How to uninstall ExpandedActivity app/extension from Mac (Virus removal guide)

What is ExpandedActivity

According to security researchers, ExpandedActivity is a malicious application that belongs to the Adware category. It can cause many issues such as annoying advertisements and popups on your internet browser, irrelevant search results that redirect to scam webpages, web browser crashes and slow loading web-sites.

Another reason why you need to remove ExpandedActivity is its online data-tracking activity. It is able to gather your privacy data (your ip address, what is a web-page you are viewing now, what you are looking for on the World Wide Web, which links you are clicking), which can later transfer to third parties.

Therefore it is very important to follow the step-by-step instructions below sooner. The few simple steps will allow you to remove ExpandedActivity as well as clean your internet browser from intrusive advertisements. What is more, the step-by-step instructions below will help you remove other malicious software such as unwanted toolbars and browser hijackers that can be installed onto computer along with the adware.

How does ExpandedActivity get on your MAC OS

Adware usually is bundled with freeware . So, when you installing free software, carefully read the disclaimers, choose the Custom or Advanced setup type to watch for bundled apps that are being installed, because some of the apps are PUPs and adware.

Threat Summary

Name	ExpandedActivity, ExpandedActivity 1.0 app
Type	adware software, potentially unwanted program (PUP), Mac virus, Mac malware
Detection Names	MacOS.Agent-MT, Adware.MAC.Generic, Osx.Adware.Cimpli, ApplicUnwnt, Trojan-Downloader.OSX.Adload, Adware/Adload!OSX, OSX.Trojan.Gen and Program:MacOS/Vigram.A
Distribution	Free software installers, torrent downloads, fake software updaters and shady pop up ads
Symptoms	The web-page links redirect to a web sites different from what you expected, unexpected ads appear on web pages that you are visiting, there is an unexpected program in the ‘Applications’ section of the Finder, unexpected browser plugins or toolbars keep coming back, your MAC OS settings are being modified without your request, low ping but slow Internet.
Removal	ExpandedActivity removal guide

How to Remove ExpandedActivity adware (removal steps)

When the adware software gets installed on your MAC without your knowledge, it is not easy to delete. In many cases, there is no Uninstall program that simply delete the ExpandedActivity adware from your Mac. So, we recommend using well-proven free specialized tool like MalwareBytes Free. But the best solution to remove ExpandedActivity will be to perform several manual steps, after that additionally run antimalware utilities.

To remove ExpandedActivity, follow the steps below:

1. Remove profiles created by ExpandedActivity
2. Check the list of installed software
3. Remove ExpandedActivity related files and folders
4. Scan your Mac with MalwareBytes
5. Remove ExpandedActivity from Safari, Chrome, Firefox
6. How to stay safe online

Remove profiles created by ExpandedActivity

ExpandedActivity can make changes to the Mac system such as malicious changes to browser settings, and the addition of malicious system profiles. You need to check the system preferences, find and remove malicious profiles and ensure your settings are as you expect.

Click Apple menu ( ) > System Preferences.

In System Preferences, select Profiles. if there is no Profiles in the list of preferences, that means there are no profiles installed on the Mac. If there is Profiles in the list, then click on it, then select a profile related to ExpandedActivity.

To delete a malicious profile, click on the minus button ( – ) located at the bottom-left of the Profiles screen.

Check the list of installed software

Some PUPs, adware and browser hijackers may be removed by uninstalling the free applications they came with. If this way does not succeed, then looking them up in the list of installed software in the Finder. Use the “Move to Trash” command in order to remove them.

1. Open the Finder.
2. Click “Applications”.
3. It will open a list of all applications installed on the MAC OS.
4. Scroll through the all list, and remove dubious and unknown apps. Pay maximum attention to the program you installed last.
5. Drag the questionable program from the Applications folder to the Trash.
6. Empty Trash.

Remove ExpandedActivity related files and folders

Now you need to try to find ExpandedActivity related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

ExpandedActivity creates several files, these files must be found and removed. Below is a list of files associated with this unwanted program.

