How to Remove Malware From a Mac for Free
Macs get infected less often than PCs, but they are far from immune. This free, step-by-step guide shows you how to spot browser hijackers, adware, and suspicious launch agents — and remove them by hand without paying for anything.
Yes, Macs Get Malware
The idea that "Macs don't get viruses" is a comforting myth that has cost a lot of people a lot of headaches. macOS has strong built-in protections — Gatekeeper, notarization checks, System Integrity Protection, and the silent, on-device XProtect scanner Apple ships with every Mac — but none of these are perfect. The most common threats on macOS today are not the destructive viruses of PC folklore. They are adware, browser hijackers, and potentially unwanted programs (PUPs) that slip in through fake installers, bundled downloads, and misleading "update your Flash Player" prompts.
These threats rarely announce themselves. Instead they quietly change your browser's homepage, inject ads into pages, redirect your searches to a low-quality engine, or install a background process that phones home and consumes CPU. The good news: because most macOS malware relies on ordinary user-level mechanisms — login items, launch agents, browser extensions — you can usually find and remove it yourself, for free, without specialist tools.
Signs Your Mac Might Be Infected
Malware on macOS tends to show its hand through behaviour rather than obvious warnings. Watch for these symptoms:
- Your browser homepage or default search engine changed on its own. If Safari or Chrome suddenly opens to an unfamiliar search page you never chose, a hijacker is the likely cause.
- Ads appear where they never used to. Pop-ups on the desktop, extra banner ads injected into normal websites, or "your Mac is infected" scare pages are classic adware behaviour.
- Searches get redirected. You type a query, but land on a different search engine or a page full of sponsored links.
- Your Mac runs hot or the fans spin up when idle. A background process pegging the CPU can indicate cryptomining malware or a runaway agent.
- New apps or browser extensions you never installed. Especially "cleaner", "converter", or "media player" apps you don't remember downloading.
- Certificate or profile prompts. Malware sometimes installs a configuration profile to control your browser or network settings.
If you recognise one or more of these, work through the sections below in order. Each targets a different place malware likes to hide.
Step 1: Check Activity Monitor for Suspicious Processes
Activity Monitor is macOS's built-in task viewer, and it is the fastest way to spot a rogue process eating your CPU. Open it from Applications > Utilities > Activity Monitor, or search for it with Spotlight (Command + Space).
-
Open Activity Monitor and click the CPU tab. Then click the "% CPU" column header to sort processes from highest usage to lowest.
-
Look for unfamiliar names. Legitimate system processes have recognisable names (
WindowServer,kernel_task, app names you know). Random strings of letters, misspelled brand names, or generic labels like "MacKeeper" or "helper" deserve scrutiny. -
Search the process name. Before killing anything, search the exact name online. Many suspicious-looking processes are legitimate. Never terminate something just because you don't recognise it — confirm first.
-
Note the offenders. If a process is confirmed malicious, note its exact name. You'll need it to track down the launch agent that keeps restarting it in Step 3.
Killing a process in Activity Monitor is only a temporary fix. Most macOS malware installs a launch agent that relaunches the process automatically, so quitting it does nothing lasting until you remove the underlying agent.
Step 2: Inspect LaunchAgents and LaunchDaemons
This is where the real removal happens. macOS uses small property-list (.plist) files to tell the system which background programs to start automatically. Malware abuses this mechanism to achieve persistence — that is, to survive restarts and reappear even after you delete the app. There are four folders worth checking:
~/Library/LaunchAgents— agents for your user account (no admin needed, most common malware location)./Library/LaunchAgents— agents that run for all users./Library/LaunchDaemons— system-wide background services (require admin rights to install, higher privilege).~/Library/Application Support— where the actual malicious payload files often live.
To open a folder, use Finder's Go > Go to Folder (Command + Shift + G) and paste the path. Inspect each .plist file — you can preview one with the Space bar. A legitimate agent references a well-known company (Google, Microsoft, Adobe, Dropbox). A suspicious one points to a random path in your home folder, an app you never installed, or a program in /tmp or a hidden dot-folder.
.plist can stop a legitimate app or service from working. When in doubt, move the file to a folder on your Desktop rather than deleting it outright, restart, and confirm nothing broke before emptying the Trash. Never delete files in /System/Library — those belong to macOS and are protected for good reason.
When you find a malicious agent, note the program path it references, delete the .plist, then delete the payload it pointed to. Restart your Mac to make sure the process does not come back.
Step 3: Clean Login Items and Configuration Profiles
Two more system settings pages are common hiding spots. Open System Settings > General > Login Items & Extensions. Review both the "Open at Login" list and the "Allow in the Background" list. Toggle off or remove anything you do not recognise or no longer use — many adware families register here.
Next, open System Settings > Privacy & Security and scroll to the bottom. If you see a Profiles section, investigate it carefully. A personal Mac that was never enrolled by an employer or school should generally have no configuration profiles at all. Adware often installs a profile to lock your browser's search settings. Select any unexpected profile and click the minus button to remove it (you'll need your admin password).
