanted application to Trash will no longer be enough. However, if you are trying to eliminate it manually, you should check the following places on your Mac:

~/Library/LaunchAgents
~/Library/Application Support
~/Library/LaunchDaemons

If you want to perform automatic PowerLift removal, you can rely on reputable anti-malware software instead. There are plenty of tools that are capable to detect all the malicious components of the PUP and delete them from your system completely. Note that you should also reset all the installed browsers due to the changed settings on them – check the guide below.

Delete from macOS

Remove the unwanted application:

From the menu bar, select Go > Applications.
In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).

Delete leftover files and folders:

Select Go > Go to Folder.
Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.
Finally, empty the Trash to permanently remove the leftovers.

Reset Internet Explorer

Remove dangerous add-ons:

Open Internet Explorer, click on the Gear icon (IE menu) on the top-right corner of the browser
Pick Manage Add-ons.
You will see a Manage Add-ons window. Here, look for suspicious plugins. Click on these entries and select Disable.

Change your homepage if it was altered:

Open IE and click on the Gear icon.
Select Internet Options.
In the General tab, delete the Home page address and replace it by your preferred one (for example, Google.com).
Click Apply and then select OK.

Delete temporary files:

Press on the Gear icon and select Internet Options.
Under Browsing history, click Delete...
Select relevant fields and press Delete.

Reset Internet Explorer:

Click on Gear icon > Internet options and select Advanced tab.
Select Reset.
In the new window, check Delete personal settings and select Reset.

Remove from Microsoft Edge

Delete unwanted extensions from MS Edge:

Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
From the list, pick the extension and click on the Gear icon.
Click Remove.

Clear cookies and other browser data:

Click on the Menu (three horizontal dots at the top-right of the browser window) and select Settings > Privacy, search, and services..
Under Clear browsing data, pick Choose what to clear.
Select Cookies and other site data and Cached images and files. (apart from passwords, although you might want to include Media licenses as well, if applicable) and click on Clear.

Restore new tab and homepage settings:

Click the menu icon and choose Settings.
Then find On startup section.
Click Remove next to any suspicious startup page.

Reset MS Edge if the above steps did not work:

Press on Ctrl + Shift + Esc to open Task Manager.
Click on More details arrow at the bottom of the window.
Select Details tab.
Now scroll down and locate every entry with Microsoft Edge name in it. Right-click on each of them and select End Task to stop MS Edge from running.

Instructions for Chromium-based Edge

Delete extensions from MS Edge (Chromium):

Open Edge and click select Settings > Extensions.
Delete unwanted extensions by clicking Remove.

Clear cache and site data:

Click on Menu and go to Settings.
Select Privacy, search and services.
Under Clear browsing data, pick Choose what to clear.
Under Time range, pick All time.
Select Clear now.

Reset Chromium-based MS Edge:

Click on Menu and select Settings.
On the left side, pick Reset settings.
Select Restore settings to their default values.
Confirm with Reset.
This will disable extensions and reset startup pages but will not delete bookmarks, saved passwords, or browsing history.

Remove from Mozilla Firefox (FF)

Remove dangerous extensions:

Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
Select Add-ons.
In here, select the unwanted extension and click Remove.

Reset the homepage:

Click three horizontal lines at the top right corner to open the menu.
Choose Settings.
Under Home, set your preferred homepage and new tab settings.

Clear cookies and site data:

Click Menu and pick Settings.
Go to Privacy & Security section.
Scroll down to locate Cookies and Site Data.
Click on Clear Data...
Select Cookies and Site Data and Temporary cached files and pages, then click Clear.

Reset Mozilla Firefox

If clearing the browser as explained above did not help, reset Mozilla Firefox:

Open Mozilla Firefox browser and click the Menu.
Go to Help and then choose Troubleshooting Information.
Under Give Firefox a tune up section, click on Refresh Firefox...
Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.

Remove from Google Chrome

Delete malicious extensions from Google Chrome:

Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.

Clear cache and web data from Chrome:

Click on Menu and pick Settings.
Under Privacy and security, select Clear browsing data.
Select Browsing history, Cookies and other site data, as well as Cached images and files.
Click Clear data.

Change your homepage:

Click menu and choose Settings.
Look for a suspicious site in the On startup section.
Click on Open a specific or set of pages and click on three dots to find the Remove option.

Reset Google Chrome:

If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:

Click on Menu and select Settings.
In the Settings, scroll down and click Advanced.
Scroll down and locate Reset and clean up section.
Now click Restore settings to their original defaults.
Confirm with Reset settings.

Delete from Safari

Remove dangerous extensions:

Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.

Clear history and website data:

Click Safari in the menu and pick Clear History.
Set Clear to all history and confirm with Clear History.

Reset Safari:

Click Safari in the menu and select Preferences > Advanced.
Enable Show Develop menu in menu bar.
From the menu bar, click Develop and select Empty Caches.

How to remove PowerLift

PowerLift is a Mac virus that specializes in generating revenue by showing users malicious ads

Keeping adware and malware away from Mac can be easy