How to remove AppWinner from Mac (Virus removal guide)

What is AppWinner?

AppWinner is an Adware application that targets Mac platform. Adware is something which you should be aware of even if you use Safari, Google Chrome or other modern web browser. This is the name given to malicious software that have been designed to display unwanted advertisements and pop-up deals onto the browser screen. Adware generates easy revenue for cybercriminals – via purchases of advertised products, or indirectly via the sale of collected user data.

AppWinner app (extension) is an malicious application (adware) designed to display ads and redirect users to phishing sites

AppWinner adware in detail

AppWinner is a malicious application that displays unwanted ads (pop-ups, various offers and deals, unclosable windows, push notifications, and even fake virus alerts) on computers or changes search results in browsers to earn money for their creators from user clicks.

AppWinner app/extension can change the browser’s homepage and the default search engine, can inject fake results into search pages and can also inject malicious ads into legitimate websites or trigger unclosable pop-up windows in the browser. The goal of its creators is to earn commission money fraudulently by abusing pay-per-view or pay-per-clickadvertising schemes.

Attackers often use adware to redirect users to pornographic content, various diet pills, fake virus alerts that trick users to buy or install applications that are not needed, work-at-home schemes and other questionable content. Below are some examples of such sites:

Adobe Flash Player is out of date POP-UP

How does AppWinner get on your computer

A common way for attackers to install adware apps on Mac computers is through file sharing websites and torrents by masquerading as program installers, hacked software and key generators for commercial games and programs. Malicious ads are also used to push adware apps.

Sometimes it is possible to avoid the setup of any adware: run only reputable software which download from reputable sources, never install any unknown and suspicious apps, keep internet browser updated (turn on automatic updates), use good antivirus software, double check freeware before install it (do a google search, scan a downloaded file with VirusTotal), avoid malicious and unknown web pages.

The pop-up window that appears after the installation of the AppWinner adware is complete:

Threat Summary

Name	AppWinner, “AppWinner 1.0”
Type	adware, PUP (potentially unwanted program), Mac malware, Mac virus
Detection Names	Adware.MAC.Generic, OSX.Trojan.Gen, Program:MacOS/Vigram.A, ApplicUnwnt, Adware/Adload!OSX, Osx.Adware.Cimpli, Trojan-Downloader.OSX.Adload and MacOS.Agent-MT
Distribution	Freeware installers, fake update tools, misleading pop up advertisements and torrent downloads
Symptoms	Every time you perform an Internet search, your web-browser is redirected to another web-page, unclosable window appear and recommend fake Flash updates, your MAC OS starts automatically installing unwanted software, unwanted web-browser toolbars, your internet browser startpage has changed and you cannot change it back, slow Internet browsing speeds.
Removal	AppWinner removal guide

How can you protect against adware?

There are a number of methods that you can use to protect against malicious adware. It is better to use them together, this will provide stronger protection.

Use an ad blocker. Ad blockers allow you to browse sites without ads, thus eliminating the possibility of clicking on something malicious and preventing it from being downloaded to the machine.
Pay for premium versions of popular services. The easiest way to avoid adware is to pay for the service you use. Many Internet services make it possible to use them without ads if you purchase a premium subscription. This helps ensure that malicious adware cannot reach you.
Buy devices from trusted companies with built-in security. There have already been many cases where people who bought inexpensive Android devices found that adware was already installed on their devices. Cheap Android devices do not receive security updates and are therefore particularly susceptible to infection and should be avoided.
Use an antivirus. Most antivirus programs can block malicious adware. Some malicious adware can block antiviruses, in which case a more aggressive method should be used, which is to use adware removal software. This software can detect and remove adware that has a negative impact on the device.

How to remove AppWinner from Mac

There are several free adware removal tools available. It is also possible to remove the AppWinner adware manually. But we recommend combining these methods into one removal algorithm. Some steps will require you to restart your computer or close this web page. So, read this instruction carefully, then bookmark this page or open it on your smartphone for future reference.

To remove AppWinner, complete the following steps:

Remove unwanted profiles on Mac device
Delete AppWinner associated software by using the Finder
Remove AppWinner related files and folders
Scan your Mac with MalwareBytes
Remove AppWinner from Safari, Chrome, Firefox
How to stay safe online

Remove unwanted profiles on Mac device

AppWinner can install a configuration profile on the Mac system to block changes made to the browser settings. Therefore, you need to open system preferences, find and delete the profile installed by the adware.

Click the System Preferences icon ( ) in the Dock, or choose Apple menu ( ) > System Preferences.

In System Preferences, click Profiles, then select a profile related to AppWinner.

Click the minus button ( – ) located at the bottom-left of the Profiles screen to remove the profile.
Note: if you do not see Profiles in the System Preferences, that means there are no profiles installed on your Mac, which is normal.

Delete AppWinner associated software by using the Finder

In order to get rid of PUPs, adware software and browser hijackers, open the Finder and click on “Applications”. Check the list of installed apps. For the ones you do not know, run an Internet search to see if they are adware software, browser hijackers and potentially unwanted programs. If yes, delete them off. Even if they are just a applications which you do not use, then deleting them off will increase your MAC OS start up time and speed dramatically.

Open Finder and click “Applications” as shown below.