• /Library/LaunchDaemons/com.ExpandedActivity.system.plist
• ~/Library/LaunchAgents/com.ExpandedActivity.service.plist
• /Library/Application Support/.(RANDOM)/System/com.ExpandedActivity.system
• ~/Library/Application Support/.(RANDOM)/Services/com.ExpandedActivity.service.app

Some files created by ExpandedActivity are hidden from the user. To find and delete them, you need to enable “show hidden files”. To do this, use the shortcut CMD + SHIFT + . Press once to show hidden files and again to hide them. There is another way. Click Finder -> Applications -> Utilities -> Terminal. In Terminal, paste the following text: defaults write com.apple.finder AppleShowAllFiles YES

Press Enter. Hold the ‘Option/alt’ key, then right click on the Finder icon in the dock and click Relaunch.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for ExpandedActivity generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: com.google.defaultsearch.plist, , installapp.plist, com.ExpandedActivity.service.plist, search.plist, com.net-preferences.plist, macsearch.plist and com.machelper.plist. Most often, potentially unwanted programs, browser hijackers and adware create several files with similar names.

Check for ExpandedActivity generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folders and files. Check the contents of suspicious folders, if there is a file with a name similar to com.ExpandedActivity.system, then this folder must be deleted. Move all suspicious folders and files to the Trash.

Check for ExpandedActivity generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for ExpandedActivity generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.installapp.system.plist, com.search.system.plist, com.ExpandedActivity.system.plist, com.macsearch.system.plist and com.machelper.system.plist. In most cases, browser hijackers, adware and potentially unwanted programs create several files with similar names.

Scan your Mac with MalwareBytes

We advise using MalwareBytes Free. You may download and install MalwareBytes Anti-Malware to detect and remove ExpandedActivity associated apps from your Mac. When installed and updated, the malicious software remover automatically scans for and deletes all security threats exist on the MAC OS.

1. Download MalwareBytes Anti-Malware (MBAM) from the link below.
   
   

   Malwarebytes Anti-malware (Mac)
   20851 downloads
   Author: Malwarebytes
   Category: Security tools
   Update: September 10, 2020
   
2. When downloading is complete, close all programs and windows on your MAC system. Open a folder in which you saved it. Run the downloaded file and follow the prompts.
3. Press the “Scan” button . MalwareBytes Free application will scan through the whole MAC for the ExpandedActivity . A system scan may take anywhere from 5 to 30 minutes, depending on your MAC.
4. Once MalwareBytes AntiMalware (MBAM) has finished scanning your MAC system, MalwareBytes will open a list of all items found by the scan. Review the results once the tool has complete the system scan. If you think an entry should not be quarantined, then uncheck it. Otherwise, simply press “Quarantine”.

Remove ExpandedActivity from Safari, Chrome, Firefox

Remove unwanted extensions is a easy way to remove ExpandedActivity adware and return internet browser’s settings which have been changed by adware.

Google Chrome	Mozilla Firefox
In the top right hand corner, click on ‘three vertical dots’, and this will open up the main menu on Chrome. When the drop-down menu appears, choose ‘More tools’ and click on ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to remove ExpandedActivity adware by reset Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing problems with ExpandedActivity adware removal, you need to reset Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stay safe online

By installing an ad-blocking program like AdGuard, you are able to block malicious web-pages, stop autoplaying video ads and remove lots of distracting and annoying ads on web-pages.

Installing the AdGuard is simple. First you’ll need to download AdGuard from the following link. Save it to your Desktop so that you can access the file easily.

Once the downloading process is complete, start the downloaded file. You will see the “Setup Wizard” screen. Follow the prompts.

Each time, when you start your Apple Mac, AdGuard will run automatically and stop unwanted advertisements, block harmful and misleading web sites.

To sum up

Now your computer should be clean of the ExpandedActivity adware. We suggest that you keep MalwareBytes Free (to periodically scan your MAC system for new adwares and other malicious software) and AdGuard (to help you block unwanted pop up advertisements and harmful web pages). Moreover, to prevent any adware, please stay clear of unknown and third party software.

If you need more help with ExpandedActivity related issues, go to here.