How to uninstall DefaultUpgrade app/extension from Mac (Virus removal guide)

What is DefaultUpgrade

DefaultUpgrade is an adware application. Adware is a form of malicious software that displays unwanted advertisements. Some of these ads are scams or fake ads developed to trick users. Even the harmless advertisements can become really irritating. Adware can be installed unintentionally and without permission, when users open email attachments, install free software.

Another reason, why adware should be removed, is its online data-tracking activity. Adware can install a component that enables its developer to track which web-sites you visit, which products you look at upon those pages. They are then able to choose the type of ads they display you. So, if you had adware software on your MAC, there is a good chance you have another that is gathering and sharing your privacy data with third parties, without your say-so.

How does DefaultUpgrade get on your MAC OS

Adware usually gets onto Apple Mac by being attached to freeware . So, when you installing free programs, carefully read the disclaimers, choose the Custom or Advanced setup option to watch for bundled programs that are being installed, because certain of the apps are potentially unwanted programs and adware.

Threat Summary

Name	DefaultUpgrade, DefaultUpgrade 1.0 app
Type	adware, potentially unwanted application (PUA), Mac malware, Mac virus
Detection Names	Program:MacOS/Vigram.A, Adware/Adload!OSX, Trojan-Downloader.OSX.Adload, MacOS.Agent-MT, Osx.Adware.Cimpli, ApplicUnwnt, Adware.MAC.Generic and OSX.Trojan.Gen
Distribution	Freeware installers, fake update tools, misleading pop-up advertisements and torrent downloads
Symptoms	The website links redirect to a webpages different from what you expected, ads appear in places they shouldn’t be, new entries appear in your Applications folder, an unexpected toolbar appears in your web browser, your MAC OS settings are being changed without your request, fast Internet but slow browsing speeds.
Removal	DefaultUpgrade removal guide

How to remove DefaultUpgrade from Mac

Without a doubt, the adware is harmful to your computer. So you need to quickly and completely delete this DefaultUpgrade . To get rid of this adware, you may use the manual removal guidance which are given below or free malicious software removal utility like MalwareBytes Anti Malware (MBAM) (it is free). We suggest you use automatic removal solution that will help you to remove DefaultUpgrade easily and safely. Manual removal is best used only if you’re well versed in MAC or in the case where adware is not deleted automatically. Read it once, after doing so, please bookmark this page (or open it on your smartphone) as you may need to close your browser or reboot your MAC system.

To remove DefaultUpgrade, perform the steps below:

1. Remove unwanted profiles on Mac device
2. Remove DefaultUpgrade associated software by using the Finder
3. Remove DefaultUpgrade related files and folders
4. Scan your Mac with MalwareBytes
5. Remove DefaultUpgrade from Safari, Chrome, Firefox
6. How to stay safe online
7. Finish words

Remove unwanted profiles on Mac device

DefaultUpgrade can install a configuration profile on the Mac system to block changes made to the browser settings. Therefore, you need to open system preferences, find and delete the profile installed by the adware software.

Click the System Preferences icon ( ) in the Dock, or choose Apple menu ( ) > System Preferences.

In System Preferences, click Profiles, then select a profile related to DefaultUpgrade.

Click the minus button ( – ) located at the bottom-left of the Profiles screen to remove the profile.
Note: if you do not see Profiles in the System Preferences, that means there are no profiles installed on your Mac computer, which is normal.

Remove DefaultUpgrade associated software by using the Finder

It’s of primary importance to identify and remove PUPs, adware and browser hijackers through ‘Applications’ section of your Finder.

Open Finder and click “Applications” like below.

You will see a list of software installed on your computer. We recommend to pay maximum attention to the program you installed last. Most likely, it’s the DefaultUpgrade adware software. If you are in doubt, you can always check the program by doing a search for her name in Google, Yahoo or Bing.

After the program which you need to remove is found, simply right click on its name, and select “Move to Trash”.

Don’t forget, select Finder, then “Empty Trash”.

Remove DefaultUpgrade related files and folders

Now you need to try to find DefaultUpgrade related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

DefaultUpgrade creates several files, these files must be found and removed. Below is a list of files associated with this unwanted program.