You will see a list of software installed on your MAC. We recommend to pay maximum attention to the application you installed last. Most likely, it is the AppWinner . If you are in doubt, you can always check the program by doing a search for her name in Google, Yahoo or Bing.

Once the program which you need to uninstall is found, simply right click on its name, and choose “Move to Trash”.

Don’t forget, select Finder, then “Empty Trash”.

Remove AppWinner related files and folders

Now you need to try to find AppWinner related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

AppWinner creates several files, these files must be found and removed. Below is a list of files associated with this unwanted application.

/Library/LaunchDaemons/com.AppWinner.system.plist
~/Library/LaunchAgents/com.AppWinner.service.plist
/Library/Application Support/.(RANDOM)/System/com.AppWinner.system
~/Library/Application Support/.(RANDOM)/Services/com.AppWinner.service.app

Some files created by AppWinner are hidden from the user. To find and delete them, you need to enable “show hidden files”. To do this, use the shortcut CMD + SHIFT + . Press once to show hidden files and again to hide them. There is another way. Click Finder -> Applications -> Utilities -> Terminal. In Terminal, paste the following text: defaults write com.apple.finder AppleShowAllFiles YES

Press Enter. Hold the ‘Option/alt’ key, then right click on the Finder icon in the dock and click Relaunch.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for AppWinner generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: com.AppWinner.service.plist, macsearch.plist, com.google.defaultsearch.plist, , installapp.plist, search.plist, com.net-preferences.plist and com.machelper.plist. Most often, adware, browser hijackers and PUPs create several files with similar names.

Check for AppWinner generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folders and files. Check the contents of suspicious folders, if there is a file with a name similar to com.AppWinner.system, then this folder must be deleted. Move all suspicious folders and files to the Trash.

Check for AppWinner generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for AppWinner generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.macsearch.system.plist, com.installapp.system.plist, com.machelper.system.plist, com.search.system.plist and com.AppWinner.system.plist. In most cases, adware, potentially unwanted programs and browser hijackers create several files with similar names.

Scan your Mac with MalwareBytes

We suggest using MalwareBytes Anti-Malware to scan the Apple computer for potentially unwanted programs, browser hijackers and adware. This free tool is an advanced malicious software removal program developed by (c) Malwarebytes lab. This program uses the world’s most popular anti-malware technology. It’s able to help you get rid of potentially unwanted software and other security threats from your Apple computer for free.

Installing the MalwareBytes Anti-Malware is simple. First you will need to download MalwareBytes on your MAC OS from the following link.

Malwarebytes Anti-malware (Mac)
20851 downloads
Author: Malwarebytes
Category: Security tools
Update: September 10, 2020
Once the download is complete, close all apps and windows on your MAC OS. Open a folder in which you saved it. Run the downloaded file and follow the prompts.
Click the “Scan” button for scanning your machine for the AppWinner . This task can take quite a while, so please be patient. While the MalwareBytes Anti-Malware is scanning, you can see number of objects it has identified either as being malicious software.
Once the checking is complete, MalwareBytes AntiMalware will prepare a list of unwanted programs and adware. Review the report and then click “Quarantine”.

Remove AppWinner from Safari, Chrome, Firefox

This step will show you how to get rid of harmful extensions. This can get rid of AppWinner adware and fix some surfing issues, especially after adware infection.

Google Chrome	Mozilla Firefox
Click on ‘three dots menu’ button at the top right corner of the Google Chrome window. Select ‘More tools’, then ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to remove AppWinner by reset Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing problems with AppWinner adware software removal, you need to reset Mozilla Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

Google Chrome

Mozilla Firefox

Click on ‘three dots menu’ button at the top right corner of the Google Chrome window.
Select ‘More tools’, then ‘Extensions’.
Click ‘Remove’ to uninstall an extension.
Click ‘Remove’ in the dialog box.

You can also try to remove AppWinner by reset Chrome settings.

Click on ‘menu’ button and select ‘Add-ons’.
Go to ‘Extensions’ tab.
To uninstall an add-on, click on ‘Remove’ button next to it.

If you are still experiencing problems with AppWinner adware software removal, you need to reset Mozilla Firefox browser.

Safari

On the top menu select ‘Safari’, then ‘Preferences’.
Select ‘Extensions’ tab.
Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stay safe online

One of the worst things is the fact that you cannot stop all malicious web sites using only built-in MacOS capabilities. However, there is an application out that you can use to stop intrusive browser redirects, malicious advertisements and scam pop-ups in any modern web-browsers including Chrome, Firefox and Safari. It’s named Adguard and it works very well.

Visit the following page to download AdGuard.

After the download is complete, run the downloaded file. The “Setup Wizard” window will show up on the computer screen.

Follow the prompts. AdGuard will then be installed. A window will show up asking you to confirm that you want to see a quick guide. Click “Skip” button to close the window and use the default settings, or press “Get Started” to see an quick instructions that will assist you get to know AdGuard better.

Each time, when you start your Apple Mac, AdGuard will launch automatically and stop intrusive pop up advertisements, block malicious and misleading web sites.

To sum up

Once you have removed the AppWinner adware using the step-by-step instructions, Google Chrome, Safari and Firefox will no longer display any unwanted ads. Unfortunately, if the steps does not help you, then you have caught a new adware software, and then the best way – ask for help here.