ProntoApp is a potentially unwanted application designed to perform malicious activities on macOS computers
ProntoApp is an adware app published by an unknown developer and is designed for all versions of Mac operating systems. The potentially unwanted program[1] might be installed along with freeware/shareware applications from third-party sites, or when users get tricked by an attractive online app, as well as a fake Flash update. Due to these reasons, users are rarely aware that ProntoApp got installed on their systems – at least, not straight away.
As soon as ProntoApp establishes on the macOS, it immediately performs several changes to Google Chrome, Safari or another browser: users will notice that their homepage has been changed to Bing, Smart Search, or similar, and they are forced to browse via a hijacked search engine (in most of the cases, ProntoApp extension is installed). Due to this, the search results victims see are not organic, although this allows the developers to monetize on clicks made. Besides, the adware will also insert scams, fake updates, pop-ups, deals, banners, offers, coupons, and other intrusive and possibly malicious content when browsing the internet.
However, typical hijacking activities are not the main problem with ProntoApp, as it also engages in numerous actions that are more related to malware rather than adware – it can read sensitive information users insert on all sites (such as credit card details) and is also equipped with persistence mechanisms that usually prevent an easy ProntoApp removal from the infected machines.
| Name | ProntoApp |
| Type | Adware, Mac virus, PUP |
| Infection means | Users typically get infected with the PUP during the installation of third-party apps like File Converter. This technique is referred to as software bundling – optional components are deliberately hidden from sight and are installed along with the desired app |
| Symptoms | Web browser settings changed; a new extension attached to all web browsers; increased number of ads during web browsing sessions; sponsored links in the search results; difficulties in removing unwanted applications along with ProntoApp |
| Dangers | The unwanted application can lead users to insecure sites where they might download and install other PUPs or even malware; scam sites might trick users into paying fake tech support fees; personal data might be collected by unwanted parties or even cybercriminals on insecure sites |
| Termination | Refer to our manual elimination instructions below. Also, a scan with reputable anti-malware is highly recommended |
| Recovery & optimization | In case your Mac is struggling (lagging, crashing, showing errors) after the infection, you can use FortectIntego as a remedy for these symptoms and make it run well again |
Besides modifying web browser settings, ProntoApp adware also attaches an extension to it. This helps the app to gather various information about users for targeted advertisement[2] campaigns. The collected data might include:
- IP address;
- Version of the OS and the installed applications;
- Internet Server Provider;
- Websites visited;
- Links and ads clicked;
- Bookmarks added, etc.
ProntoApp application is not the only one that has been infecting Mac users in recent months. It is highly likely that it is a work of the same developer as ProductEvent, CoordinatorPlus, IdeaShared, and many others. All of the programs use the same magnifying glass icon with a green background and are not signed by any developer. In other words, ProntoApp is a re-skinned version of the same application, just named differently – this is a common trait of shady programs that are spread around the web by using deceptive means in order to gain quick revenue from infected users.
In fact, ProntoApp is so intrusive and persistent, that many users attributed it “ProntoApp virus” or “ProntoApp malware” term. While it is not entirely true (this app seems to be an aggressive type of adware), users have every right to be concerned, as unwanted changes to the installed web browsers, redirects, pop-up ads, slowdown of macOS, and other symptoms are something that nobody should deal with.
Besides showing ads to infected users, ProntoApp is also dangerous due to its redirection tendencies. Adware is known to sometimes direct users to scam or fake update sites, where they are prompted to download other potentially unwanted programs or call fake technicians for an alleged fix – a few examples of popular scams include “Your system is infected with 3 viruses,” “Immediate action required,” and many others.
You should remove ProntoApp with the help of our instructions below. If you encounter difficulties during the process, you should also scan your Mac with anti-virus software. Additionally, you should also reset your browsers and employ FortectIntego if you want to make sure that your computer is in its best shape after the infection.
