How to uninstall ExpandedValue app/extension from Mac (Virus removal guide)

What is ExpandedValue

According to security experts, ExpandedValue is an adware application. Adware is considered by many to be synonymous with ‘malware’. It is a harmful application which didplays unwanted ads. Some examples include popup advertisements, push notifications or unclosable windows. ExpandedValue can modify browser settings, download and install malicious browser extensions. The adware app can be installed onto your Mac via infected web-pages, when you open email attachments, anytime you download and install free applications.

The ExpandedValue adware has the ability to gather and transmit privacy info without your permission. It is able to track information about web-sites visited, web browser and system information, and your MAC IP address. So, if you happen to encounter the adware, then be quick and take effort to get rid of it as quickly as possible. Follow the tutorial below to get rid of ExpandedValue adware. Let us know how you managed by sending us your comments please.

How does ExpandedValue get on your computer

Adware software usually is bundled within certain free programs that users download off of the Web. So, think back, have you ever download and run any free apps. In order to avoid infection, in the Setup wizard, you should be be proactive and carefully read the ‘Terms of use’, the ‘license agreement’ and other installation screens, as well as to always choose the ‘Manual’ or ‘Advanced’ installation mode, when installing anything downloaded from the Net.

Threat Summary

Name	ExpandedValue, ExpandedValue 1.0 app
Type	adware, potentially unwanted application (PUA), Mac malware, Mac virus
Detection Names	OSX.Trojan.Gen, MacOS.Agent-MT, Trojan-Downloader.OSX.Adload, Adware.MAC.Generic, Osx.Adware.Cimpli, Program:MacOS/Vigram.A, ApplicUnwnt and Adware/Adload!OSX
Distribution	Free software installers, fake software updaters, torrent downloads and dubious pop-up advertisements
Symptoms	Your web-browser is redirected to web pages you did not want, undesired advertising links appear on web-pages that you are visiting, there is an unexpected program in the ‘Applications’ section of the Finder, an unwanted toolbar appears in your internet browser, your MAC system settings are being changed without your request, low ping but slow Internet.
Removal	ExpandedValue removal guide

How to remove ExpandedValue

To get rid of ExpandedValue from your MAC, you must remove all suspicious apps and every component that could be related to the adware. Besides, to restore your internet browser default search engine, new tab page and homepage, you should reset the hijacked web-browsers. As soon as you are finished with ExpandedValue adware removal process, we suggest you scan your Mac with malware removal utilities listed below. It will complete the removal process on your computer.

To remove ExpandedValue, use the following steps:

1. Remove unwanted profiles on Mac device
2. Check the list of installed applications
3. Remove ExpandedValue related files and folders
4. Scan your Mac with MalwareBytes
5. Remove ExpandedValue from Safari, Chrome, Firefox
6. How to stay safe online

Remove unwanted profiles on Mac device

ExpandedValue can install a configuration profile on the Mac system to block changes made to the browser settings. Therefore, you need to open system preferences, find and delete the profile installed by the adware.

Click the System Preferences icon ( ) in the Dock, or choose Apple menu ( ) > System Preferences.

In System Preferences, click Profiles, then select a profile related to ExpandedValue.

Click the minus button ( – ) located at the bottom-left of the Profiles screen to remove the profile.
Note: if you do not see Profiles in the System Preferences, that means there are no profiles installed on your Mac computer, which is normal.

Check the list of installed applications

Some of PUPs, adware and browser hijackers can be removed using the Move to Trash tool which may be found in the Finder. So, if you’re using any version of Mac OS and you have noticed an unwanted program, then first try to remove it through the Finder.

Make sure you have closed all web-browsers and other software. Next, uninstall any unknown and suspicious software from Apple Mac using the Finder.

Open Finder and click “Applications”.

Look around the entire list of software installed on your computer. Most probably, one of them is the ExpandedValue adware software. Select the dubious program or the program that name is not familiar to you and delete it.

Drag the questionable application from the Applications folder to the Trash.

Most important, don’t forget, select Finder -> Empty Trash.

Remove ExpandedValue related files and folders

Now you need to try to find ExpandedValue related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

ExpandedValue creates several files, these files must be found and removed. Below is a list of files associated with this unwanted program.

