Remove adware and browser hijackers on Mac

What is adware?

Adware is software that shows you ads or steers your searches without asking. It rarely damages files. Instead it takes over your browser, so someone else earns money every time you search or click, and it usually sees every search you make and every site you visit.

It comes bundled with free downloads, fake "Flash Player" or video player updates, cracked apps and the download buttons on piracy sites. The installer asks for your password once, and that is all it needs to change your Mac's settings.

Signs you might have it

• Your searches pass through a site you don't know before showing results, often ending up on Yahoo or Bing.
• Your home page or new tab page changed, and changes back after you fix it.
• Chrome or Edge says "Managed by your organisation" on a Mac nobody manages.
• Extra ads, pop-ups or new tabs appear on sites that never had them.
• An extension you never installed, which you can't remove.

Why the antivirus doesn't find it

An antivirus compares files with known malware. Mac adware often leaves no harmful file behind. It changes settings that macOS and the browsers offer so companies can manage their Macs: a management profile, a browser policy, a proxy. Those settings are legitimate on their own, so no scanner flags them. What matters is who set them, and why. That is what the Adware page checks.

What the Adware page checks

Each finding is rated High, Medium or for information, and says what the setting is, what it does on your Mac, why adware uses it, and when it is harmless. The check takes well under a second and runs as part of every Smart Scan.

Fix it, with a confirmation first

Every fix says exactly what will change before it runs, and most ask for your administrator password, because adware set them with it too.

• Remove Profile removes the profile and every setting it forces. If macOS won't let it go, System Settings › Profiles opens instead.
• Remove Policies deletes the forced browser settings, and the browser picks its own defaults again the next time it starts.
• Turn Off Proxy turns off the web, secure web, SOCKS and automatic proxy on every network connection.
• Remove Lines takes the chosen lines out of /etc/hosts. A copy of the file is kept next to it first, then the DNS cache is flushed.

After each fix the check runs again, so the page shows what is actually left.

Adware usually brings more than one thing. After a fix, also look through Browser Extensions, Startup Items and Background Services for things you don't recognise, uninstall the app that brought it in, and restart your browser.

Work Macs are told apart

If your Mac is enrolled in an organisation's device management, profiles, browser policies and proxies are normal. Tidy My Mac shows them as information, with "your organisation set this up" wording, and suggests you ask your IT team before changing anything. Tidy My Mac's own Web Protection is never reported either.

What stays on your Mac

The check reads settings on your Mac and nothing it finds is sent anywhere. The Privacy Policy lists every request the app makes.