How to check a Mac for adware and malware

Updated November 4, 2026

Real Mac viruses are rare. What people do run into is adware: a browser that keeps opening a strange search page, pop-ups, a "cleaner" nobody installed. It usually came with a download and starts again every time you log in.

The short answer: look at what starts by itself. Check System Settings › General › Login Items & Extensions, then the folders ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons. Adware hides there under random or Apple-like names. Then check your browser extensions and configuration profiles. macOS's own XProtect already blocks known malware files.

Where does Mac adware hide?

• Launch agents and daemons: small .plist files that tell macOS to start a program at login or at startup. Yours are in ~/Library/LaunchAgents; the whole Mac's in /Library/LaunchAgents and /Library/LaunchDaemons.
• Applications: an app you don't remember installing, often with a generic name.
• Browser extensions: Safari › Settings › Extensions, and each other browser's extensions page.
• Configuration profiles: System Settings › General › Device Management. On a Mac nobody manages for you, this list is usually empty.

How do I list launch agents in Terminal?

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

For any file you don't recognise, see which program it starts, then who signed that program:

plutil -p ~/Library/LaunchAgents/com.example.helper.plist
codesign -dv --verbose=2 "/path/to/the/program"

The Program or ProgramArguments line is the program. In codesign's output, the Authority lines name the developer; "code object is not signed at all" means nobody did.

What looks suspicious?

• A program no known developer signed, which no installed app claims.
• A program in a hidden folder, in /tmp, or in /Users/Shared, which every user can write to.
• A random-looking name, like com.xkqzt.plist.
• A com.apple name on a program Apple didn't sign.

Each of these is a reason to look closer, not proof: small developers' helpers can look the same. Search the name before removing anything.

How do I remove adware from a Mac?

1. Quit the app it belongs to, if there is one, and move the app to the Trash.
2. Move its .plist from LaunchAgents or LaunchDaemons to the Trash. The ones in /Library ask for an administrator password.
3. Move the program the .plist pointed to to the Trash as well.
4. Restart, or log out and back in, so it stops running. Remove any browser extension and profile it added.

Is XProtect enough, or do I need an antivirus?

macOS checks downloads with Gatekeeper and notarization, and XProtect blocks and removes known malware using signatures Apple updates on its own. That covers most people. To see your XProtect version:

defaults read /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist CFBundleShortVersionString

Adware is often installed with your permission, as part of something else, so checking what starts on its own now and then is still worth it.