How to uninstall RotatorBox app/extension from Mac

What is RotatorBox

According to security specialists, RotatorBox is an adware program. Most commonly, this adware installs on Mac in a bundle with fake Java or Flash Player Updates, free applications that you downloaded and installed from the Internet. Once RotatorBox gets inside your computer, it will configure itself to start automatically when your Mac boot. It can alter internet browser settings, redirect your web browser to unwanted websites, display pop-up ads from various third-party ad networks and these unwanted advertisements is hard to shut down.

Another reason why you need to delete RotatorBox is its online data-tracking activity. It can monetize its functionality by collecting privacy data from your browsing sessions. This user data, afterwards, can be easily sold to third party companies. This puts your confidential data at a security risk. If you want to remove RotatorBox adware, you will not succeed, because it is very stubborn. Using the following steps, you surely can remove this adware completely from your MAC OS.

How does RotatorBox get on your Apple Mac

Most of unwanted ads and pop-ups come from web browser toolbars and/or extensions, BHOs (browser helper objects) and additional software. In many cases, these items claim itself as apps that improve your experience on the Internet by providing a fast and interactive start page or a search provider that does not track you. Remember, how to avoid the unwanted apps. Be cautious, run only reputable software which download from reputable sources. NEVER install any unknown and questionable apps.

Threat Summary

Name	RotatorBox, RotatorBox 1.0 app
Type	adware, PUP (potentially unwanted program), Mac virus, Mac malware
Detection Names	Trojan-Downloader.OSX.Adload, Osx.Adware.Cimpli, Adware.MAC.Generic, Adware/Adload!OSX, OSX.Trojan.Gen, MacOS.Agent-MT, Program:MacOS/Vigram.A and ApplicUnwnt
Distribution	Freeware installers, fake software updaters, torrent downloads and dubious pop-up advertisements
Symptoms	Every time you perform an Internet search, your web browser is redirected to another web page, you experience a lot of of unwanted pop up advertisements, new entries appear in your Applications folder, an unexpected toolbar appears in your internet browser, your browser startpage has modified and you cannot modify it back, speed test good but internet slow.
Removal	RotatorBox removal guide

How to remove RotatorBox from Mac

As with uninstalling adware, malware or PUPs, there are few steps you may do. We advise trying them all. If you do only one part of the instructions, then it should be run malicious software removal utility, because it should delete adware software and block any further infection. But to completely remove RotatorBox adware you will have to at least reset your browser settings to default state, uninstall all unwanted and suspicious programs, and get rid of adware with malware removal utilities. Read it once, after doing so, please bookmark this page (or open it on your smartphone) as you may need to close your web browser or restart your MAC system.

To remove RotatorBox, use the following steps:

1. Remove unwanted profiles on Mac device
2. Delete RotatorBox related apps through the Finder
3. Remove RotatorBox related files and folders
4. Scan your Mac with MalwareBytes
5. Remove RotatorBox from Safari, Chrome, Firefox
6. How to stay safe online

Remove unwanted profiles on Mac device

RotatorBox can make changes to the Mac system such as malicious changes to browser settings, and the addition of malicious system profiles. You need to check the system preferences, find and remove malicious profiles and ensure your settings are as you expect.

Click the System Preferences icon ( ) in the Dock, or choose Apple menu ( ) > System Preferences.

In System Preferences, click Profiles, then select a profile associated with RotatorBox.

Click the minus button ( – ) located at the bottom-left of the Profiles screen to remove the profile.
Note: if you do not see Profiles in the System Preferences, that means there are no profiles installed on your Mac, which is normal.

Delete RotatorBox related apps through the Finder

It’s of primary importance to identify and get rid of PUPs, browser hijackers and adware through ‘Applications’ section of your Finder.

Open Finder and click “Applications”.

Very carefully look around the entire list of programs installed on your Apple Mac. Most probably, one of them is the RotatorBox adware. Once you have found a suspicious, unwanted or unused program, right click to it and choose “Move to Trash”. Another method is drag the program from the Applications folder to the Trash.

Don’t forget, select Finder -> “Empty Trash”.

Remove RotatorBox related files and folders

Now you need to try to find RotatorBox related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

RotatorBox creates several files, these files must be found and removed. Below is a list of files associated with this unwanted program.