Step 4: Remove Malicious Browser Extensions
Browser hijackers almost always install an extension. Check each browser you use:
Safari
Go to Safari > Settings > Extensions. Uninstall any extension you did not deliberately install. Then check Settings > General and Settings > Search to reset your homepage and default search engine back to your preferred choices.
Google Chrome
Open chrome://extensions and remove anything unfamiliar. Then visit Settings > Search engine and Settings > On startup to undo any hijacked defaults. Chrome's Settings > Reset settings option can restore everything to a clean state in one step.
Firefox
Go to about:addons, remove suspect extensions, then use Help > More Troubleshooting Information > Refresh Firefox if the hijacking persists.
After cleaning extensions, quit and reopen each browser. If the hijacker returns, it means a launch agent or profile is reinstalling it — go back to Steps 2 and 3.
Step 5: Let macOS Do Its Part
macOS already includes a malware scanner called XProtect that runs silently in the background and a removal tool (MRT) that Apple updates automatically. You don't launch these manually — they work on their own — but you can help them by keeping your system current. Open System Settings > General > Software Update and install any pending updates, including "background" security updates. Apple pushes new malware signatures through this channel, often within hours of a new threat being identified.
Restart your Mac after cleanup. A restart clears anything a malicious process was holding in memory and confirms that your removals actually stuck.
Where TrimyMac Fits In
TrimyMac is a disk cleaner first and foremost, not a full antivirus suite — and we think it's important to say so plainly. Security Scan lists LaunchAgents and LaunchDaemons for you to review; it does not judge whether they are safe. It does not list Login Items, configuration profiles, or browser extensions. You still decide what to remove, and the checks in this guide for those other places stay manual. The app does not include a usage-analytics SDK, so the file list it shows you is not uploaded. License checks and update checks are separate network calls.
See What's Running on Your Mac
TrimyMac's Security Scan lists LaunchAgents and LaunchDaemons for you to review; it does not judge whether they are safe. Free download for macOS.
Download TrimyMac FreeHow to Avoid Reinfection
Removal is only half the job. To keep malware off your Mac going forward:
- Only install apps from the App Store or the developer's official website. Avoid "download aggregator" sites that wrap installers in bundled junk.
- Never trust a pop-up telling you to update Flash, a codec, or your browser. Adobe Flash has been dead since 2020; any prompt to install it is malware.
- Read installer screens. Bundled adware hides behind pre-ticked "recommended" checkboxes. Untick anything you didn't ask for.
- Keep macOS updated so XProtect has the latest signatures.
- Be skeptical of "cleaner" apps that use scare tactics. Some of the loudest "your Mac is infected!" apps are themselves the problem.
Frequently Asked Questions
Can I remove malware from my Mac for free?
Yes. Most common macOS threats — adware, browser hijackers, and unwanted background agents — can be removed entirely for free using tools already built into macOS. You inspect Activity Monitor for rogue processes, remove malicious launch agents from your Library folders, clean out suspicious login items and configuration profiles, and delete hijacking browser extensions. macOS also runs its own free, built-in scanner (XProtect) automatically. You do not need to buy antivirus software to handle the everyday threats that affect most Mac users.
How do I check my Mac for malware?
Start with Activity Monitor and sort processes by CPU usage to spot anything unfamiliar consuming resources. Then check ~/Library/LaunchAgents, /Library/LaunchAgents, /Library/LaunchDaemons, and ~/Library/Application Support for property-list files pointing to programs you never installed. Review System Settings for unexpected login items and configuration profiles, and check each browser's extensions list. TrimyMac's Security Scan can list LaunchAgents and LaunchDaemons from a storage scan for you to review. The other checks in this answer stay manual.
Does my Mac already have antivirus built in?
Yes. Every Mac ships with XProtect, an on-device malware scanner that checks apps against a signature list Apple maintains, and a removal tool that runs automatically in the background. Combined with Gatekeeper (which blocks unsigned, un-notarized apps by default) and System Integrity Protection (which prevents modification of core system files), macOS has meaningful protection out of the box. Keeping your system updated ensures these defences have the newest threat signatures. For most users, these built-in tools plus careful browsing habits are the core of Mac security.
What is a launch agent and why does malware use it?
A launch agent is a small property-list (.plist) file that tells macOS to start a program automatically — at login or in the background. It is a completely legitimate mechanism used by apps like Dropbox and Google Drive to keep their helpers running. Malware abuses it to achieve persistence: by installing its own launch agent, the malicious process relaunches itself every time you restart, even if you delete the visible app. That is why simply dragging an app to the Trash often isn't enough — you also have to remove its launch agent from ~/Library/LaunchAgents or the system-level equivalents.
Is TrimyMac an antivirus program?
No, and we're upfront about that. TrimyMac is a native macOS disk cleaner. Security Scan lists LaunchAgents and LaunchDaemons for you to review; it does not judge whether they are safe, and it does not remove threats the way a dedicated antivirus suite does. Login Items, configuration profiles, and browser extensions are not part of that scan. For advanced or targeted threats, use a dedicated security tool or consult a professional.