• /Library/LaunchDaemons/com.ExpandedValue.system.plist
• ~/Library/LaunchAgents/com.ExpandedValue.service.plist
• /Library/Application Support/.(RANDOM)/System/com.ExpandedValue.system
• ~/Library/Application Support/.(RANDOM)/Services/com.ExpandedValue.service.app

Some files created by ExpandedValue are hidden from the user. To find and delete them, you need to enable “show hidden files”. To do this, use the shortcut CMD + SHIFT + . Press once to show hidden files and again to hide them. There is another way. Click Finder -> Applications -> Utilities -> Terminal. In Terminal, paste the following text: defaults write com.apple.finder AppleShowAllFiles YES

Press Enter. Hold the ‘Option/alt’ key, then right click on the Finder icon in the dock and click Relaunch.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for ExpandedValue generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: com.google.defaultsearch.plist, , search.plist, macsearch.plist, com.net-preferences.plist, installapp.plist, com.ExpandedValue.service.plist and com.machelper.plist. Most often, adware software, browser hijackers and potentially unwanted programs create several files with similar names.

Check for ExpandedValue generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folders and files. Check the contents of suspicious folders, if there is a file with a name similar to com.ExpandedValue.system, then this folder must be deleted. Move all suspicious folders and files to the Trash.

Check for ExpandedValue generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for ExpandedValue generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.macsearch.system.plist, com.ExpandedValue.system.plist, com.search.system.plist, com.installapp.system.plist and com.machelper.system.plist. In most cases, browser hijackers, adware software and potentially unwanted programs create several files with similar names.

Scan your Mac with MalwareBytes

We recommend using MalwareBytes to scan the Mac computer for adware software, browser hijackers and PUPs. This free tool is an advanced malicious software removal program created by (c) Malwarebytes lab. This program uses the world’s most popular anti malware technology. It’s able to help you delete ransomware and other security threats from your Mac computer for free.

1. Click the following link to download MalwareBytes Free.
   
   

   Malwarebytes Anti-malware (Mac)
   20850 downloads
   Author: Malwarebytes
   Category: Security tools
   Update: September 10, 2020
   
2. Once the download is done, please close all applications and open windows on your MAC OS. Run the downloaded file. Follow the prompts.
3. The MalwareBytes will start and open the main window.
4. Further, click the “Scan” button . MalwareBytes Free program will scan through the whole Apple Mac for the ExpandedValue adware. This procedure can take some time, so please be patient. While the utility is checking, you can see how many objects and files has already scanned.
5. Once the scan is finished, MalwareBytes Anti-Malware (MBAM) will display a scan report.
6. Next, you need to click the “Remove Selected Items” button.
7. Close the AntiMalware and continue with the next step.

Remove ExpandedValue from Safari, Chrome, Firefox

If you’re still seeing ExpandedValue that won’t go away, you might have harmful addons installed on your browser. Check your internet browser for unwanted extensions using the steps below.

Google Chrome	Mozilla Firefox
In the top right corner, click on Google Chrome’s main menu button, represented by three vertical dots. When the drop-down menu appears, select ‘More tools’ and click on ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to remove ExpandedValue adware software by reset Google Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing issues with ExpandedValue adware removal, you need to reset Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stay safe online

By installing an ad-blocker application such as AdGuard, you’re able to block malicious web-pages, stop autoplaying video ads and remove a ton of distracting and unwanted ads on web pages.

1. Visit the following page to download the latest version of AdGuard for Mac OS.
   
   

   AdGuard for Mac download
   3687 downloads
   Author: © Adguard
   Category: Security tools
   Update: January 17, 2018
   
2. Once the download is done, start the downloaded file. You will see the “Setup Wizard” program window. Follow the prompts.
3. When the install is finished, click “Skip” to close the installation program and use the default settings, or press “Get Started” to see an quick tutorial which will allow you get to know AdGuard better.
4. In most cases, the default settings are enough and you do not need to change anything. Each time, when you start your computer, AdGuard will start automatically and stop intrusive ads, block malicious and misleading web sites.

Finish words

After completing the few simple steps outlined above, your Apple Mac should be clean from the ExpandedValue adware and other malware. The Safari, Firefox and Google Chrome will no longer redirect you to scam pages and online ads. Unfortunately, if the steps does not help you, then you have caught a new adware, and then the best way – ask for help here.