How to uninstall ExpandedCollection app/extension from Mac (Virus removal guide)

What is ExpandedCollection

ExpandedCollection is an adware application that targets Mac platform. Adware is type of malware which display unwanted advertisements, redirects search requests to scam webpages and gathers sensitive information for marketing purposes. ExpandedCollection can show banner advertisements, full-screen ads, pop ups, videos, push notifications, fake alerts, or other varieties of online advertising. It can attack your Mac’s web-browsers such as Chrome, Firefox and Safari. Maybe you approve the idea that the advertisements or pop ups is just a small problem. But these annoying advertisements eat MAC resources and slow down your system performance.

Another reason why you need to delete ExpandedCollection is its online data-tracking activity. It can monetize its functionality by gathering sensitive info from your browsing sessions. This user data, afterwards, can be easily sold to third parties. This puts your personal data at a security risk.

Adware software is usually written in ways common to malicious software, spyware and hijackers. In order to get rid of ExpandedCollection follow the steps below or use free adware removal tool listed below.

How does ExpandedCollection get on your machine

Adware usually comes on MAC computers with free applications. Most commonly, it comes without the user’s knowledge. Therefore, many users aren’t even aware that their MAC has been infected with potentially unwanted apps and adware. Please follow the easy rules in order to protect your machine from adware: do not install any suspicious programs, read the user agreement and choose only the Custom, Manual or Advanced setup mode, don’t rush to click the Next button. Also, always try to find a review of the application on the Internet. Be careful and attentive!

Threat Summary

Name	ExpandedCollection
Type	adware, potentially unwanted application (PUA), Mac virus, Mac malware
Detection Names	Trojan-Downloader.OSX.Adload, Adware.MAC.Generic, ApplicUnwnt, Program:MacOS/Vigram.A, Osx.Adware.Cimpli, OSX.Trojan.Gen, MacOS.Agent-MT and Adware/Adload!OSX
Distribution	Freeware installers, fake updaters, misleading pop up advertisements and torrent downloads
Symptoms	Your internet browser is redirected to web-pages you did not want, web browser pop-ups appear and recommend fake Flash updates, unwanted program installed without your say-so, unwanted web browser toolbars, your MAC settings are being modified without your request, fast Internet but slow browsing speeds.
Removal	ExpandedCollection removal guide

How to Remove ExpandedCollection adware (removal tutorial)

In the few simple steps below we will have a look at the adware software and how to get rid of ExpandedCollection from Firefox, Chrome and Safari web-browsers for Mac, natively or by using a few free removal utilities. Read this manual carefully, bookmark it or open this page on your smartphone, because you may need to exit your web-browser or restart your MAC system.

To remove ExpandedCollection, use the following steps:

1. Remove profiles created by ExpandedCollection
2. Check the list of installed software
3. Remove ExpandedCollection related files and folders
4. Scan your Mac with MalwareBytes
5. Remove ExpandedCollection from Safari, Chrome, Firefox
6. How to stay safe online

Remove profiles created by ExpandedCollection

ExpandedCollection can install a configuration profile on the Mac system to block changes made to the browser settings. Therefore, you need to open system preferences, find and delete the profile installed by the adware.

Click the System Preferences icon ( ) in the Dock, or choose Apple menu ( ) > System Preferences.

In System Preferences, click Profiles, then select a profile related to ExpandedCollection.

Click the minus button ( – ) located at the bottom-left of the Profiles screen to remove the profile.
Note: if you do not see Profiles in the System Preferences, that means there are no profiles installed on your Mac computer, which is normal.

Check the list of installed software

Go to the Finder and delete suspicious apps, all programs you do not remember installing. It is important to pay the most attention to programs you have recently installed. If you do not know what a program does, look for the answer on the World Wide Web.

Open Finder and click “Applications”.

Carefully browse through the list of installed apps and get rid of all questionable and unknown programs.

When you have found anything dubious that may be the ExpandedCollection or other potentially unwanted program, then right click this program and choose “Move to Trash”. Once complete, Empty Trash.

Remove ExpandedCollection related files and folders

Now you need to try to find ExpandedCollection related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

ExpandedCollection creates several files, these files must be found and removed. Below is a list of files associated with this unwanted application.

