How to uninstall ExpressDefault app/extension from Mac (Virus removal guide)

What is ExpressDefault

ExpressDefault is an adware application that targets Apple computers. Adware is a part of malicious software designed to display unwanted advertisements, modify web-browser settings, download and install harmful browser add-ons. All the time, while ExpressDefault is running, your web browser will be fill with annoying ads. Most probably, it has been installed on your MAC without permission and you don’t even know how and where this adware has got into your machine.

The worst is, adware software is often harmless, but sometimes the adware you inadvertently download can also be spyware. Spyware can sometimes seek out your confidential data stored on the machine, gather this information and use it to steal your identity.

Below we are discussing the ways which are very effective in removing adware. The guidance will also assist you to remove ExpressDefault from your MAC system for free.

How does ExpressDefault get on your MAC

Usually, adware gets into MAC computers as part of a bundle with free applications, sharing files and other unsafe apps which users downloaded from the I*nternet. The creators of adware pays software authors for distributing adware within their applications. So, optional apps is often included as part of the installer. In order to avoid the setup of any adware: choose only Manual, Custom or Advanced install option and reject all third-party apps in which you are unsure.

Threat Summary

Name	ExpressDefault
Type	adware software, PUP (potentially unwanted program), Mac malware, Mac virus
Detection Names	Program:MacOS/Vigram.A, Trojan-Downloader.OSX.Adload, Osx.Adware.Cimpli, Adware/Adload!OSX, MacOS.Agent-MT, OSX.Trojan.Gen, ApplicUnwnt and Adware.MAC.Generic
Distribution	Free software installers, fake software updaters, suspicious popup advertisements and torrent downloads
Symptoms	The web-site links redirect to a web-sites different from what you expected, you experience a lot of of unwanted popup windows, your MAC starts automatically installing unexpected programs, unexpected web-browser extensions or toolbars keep coming back, your Mac settings are being modified without your request, slow Internet browsing speeds.
Removal	ExpressDefault removal guide

How to remove ExpressDefault from Mac device

There present several free adware removal tools. Also it is possible to remove ExpressDefault adware manually. But we suggest to combine all these ways below into the one removal algorithm. Follow the steps of the guide. Read it once, after doing so, please bookmark this page (or open it on your smartphone) as you may need to exit your browser or restart your MAC.

To remove ExpressDefault, execute the steps below:

1. Remove unwanted profiles on Mac device
2. Check the list of installed applications
3. Remove ExpressDefault related files and folders
4. Scan your Mac with MalwareBytes
5. Remove ExpressDefault from Safari, Chrome, Firefox
6. How to stay safe online

Remove unwanted profiles on Mac device

ExpressDefault can make changes to the Mac system such as malicious changes to browser settings, and the addition of malicious system profiles. You need to check the system preferences, find and remove malicious profiles and ensure your settings are as you expect.

Click Apple menu ( ) > System Preferences.

In System Preferences, select Profiles. if there is no Profiles in the list of preferences, that means there are no profiles installed on the Mac device. If there is Profiles in the list, then click on it, then select a profile associated with ExpressDefault.

To delete a malicious profile, click on the minus button ( – ) located at the bottom-left of the Profiles screen.

Check the list of installed applications

Go to the Finder and delete dubious software, all programs you do not remember installing. It is important to pay the most attention to programs you have recently installed. If you don’t know what a program does, look for the answer on the World Wide Web.

Open Finder and click “Applications”.

Carefully browse through the list of installed apps and delete all dubious and unknown programs.

Once you have found anything dubious that may be the ExpressDefault adware or other PUP, then right click this program and select “Move to Trash”. Once complete, Empty Trash.

Remove ExpressDefault related files and folders

Now you need to try to find ExpressDefault related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

ExpressDefault creates several files, these files must be found and removed. Below is a list of files associated with this unwanted application.