Be careful when installing applications from third-party sites
There is a reason why many security experts[3] advise users staying away from third-party sites when it comes to new software installs. Apple uses sophisticated scanners and other checks before allowing an application into the App Store (although even the tech giant might sometimes fail to detect malicious apps, as 17 of them were recently removed after security firm detected shady practices of adware). Unfortunately, third-parties do not have the resources and the need to perform such broad checks before apps are placed on the site.
When you try to install an app from a third-party site, GateKeeper will detect the unofficial origin and ask your credentials to allow the installation – this stops many unwanted apps from entering without permission. The problem is that users are tricked into agreeing to install those applications and enter the credentials nonetheless.
When installing apps from third-parties, make sure you take precautionary measures. Most importantly, you should never rush the process, opt for Advanced/Custom settings, check each of the installation steps carefully, and decline all promotional offers on the way.
Uninstall ProntoApp along with all other PUPs that might have entered the system without your approval
When it comes to ProntoApp adware, it is one of those more aggressive and deceptive types that nobody knows the origins of. If anything, it reminds more of malware that seeks to monetize on users' ruined web browsing experiences – it also puts their safety at risk. It is also not surprising, considering the nature of the app, that many might be struggling when trying to perform ProntoApp removal.
We suggest you first try to remove ProntoApp manually by finding all its components on macOS and deleting them. Here's what you should look for:
- ~/Library/LaunchAgents/pronto.notification.plist
- ~/Library/LaunchAgents/pronto.update.plist
- ~/Library/Application Support/ProntoApp/ProntoApp.app/Contents/MacOS/ProntoApp
The problem is, however, that the ProntoApp virus often comes along with other unwanted software, which might be difficult to find. For that reason, we suggest you scan your machine with anti-malware software to make sure all the suspicious elements are uninstalled. Additionally, we highly advise you reset Google Chrome, Safari, and Mozilla Firefox in order to prevent the unwanted activities of coming back.
Delete from macOS
Remove the unwanted application:
- From the menu bar, select Go > Applications.
- In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).
Delete leftover files and folders:
- Select Go > Go to Folder.
- Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
- Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.
- Finally, empty the Trash to permanently remove the leftovers.
Remove from Mozilla Firefox (FF)
Remove dangerous extensions:
- Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
- Select Add-ons.
- In here, select the unwanted extension and click Remove.
Reset the homepage:
- Click three horizontal lines at the top right corner to open the menu.
- Choose Settings.
- Under Home, set your preferred homepage and new tab settings.
Clear cookies and site data:
- Click Menu and pick Settings.
- Go to Privacy & Security section.
- Scroll down to locate Cookies and Site Data.
- Click on Clear Data...
- Select Cookies and Site Data and Temporary cached files and pages, then click Clear.
Reset Mozilla Firefox
If clearing the browser as explained above did not help, reset Mozilla Firefox:
- Open Mozilla Firefox browser and click the Menu.
- Go to Help and then choose Troubleshooting Information.
- Under Give Firefox a tune up section, click on Refresh Firefox...
- Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.
Remove from Google Chrome
Delete malicious extensions from Google Chrome:
- Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
- In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.
Clear cache and web data from Chrome:
- Click on Menu and pick Settings.
- Under Privacy and security, select Clear browsing data.
- Select Browsing history, Cookies and other site data, as well as Cached images and files.
- Click Clear data.
Change your homepage:
- Click menu and choose Settings.
- Look for a suspicious site in the On startup section.
- Click on Open a specific or set of pages and click on three dots to find the Remove option.
Reset Google Chrome:
If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:
- Click on Menu and select Settings.
- In the Settings, scroll down and click Advanced.
- Scroll down and locate Reset and clean up section.
- Now click Restore settings to their original defaults.
- Confirm with Reset settings.
Delete from Safari
Remove dangerous extensions:
- Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
- Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.
Clear history and website data:
- Click Safari in the menu and pick Clear History.
- Set Clear to all history and confirm with Clear History.
Reset Safari:
- Click Safari in the menu and select Preferences > Advanced.
- Enable Show Develop menu in menu bar.
- From the menu bar, click Develop and select Empty Caches.
Was this guide helpful?
Be the first to comment