• /Library/LaunchDaemons/com.ExpandedCollection.system.plist
• ~/Library/LaunchAgents/com.ExpandedCollection.service.plist
• /Library/Application Support/.(RANDOM)/System/com.ExpandedCollection.system
• ~/Library/Application Support/.(RANDOM)/Services/com.ExpandedCollection.service.app

Some files created by ExpandedCollection are hidden from the user. To find and delete them, you need to enable “show hidden files”. To do this, use the shortcut CMD + SHIFT + . Press once to show hidden files and again to hide them. There is another way. Click Finder -> Applications -> Utilities -> Terminal. In Terminal, paste the following text: defaults write com.apple.finder AppleShowAllFiles YES

Press Enter. Hold the ‘Option/alt’ key, then right click on the Finder icon in the dock and click Relaunch.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for ExpandedCollection generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: com.ExpandedCollection.service.plist, macsearch.plist, com.net-preferences.plist, com.machelper.plist, installapp.plist, com.google.defaultsearch.plist, and search.plist. Most often, browser hijackers, PUPs and adware create several files with similar names.

Check for ExpandedCollection generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folders and files. Check the contents of suspicious folders, if there is a file with a name similar to com.ExpandedCollection.system, then this folder must be deleted. Move all suspicious folders and files to the Trash.

Check for ExpandedCollection generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for ExpandedCollection generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.machelper.system.plist, com.installapp.system.plist, com.search.system.plist, com.ExpandedCollection.system.plist and com.macsearch.system.plist. In most cases, PUPs, adware and browser hijackers create several files with similar names.

Scan your Mac with MalwareBytes

We suggest using MalwareBytes Anti Malware to scan the Mac for browser hijackers, adware software and PUPs. This free utility is an advanced malware removal application created by (c) Malwarebytes lab. This program uses the world’s most popular anti malware technology. It is able to help you remove web browser toolbars and other security threats from your Mac device for free.

1. Download MalwareBytes Anti-Malware on your MAC by clicking on the following link.
   
   

   Malwarebytes Anti-malware (Mac)
   20850 downloads
   Author: Malwarebytes
   Category: Security tools
   Update: September 10, 2020
   
2. After the download is done, close all software and windows on your MAC. Open a file location. Run the downloaded file and follow the prompts.
3. Click the “Scan” button to scan for ExpandedCollection . Depending on your MAC, the scan can take anywhere from a few minutes to close to an hour.
4. After that process is done, MalwareBytes Free will open a scan report. When you’re ready, click “Quarantine”.

Remove ExpandedCollection from Safari, Chrome, Firefox

If you have ‘ExpandedCollection adware’ removal problem, then remove unwanted addons can help you. In the steps below we will show you the method to remove malicious extensions without reinstall. This will also help to remove ExpandedCollection from your internet browser.

Google Chrome	Mozilla Firefox
Click on ‘three dots menu’ button at the top right corner of the Google Chrome window. When the drop-down menu appears, select ‘More tools’ and click on ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to remove ExpandedCollection adware by reset Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing problems with ExpandedCollection adware removal, you need to reset Mozilla Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stay safe online

If you want to remove unwanted ads, web-browser redirects and popups, then install an adblocker program like AdGuard. It can block unwanted advertisements and pop-ups, stop web-sites from tracking your online activities when using the Google Chrome, Mozilla Firefox and Safari. So, if you like surf the Web, but you do not like intrusive ads and want to protect your MAC OS from malicious webpages, then the AdGuard is your best choice.

Download AdGuard from the link below.

When downloading is complete, run the downloaded file. You will see the “Setup Wizard” screen. Follow the prompts.

Each time, when you run your MAC, AdGuard will start automatically and stop unwanted popups, block malicious and misleading websites.

To sum up

We suggest that you keep AdGuard (to help you stop unwanted popups and unwanted harmful websites) and MalwareBytes Anti-Malware (to periodically scan your computer for new malicious software, hijackers and adware). Make sure that you have all the Critical Updates recommended for Mac operating system. Without regular updates you WILL NOT be protected when new browser hijackers, malicious apps and adware are released.

If you are still having problems while trying to get rid of ExpandedCollection from your internet browser, then ask for help here.