How to uninstall ElemntState app/extension from Mac (Virus removal guide)

What is ElemntState

According to security professionals, ElemntState is an Adware app. Adware is type of malicious software designed to insert advertising into your Web browsing or even desktop experience. Adware can alter your homepage, search provider, search results, or even add toolbars to your internet browser. Adware software run in the background when you’re online, and it can slow down your Mac and affect its performance.

Does adware steal your confidential data? Adware software is able to gather and transmit privacy data without your knowledge. It has the ability to track information about webpages visited, internet browser and system information, and your MAC system IP address.

If your browser has been hijacked by the adware, you must have done any of the steps below. Once you have removed ElemntState from your MAC by following our suggestions below, make sure not to commit the same mistakes again in the future.

How does ElemntState get on your machine

Adware spreads with a simple but quite effective way. It is integrated into the setup file of various freeware. Thus on the process of installation, it will be added onto your MAC OS and/or web browser. In order to avoid adware, you just need to follow a few simple rules: carefully read the Terms of Use and the license, choose only a Manual, Custom or Advanced installation mode, which enables you to make sure that the application you want to install, thereby protect your Mac from adware.

Threat Summary

Name	ElemntState, ElemntState 1.0 app
Type	adware, potentially unwanted application (PUA), Mac virus, Mac malware
Detection Names	Trojan-Downloader.OSX.Adload, ApplicUnwnt, Adware.MAC.Generic, Osx.Adware.Cimpli, Program:MacOS/Vigram.A, OSX.Trojan.Gen, MacOS.Agent-MT and Adware/Adload!OSX
Distribution	Freeware installers, torrent downloads, suspicious pop-up advertisements and fake software updaters
Symptoms	Your browser is redirected to web pages you did not want, pop ups and newtabs are loaded without your request, your MAC OS starts automatically installing unwanted software, unwanted internet browser toolbars, your web browser search provider has replaced without your permission, low ping but slow Internet.
Removal	ElemntState removal guide

How to remove ElemntState from Mac computer

As with removing adware software, malicious software or potentially unwanted programs, there are few steps you can do. We recommend trying them all. If you do only one part of the guidance, then it should be run malware removal tool, because it should uninstall adware software and block any further infection. But to completely remove ElemntState adware you will have to at least reset your internet browser settings to default state, uninstall all unwanted and suspicious programs, and remove adware software by malicious software removal tools. Some of the steps will require you to restart your computer or close this web-page. So, read this tutorial carefully, then bookmark this page or open it on your smartphone for later reference.

To remove ElemntState, complete the following steps:

1. Remove unwanted profiles on Mac device
2. Uninstall ElemntState related applications through the Finder
3. Remove ElemntState related files and folders
4. Scan your Mac with MalwareBytes
5. Remove ElemntState from Safari, Chrome, Firefox
6. How to stay safe online
7. Finish words

Remove unwanted profiles on Mac device

ElemntState can install a configuration profile on the Mac system to block changes made to the browser settings. Therefore, you need to open system preferences, find and delete the profile installed by the adware.

Click the System Preferences icon ( ) in the Dock, or choose Apple menu ( ) > System Preferences.

In System Preferences, click Profiles, then select a profile associated with ElemntState.

Click the minus button ( – ) located at the bottom-left of the Profiles screen to remove the profile.
Note: if you do not see Profiles in the System Preferences, that means there are no profiles installed on your Mac device, which is normal.

Uninstall ElemntState related applications through the Finder

Some adware, PUPs and browser hijackers can be removed by uninstalling the free applications they came with. If this way does not succeed, then looking them up in the list of installed apps in the Finder. Use the “Move to Trash” command in order to get rid of them.

1. Open the Finder.
2. Click “Applications”.
3. It will show a list of all programs installed on the MAC system.
4. Scroll through the all list, and delete questionable and unknown software. Pay maximum attention to the program you installed last.
5. Drag the dubious application from the Applications folder to the Trash.
6. Empty Trash.

Remove ElemntState related files and folders

Now you need to try to find ElemntState related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

ElemntState creates several files, these files must be found and removed. Below is a list of files associated with this unwanted application.