• /Library/LaunchDaemons/com.ExpressDefault.system.plist
• ~/Library/LaunchAgents/com.ExpressDefault.service.plist
• /Library/Application Support/.(RANDOM)/System/com.ExpressDefault.system
• ~/Library/Application Support/.(RANDOM)/Services/com.ExpressDefault.service.app

Some files created by ExpressDefault are hidden from the user. To find and delete them, you need to enable “show hidden files”. To do this, use the shortcut CMD + SHIFT + . Press once to show hidden files and again to hide them. There is another way. Click Finder -> Applications -> Utilities -> Terminal. In Terminal, paste the following text: defaults write com.apple.finder AppleShowAllFiles YES

Press Enter. Hold the ‘Option/alt’ key, then right click on the Finder icon in the dock and click Relaunch.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for ExpressDefault generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: com.machelper.plist, com.google.defaultsearch.plist, , com.net-preferences.plist, installapp.plist, com.ExpressDefault.service.plist, search.plist and macsearch.plist. Most often, PUPs, browser hijackers and adware create several files with similar names.

Check for ExpressDefault generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folders and files. Check the contents of suspicious folders, if there is a file with a name similar to com.ExpressDefault.system, then this folder must be deleted. Move all suspicious folders and files to the Trash.

Check for ExpressDefault generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for ExpressDefault generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.macsearch.system.plist, com.search.system.plist, com.installapp.system.plist, com.ExpressDefault.system.plist and com.machelper.system.plist. In most cases, browser hijackers, adware software and potentially unwanted programs create several files with similar names.

Scan your Mac with MalwareBytes

If you carefully followed the previous steps, then you should be able to remove ExpressDefault. Of course, very often PUPs, browser hijackers and adware hides on a Mac computer, disguising itself as legitimate apps and files. Therefore, in some cases, it is difficult for an inexperienced user to decide whether a particular file is part of PUPs, browser hijackers and adware. Therefore, we advise you to use MalwareBytes Free to scan the Mac device.

Visit the following page to download the latest version of MalwareBytes for Apple Mac.

After downloading is complete, close all windows on your MAC OS. Further, start the saved file. Follow the prompts.

The MalwareBytes Anti-Malware will automatically start and you can see its main window like below.

Next, click the “Scan Now” button to start scanning your MAC system for the ExpressDefault adware. A system scan can take anywhere from 5 to 30 minutes, depending on your MAC OS. While the MalwareBytes utility is scanning, you may see how many objects it has identified as being infected by malware.

When that process is complete, it will display the Scan Results. Review the report and then press the “Quarantine” button.

The MalwareBytes Free will remove ExpressDefault and move the selected threats to the Quarantine.

Remove ExpressDefault from Safari, Chrome, Firefox

If you have ‘ExpressDefault ‘ removal problem, then remove unwanted extensions can help you. In the steps below we’ll show you the solution to remove malicious plugins without reinstall. This will also allow to get rid of ExpressDefault adware from your web browser.

Google Chrome	Mozilla Firefox
Click on ‘three dots menu’ button at the top right corner of the Chrome window. In the menu go to ‘More tools’, then ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to get rid of ExpressDefault by reset Google Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing problems with ExpressDefault removal, you need to reset Mozilla Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stay safe online

It’s also critical to protect your internet browsers from harmful web sites and advertisements by using an adblocker program such as AdGuard. Security experts says that it’ll greatly reduce the risk of malicious software, and potentially save lots of money. Additionally, the AdGuard may also protect your privacy by blocking almost all trackers.

1. Visit the page linked below to download the latest version of AdGuard for Apple Mac.
   
   

   AdGuard for Mac download
   3687 downloads
   Author: © Adguard
   Category: Security tools
   Update: January 17, 2018
   
2. Once the download is done, launch the downloaded file. You will see the “Setup Wizard” program window. Follow the prompts.
3. When the setup is done, click “Skip” to close the installation program and use the default settings, or press “Get Started” to see an quick tutorial which will assist you get to know AdGuard better.
4. In most cases, the default settings are enough and you don’t need to change anything. Each time, when you start your MAC OS, AdGuard will start automatically and stop annoying advertisements, block harmful and misleading web sites.

To sum up

We suggest that you keep AdGuard (to help you stop unwanted ads and annoying malicious web pages) and MalwareBytes Anti Malware (to periodically scan your MAC for new malware, hijackers and adware software). Make sure that you have all the Critical Updates recommended for Mac operating system. Without regular updates you WILL NOT be protected when new hijackers, malicious software and adware are released.

If you are still having problems while trying to remove ExpressDefault from your web browser, then ask for help here.