• /Library/LaunchDaemons/com.RotatorBox.system.plist
• ~/Library/LaunchAgents/com.RotatorBox.service.plist
• /Library/Application Support/.(RANDOM)/System/com.RotatorBox.system
• ~/Library/Application Support/.(RANDOM)/Services/com.RotatorBox.service.app

Some files created by RotatorBox are hidden from the user. To find and delete them, you need to enable “show hidden files”. To do this, use the shortcut CMD + SHIFT + . Press once to show hidden files and again to hide them. There is another way. Click Finder -> Applications -> Utilities -> Terminal. In Terminal, paste the following text: defaults write com.apple.finder AppleShowAllFiles YES

Press Enter. Hold the ‘Option/alt’ key, then right click on the Finder icon in the dock and click Relaunch.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for RotatorBox generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: installapp.plist, com.machelper.plist, com.google.defaultsearch.plist, , macsearch.plist, search.plist, com.RotatorBox.service.plist and com.net-preferences.plist. Most often, adware, PUPs and browser hijackers create several files with similar names.

Check for RotatorBox generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folders and files. Check the contents of suspicious folders, if there is a file with a name similar to com.RotatorBox.system, then this folder must be deleted. Move all suspicious folders and files to the Trash.

Check for RotatorBox generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for RotatorBox generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.search.system.plist, com.installapp.system.plist, com.macsearch.system.plist, com.RotatorBox.system.plist and com.machelper.system.plist. In most cases, PUPs, browser hijackers and adware create several files with similar names.

Scan your Mac with MalwareBytes

We recommend using MalwareBytes Free. You may download and install MalwareBytes Anti Malware to detect and remove RotatorBox associated software from your Mac device. When installed and updated, the malicious software remover automatically detects and removes all security threats present on the machine.

Visit the following page to download the latest version of MalwareBytes for Mac.

When downloading is finished, close all applications and windows on your machine. Run the saved file. Follow the prompts.

The MalwareBytes will automatically start and you can see its main screen as on the image below.

Now click the “Scan” button . MalwareBytes tool will start scanning the whole machine to find out RotatorBox adware. This process can take some time, so please be patient. While the MalwareBytes Anti Malware is checking, you can see number of objects it has identified either as being malware.

Once the scanning is finished, MalwareBytes Anti-Malware (MBAM) will display a list of all items detected by the scan. Make sure to check mark the threats that are unsafe and then click the “Quarantine” button. The MalwareBytes Free will get rid of RotatorBox adware software and move the selected items to the program’s quarantine.

Remove RotatorBox from Safari, Chrome, Firefox

Remove unwanted extensions is a easy way to get rid of RotatorBox adware software and revert back web browser’s settings which have been modified by adware.

Google Chrome	Mozilla Firefox
In the top-right corner, expand the Chrome menu. In the menu go to ‘More tools’, then ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to delete RotatorBox adware by reset Google Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing issues with RotatorBox removal, you need to reset Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stay safe online

The AdGuard is a very good ad blocking application for the Safari, Chrome and Mozilla Firefox, with active user support. It does a great job by removing certain types of unwanted advertisements, popunders, popups, undesired newtab pages, and even full page advertisements and web site overlay layers. Of course, the AdGuard can stop malicious web-sites automatically or by using a custom filter rule.

1. Download AdGuard from the link below.
   
   

   AdGuard for Mac download
   3677 downloads
   Author: © Adguard
   Category: Security tools
   Update: January 17, 2018
   
2. When the download is finished, run the downloaded file. You will see the “Setup Wizard” program window. Follow the prompts.
3. After the installation is complete, click “Skip” to close the installation application and use the default settings, or click “Get Started” to see an quick tutorial that will help you get to know AdGuard better.
4. In most cases, the default settings are enough and you don’t need to change anything. Each time, when you start your machine, AdGuard will run automatically and stop unwanted advertisements, block harmful and misleading webpages.

To sum up

Now your MAC OS should be free of the RotatorBox adware. We suggest that you keep AdGuard (to help you stop unwanted pop-up ads and undesired harmful websites) and MalwareBytes Free (to periodically scan your computer for new adwares and other malware).

If you are still having problems while trying to remove adware software from the Safari, Chrome and Firefox, then ask for help here here.