• /Library/LaunchDaemons/com.DefaultUpgrade.system.plist
• ~/Library/LaunchAgents/com.DefaultUpgrade.service.plist
• /Library/Application Support/.(RANDOM)/System/com.DefaultUpgrade.system
• ~/Library/Application Support/.(RANDOM)/Services/com.DefaultUpgrade.service.app

Some files created by DefaultUpgrade are hidden from the user. To find and delete them, you need to enable “show hidden files”. To do this, use the shortcut CMD + SHIFT + . Press once to show hidden files and again to hide them. There is another way. Click Finder -> Applications -> Utilities -> Terminal. In Terminal, paste the following text: defaults write com.apple.finder AppleShowAllFiles YES

Press Enter. Hold the ‘Option/alt’ key, then right click on the Finder icon in the dock and click Relaunch.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for DefaultUpgrade generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: macsearch.plist, com.google.defaultsearch.plist, , com.net-preferences.plist, com.DefaultUpgrade.service.plist, com.machelper.plist, search.plist and installapp.plist. Most often, adware, potentially unwanted programs and browser hijackers create several files with similar names.

Check for DefaultUpgrade generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folders and files. Check the contents of suspicious folders, if there is a file with a name similar to com.DefaultUpgrade.system, then this folder must be deleted. Move all suspicious folders and files to the Trash.

Check for DefaultUpgrade generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for DefaultUpgrade generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.machelper.system.plist, com.DefaultUpgrade.system.plist, com.search.system.plist, com.installapp.system.plist and com.macsearch.system.plist. In most cases, adware, potentially unwanted programs and browser hijackers create several files with similar names.

Scan your Mac with MalwareBytes

You can remove DefaultUpgrade associated files automatically through the use of MalwareBytes Free. We advise this free malicious software removal tool because it may easily remove adware, browser hijackers, toolbars and PUPs with all their components such as files, folders and system entries.

Download MalwareBytes on your Apple Mac by clicking on the following link.

Once the downloading process is finished, close all applications and windows on your MAC. Run the saved file. Follow the prompts.

The MalwareBytes AntiMalware will automatically start and you can see its main screen as shown below.

Now click the “Scan” button to perform a system scan for the DefaultUpgrade . This task may take some time, so please be patient. While the MalwareBytes Anti Malware is checking, you may see how many objects it has identified either as being malware.

When MalwareBytes AntiMalware (MBAM) completes the scan, you can check all threats detected on your MAC. Make sure all items have ‘checkmark’ and click the “Quarantine” button. The MalwareBytes Anti Malware will remove DefaultUpgrade .

Remove DefaultUpgrade from Safari, Chrome, Firefox

If you have ‘DefaultUpgrade ‘ removal problem, then remove unwanted plugins can help you. In the steps below we’ll show you the way to delete harmful extensions without reinstall. This will also allow to remove DefaultUpgrade adware from your web browser.

Google Chrome	Mozilla Firefox
In the top right corner, click on Google Chrome’s main menu button, represented by three vertical dots. When the drop-down menu appears, select ‘More tools’ and click on ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to remove DefaultUpgrade by reset Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing issues with DefaultUpgrade removal, you need to reset Mozilla Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stay safe online

If you want to delete intrusive ads, web-browser redirects and pop-ups, then install an ad-blocker application such as AdGuard. It can block unwanted ads and pop-ups, stop webpages from tracking your online activities when using the Mozilla Firefox, Chrome and Safari. So, if you like browse the Net, but you don’t like annoying advertisements and want to protect your computer from harmful web pages, then the AdGuard is your best choice.

Download AdGuard from the following link.

Once the download is finished, run the downloaded file. The “Setup Wizard” window will show up on the computer screen.

Follow the prompts. AdGuard will then be installed. A window will show up asking you to confirm that you want to see a quick instructions. Click “Skip” button to close the window and use the default settings, or press “Get Started” to see an quick guidance which will help you get to know AdGuard better.

Each time, when you start your machine, AdGuard will launch automatically and stop unwanted pop-up ads, block malicious and misleading web-pages.

Finish words

Now your computer should be free of the DefaultUpgrade adware. We suggest that you keep AdGuard (to help you stop unwanted popup advertisements and annoying harmful web-pages) and MalwareBytes AntiMalware (to periodically scan your MAC system for new adware softwares and other malware).

If you are still having problems while trying to delete DefaultUpgrade app/extension from the Google Chrome, Safari and Mozilla Firefox, then ask for help here here.