How to uninstall CloudMensis app/extension from Mac (Virus removal guide)

What is CloudMensis

CloudMensis is an adware application that targets Apple computers. This malicious software can affect the Mac in very different ways. For example, it can display unwanted ads and pop-ups in your internet browser, redirect your searches to scam websites, cause browser crashes and slow loading of web pages. Adware is often installed on Mac computers with malicious downloads, fake updates, and free software.

The worst thing is that adware can collect a lot of information about you (your IP address, what website you are currently browsing, what you are looking for on the World Wide Web, what links you are clicking) which can then be shared with third parties.

Attackers often use adware to redirect users to malicious and scam websites. Below are some examples of such sites:

Therefore, it is very important to follow the instructions below without delay. This step by step guide will help you remove CloudMensis and also get rid of unwanted ads. Moreover, this guide will help you remove malicious applications such as unwanted toolbars and browser hijackers that may be installed on your computer along with adware.

How does CloudMensis get on your MAC

Most often, adware is bundled within installation packages from file sharing and torrent sites. Thus, downloading software from such sources is a good chance to find a bundled adware. If you do not know how to avoid this, then use a simple trick. During installation, select Custom or Advanced installation. Then click the Decline button and uncheck any offers that ask you to install additional apps. Also, please read the Terms of Use and User Agreement carefully before installing any new software.

The pop-up window that can appear after the installation of the CloudMensis adware is complete:

Threat Summary

Name	CloudMensis, “CloudMensis 1.0”
Type	adware, potentially unwanted application (PUA), Mac virus, Mac malware
Detection Names	OSX.Trojan.Gen, MacOS.Agent-MT, Adware.MAC.Generic, Osx.Adware.Cimpli, Program:MacOS/Vigram.A, Adware/Adload!OSX, Trojan-Downloader.OSX.Adload and ApplicUnwnt
Distribution	Freeware installers, torrent downloads, fake updaters and malicious popup ads
Symptoms	The web page links redirect to a web pages different from what you expected, advertising pop-ups won’t go away, new entries appear in your Applications folder, unwanted web-browser toolbars, your web-browser start page has replaced and you are unable to modify it back, speed test good but internet slow.
Removal	CloudMensis removal guide

How to remove CloudMensis adware

To remove CloudMensis adware from your computer, you must remove suspicious applications and all components that may be associated with adware. In addition, to fix your web browser homepage, search provider, and new tab page, you must reset hijacked internet browsers. Once you have completed the adware removal procedure, we recommend that you scan your MAC with the malware removal utilities listed below. This will complete the uninstall process on your Mac.

To remove CloudMensis, follow the steps below:

1. Remove profiles created by CloudMensis
2. Uninstall CloudMensis associated software by using the Finder
3. Remove CloudMensis related files and folders
4. Scan your Mac with MalwareBytes
5. Remove CloudMensis from Safari, Chrome, Firefox
6. How to stay safe online

Remove profiles created by CloudMensis

CloudMensis can install a configuration profile on the Mac system to block changes made to the browser settings. Therefore, you need to open system preferences, find and delete the profile installed by the adware.

Click Apple menu ( ) > System Preferences.

In System Preferences, select Profiles. if there is no Profiles in the list of preferences, that means there are no profiles installed on the Mac. If there is Profiles in the list, then click on it, then select a profile related to CloudMensis.

To delete a malicious profile, click on the minus button ( – ) located at the bottom-left of the Profiles screen.

Uninstall CloudMensis associated software by using the Finder

Some browser hijackers, PUPs and adware can be removed by uninstalling the free applications they came with. If this way does not succeed, then looking them up in the list of installed applications in the Finder. Use the “Move to Trash” command in order to get rid of them.

Make sure you have closed all web browsers and other software. Next, remove any unwanted and suspicious apps from MAC OS using the Finder.

Open Finder and click “Applications”.

Look around the entire list of apps installed on your computer. Most likely, one of them is the CloudMensis . Choose the questionable program or the program that name is not familiar to you and remove it.

Drag the suspicious application from the Applications folder to the Trash.

Most important, don’t forget, choose Finder -> Empty Trash.

Remove CloudMensis related files and folders

Now you need to try to find CloudMensis related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

CloudMensis creates several files, these files must be found and removed. Below is a list of files associated with this unwanted application.