• /Library/LaunchDaemons/com.ElemntState.system.plist
• ~/Library/LaunchAgents/com.ElemntState.service.plist
• /Library/Application Support/.(RANDOM)/System/com.ElemntState.system
• ~/Library/Application Support/.(RANDOM)/Services/com.ElemntState.service.app

Some files created by ElemntState are hidden from the user. To find and delete them, you need to enable “show hidden files”. To do this, use the shortcut CMD + SHIFT + . Press once to show hidden files and again to hide them. There is another way. Click Finder -> Applications -> Utilities -> Terminal. In Terminal, paste the following text: defaults write com.apple.finder AppleShowAllFiles YES

Press Enter. Hold the ‘Option/alt’ key, then right click on the Finder icon in the dock and click Relaunch.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for ElemntState generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: com.net-preferences.plist, search.plist, installapp.plist, com.google.defaultsearch.plist, , com.ElemntState.service.plist, macsearch.plist and com.machelper.plist. Most often, PUPs, adware and browser hijackers create several files with similar names.

Check for ElemntState generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folders and files. Check the contents of suspicious folders, if there is a file with a name similar to com.ElemntState.system, then this folder must be deleted. Move all suspicious folders and files to the Trash.

Check for ElemntState generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for ElemntState generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.macsearch.system.plist, com.installapp.system.plist, com.machelper.system.plist, com.search.system.plist and com.ElemntState.system.plist. In most cases, browser hijackers, potentially unwanted programs and adware create several files with similar names.

Scan your Mac with MalwareBytes

If you carefully followed the previous steps, then you should be able to delete ElemntState. Of course, very often adware, browser hijackers and potentially unwanted programs hides on a Mac device, disguising itself as legitimate apps and files. Therefore, in some cases, it is difficult for an inexperienced user to decide whether a particular file is part of adware, browser hijackers and potentially unwanted programs. Therefore, we advise you to use MalwareBytes Free to scan the Mac computer.

1. Installing the MalwareBytes Anti Malware (MBAM) is simple. First you will need to download MalwareBytes Free from the link below. Save it to your Desktop so that you can access the file easily.
   
   

   Malwarebytes Anti-malware (Mac)
   20850 downloads
   Author: Malwarebytes
   Category: Security tools
   Update: September 10, 2020
   
2. When the downloading process is done, close all applications and windows on your machine. Open a directory in which you saved it. Run the downloaded file and follow the prompts.
3. Click the “Scan” button . MalwareBytes Anti Malware program will scan through the whole machine for the ElemntState adware. This procedure can take quite a while, so please be patient. While the tool is scanning, you may see count of objects and files has already scanned.
4. After that process is done, the results are displayed in the scan report. Review the results once the tool has finished the system scan. If you think an entry should not be quarantined, then uncheck it. Otherwise, simply press “Quarantine”.

Remove ElemntState from Safari, Chrome, Firefox

If you’re still seeing ElemntState that won’t go away, you might have harmful extensions installed on your internet browser. Check your web-browser for unwanted extensions using the steps below.

Google Chrome	Mozilla Firefox
In the top-right corner, expand the Chrome menu. Select ‘More tools’, then ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to get rid of ElemntState by reset Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing issues with ElemntState adware removal, you need to reset Mozilla Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stay safe online

To put it simply, you need to use an ad-blocker utility (AdGuard, for example). It will stop and protect you from malicious webpages, unwanted advertisements and pop-ups. To be able to do that, the ad blocker program uses a list of filters. Each filter is a rule that describes a malicious webpage, an advertising content, a banner and others. The ad-blocker program automatically uses these filters, depending on the webpages you’re visiting.

AdGuard can be downloaded from the following link.

When the download is finished, run the downloaded file. The “Setup Wizard” window will show up on the computer screen.

Follow the prompts. AdGuard will then be installed. A window will show up asking you to confirm that you want to see a quick guide. Click “Skip” button to close the window and use the default settings, or click “Get Started” to see an quick guidance which will assist you get to know AdGuard better.

Each time, when you start your machine, AdGuard will start automatically and stop annoying popups, block malicious and misleading web-sites.

Finish words

Once you have complete the steps outlined above, your MAC should be clean from ElemntState adware and other malicious software. The Firefox, Safari and Google Chrome will no longer redirect you to various unwanted websites and online ads. Unfortunately, if the few simple steps does not help you, then you have caught a new adware software, and then the best way – ask for help here.