Pop-ups and hijacked search on your Mac: remove the adware

Steps

1. 01

   Update macOS, then restart

   • Apple menu›System Settings›General›Software Update, and install whatever is offered (Monterey and earlier:Apple menu›System Preferences›Software Update)
   • Already on the latest version? Restart the Mac anyway

   Why?

   Apple's own advice starts here: macOS carries a built-in tool that removes known malware when the Mac restarts, so updating and restarting clears a lot of this without you hunting for anything.

   Also see: Keep macOS updated the safe way

2. 02

   Look for apps you didn't install

   • Finder›Applications, and read the whole list — Apple's guidance is to look for apps you don't expect
   • Move anything you don't recognise and didn't install to the Trash, or use its own uninstaller if it came with one

   !Careful: Don't delete anything you're unsure about — search the name first. Removing something an app you rely on installed will break that app.

3. 03

   Turn off Safari extensions you didn't add

   • Safari›Settings(Preferences on older macOS) → Extensions tab — turn off or uninstall anything unnecessary
   • A homepage or search engine that won't stay changed is usually an extension changing it back

   ✓You should see: The Extensions list holds only extensions you recognise and chose.

   Also see: Give Safari a proper clean-out

4. 04

   Remove configuration profiles you didn't install

   • macOS 13 or later:Apple menu›System Settings›General›Device Management(macOS 12 or earlier:Apple menu›System Preferences›Profiles)
   • Select any profile you don't recognise, click the remove button (−) below the list, then restart the Mac
   • On macOS 12 or earlier, no Profiles pane at all means no profiles are installed and there's nothing to remove here

   !Careful: On a Mac managed by an employer or a school, the profile belongs there and removing it can cut off mail, Wi-Fi or VPN access — check with them first.

   Why?

   Adware uses a profile to pin a homepage or search engine in place, which is why changing it back in the browser doesn't stick.

5. 05

   Put Safari's own defences back on

   • Safari›Settings(Preferences on older Safari)Websites›Pop-up Windows— set the 'When visiting other websites' menu to Block and Notify, or Block; the three options are Allow, Block and Notify, and Block
   • In the same pane, remove any configured websites set to Allow that you don't trust
   • Safari›Settings›Security tab— turn on the warning for fraudulent websites
   • Set your homepage and search engine back to the ones you want

   ✓You should see: Pop-ups stop appearing, and Safari warns you before it loads a site it knows to be fraudulent.