• /Library/LaunchDaemons/com.CloudMensis.system.plist
• ~/Library/LaunchAgents/com.CloudMensis.service.plist
• /Library/Application Support/.(RANDOM)/System/com.CloudMensis.system
• ~/Library/Application Support/.(RANDOM)/Services/com.CloudMensis.service.app

Some files created by CloudMensis are hidden from the user. To find and delete them, you need to enable “show hidden files”. To do this, use the shortcut CMD + SHIFT + . Press once to show hidden files and again to hide them. There is another way. Click Finder -> Applications -> Utilities -> Terminal. In Terminal, paste the following text: defaults write com.apple.finder AppleShowAllFiles YES

Press Enter. Hold the ‘Option/alt’ key, then right click on the Finder icon in the dock and click Relaunch.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for CloudMensis generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: macsearch.plist, com.CloudMensis.service.plist, com.machelper.plist, installapp.plist, com.net-preferences.plist, search.plist and com.google.defaultsearch.plist, . Most often, PUPs, browser hijackers and adware create several files with similar names.

Check for CloudMensis generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folders and files. Check the contents of suspicious folders, if there is a file with a name similar to com.CloudMensis.system, then this folder must be deleted. Move all suspicious folders and files to the Trash.

Check for CloudMensis generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for CloudMensis generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.installapp.system.plist, com.CloudMensis.system.plist, com.macsearch.system.plist, com.search.system.plist and com.machelper.system.plist. In most cases, browser hijackers, adware software and potentially unwanted programs create several files with similar names.

Scan your Mac with MalwareBytes

You can remove CloudMensis associated files automatically through the use of MalwareBytes Anti-Malware. We recommend this free malware removal tool because it can easily remove potentially unwanted programs, toolbars, browser hijackers and adware with all their components such as files, folders and system entries.

Visit the following page to download the latest version of MalwareBytes Anti-Malware for Mac OS.

When the downloading process is done, close all applications and windows on your MAC system. Run the saved file. Follow the prompts.

The MalwareBytes Anti-Malware will automatically start and you can see its main screen as on the image below.

Now click the “Scan” button to perform a system scan with this utility for the CloudMensis adware. This procedure can take some time, so please be patient. While the utility is checking, you can see number of objects and files has already scanned.

When MalwareBytes is finished scanning your Apple Mac, MalwareBytes Anti-Malware will open a list of detected items. Review the results once the tool has finished the system scan. If you think an entry should not be quarantined, then uncheck it. Otherwise, simply click the “Quarantine” button. The MalwareBytes AntiMalware will begin to get rid of CloudMensis .

Remove CloudMensis from Safari, Chrome, Firefox

This step will show you how to remove harmful plugins. This can remove CloudMensis adware and fix some browsing problems, especially after adware software infection.

Google Chrome	Mozilla Firefox
In the top right hand corner, click on ‘three vertical dots’, and this will open up the main menu on Chrome. Select ‘More tools’, then ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to get rid of CloudMensis adware by reset Google Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing issues with CloudMensis removal, you need to reset Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stay safe online

It’s also critical to protect your web-browsers from harmful websites and ads by using an ad-blocking application like AdGuard. Security experts says that it’ll greatly reduce the risk of malicious software, and potentially save lots of money. Additionally, the AdGuard can also protect your privacy by blocking almost all trackers.

1. Download AdGuard by clicking on the link below.
   
   

   AdGuard for Mac download
   3771 downloads
   Author: © Adguard
   Category: Security tools
   Update: January 17, 2018
   
2. When the download is done, start the downloaded file. You will see the “Setup Wizard” program window. Follow the prompts.
3. Once the setup is complete, click “Skip” to close the installation program and use the default settings, or click “Get Started” to see an quick tutorial that will assist you get to know AdGuard better.
4. In most cases, the default settings are enough and you don’t need to change anything. Each time, when you launch your MAC OS, AdGuard will launch automatically and stop unwanted advertisements, block malicious and misleading websites.

Finish words

We suggest that you keep MalwareBytes Anti-Malware (to periodically scan your computer for new adware softwares and other malicious software) and AdGuard (to help you block intrusive advertisements and harmful web-sites). Moreover, to prevent any adware software, please stay clear of unknown and third party applications.

If you need more help with CloudMensis related issues, go to here.