How to uninstall CapitalSearchCharacter app/extension from Mac (Virus removal guide)

What is CapitalSearchCharacter

CapitalSearchCharacter is a malicious application that falls under the category of Adware. Adware is a part of software designed to throw ads up on your browser screen. Adware generates revenue for its creator by automatically showing a huge count of advertisements and pop up deals. You might experience a change in your homepage or search engine, new tabs opening or even a redirect to misleading webpages.

Another reason why you need to remove the CapitalSearchCharacter adware is its online data-tracking activity. It can collect your Internet browsing activity by recording URLs visited, IP addresses, web-browser version and type, cookie information, Internet Service Provider (ISP) and web-pages visited. Such kind of behavior can lead to serious security problems or user data theft. This is another reason why the adware should be removed as soon as possible.

We suggest to remove CapitalSearchCharacter adware, as soon as you found this problem, as it can redirect your browser to web-resources that may load other unwanted programs on your MAC.

How does CapitalSearchCharacter get on your MAC system

These days certain free software creators bundle PUPs or adware with a view to making some money. These are not free programs as install an unwanted applications on to your MAC. So whenever you install free applications that downloaded from the World Wide Web, be very careful during setup. Carefully read the EULA (a text with I ACCEPT/I DECLINE button), select custom or manual install option, disable all third-party apps.

Threat Summary

Name	CapitalSearchCharacter, “CapitalSearchCharacter 1.0 app”
Type	adware, PUP (potentially unwanted program), Mac malware, Mac virus
Detection Names	Trojan-Downloader.OSX.Adload, OSX.Trojan.Gen, MacOS.Agent-MT, Adware.MAC.Generic, Program:MacOS/Vigram.A, Osx.Adware.Cimpli, ApplicUnwnt and Adware/Adload!OSX
Distribution	Free software installers, torrent downloads, fake updaters and shady popup ads
Symptoms	You keep getting redirected to dubious web pages, web-browser pop-ups appear and recommend fake updates and other unwanted applications, unexpected program installed without your consent, unexpected web-browser addons or toolbars keep coming back, unwanted changes in your internet browser such as using a new default search engine, speed test good but internet slow.
Removal	CapitalSearchCharacter removal guide

How to Remove CapitalSearchCharacter (removal steps)

If you have consistent pop-ups or undesired ads, slow machine, freezing MAC issues, you are in need of adware removal assistance. The step-by-step instructions below will guide you forward to get CapitalSearchCharacter adware removed and will help you get your computer operating at peak capacity again.

To remove CapitalSearchCharacter, complete the following steps:

1. Remove unwanted profiles on Mac device
2. Delete CapitalSearchCharacter associated software by using the Finder
3. Remove CapitalSearchCharacter related files and folders
4. Scan your Mac with MalwareBytes
5. Remove CapitalSearchCharacter from Safari, Chrome, Firefox
6. How to stay safe online

Remove unwanted profiles on Mac device

CapitalSearchCharacter can make changes to the Mac system such as malicious changes to browser settings, and the addition of malicious system profiles. You need to check the system preferences, find and remove malicious profiles and ensure your settings are as you expect.

Click the System Preferences icon ( ) in the Dock, or choose Apple menu ( ) > System Preferences.

In System Preferences, click Profiles, then select a profile related to CapitalSearchCharacter.

Click the minus button ( – ) located at the bottom-left of the Profiles screen to remove the profile.
Note: if you do not see Profiles in the System Preferences, that means there are no profiles installed on your Mac device, which is normal.

Delete CapitalSearchCharacter associated software by using the Finder

Check the list of installed programs on your Mac computer and delete all unknown and recently installed apps. If you see an unknown program with incorrect spelling or varying capital letters, it have most likely been installed by malicious software and you should clean it off first with malware removal tool such as MalwareBytes Anti Malware.

Open Finder and click “Applications”.

Carefully browse through the list of installed software and remove all questionable and unknown apps.

Once you’ve found anything questionable that may be the CapitalSearchCharacter adware software or other potentially unwanted program, then right click this program and choose “Move to Trash”. Once complete, Empty Trash.

Remove CapitalSearchCharacter related files and folders

Now you need to try to find CapitalSearchCharacter related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

CapitalSearchCharacter creates several files, these files must be found and removed. Below is a list of files associated with this unwanted application.

• /Library/LaunchDaemons/com.CapitalSearchCharacter.system.plist
• ~/Library/LaunchAgents/com.CapitalSearchCharacter.service.plist
• /Library/Application Support/.(RANDOM)/System/com.CapitalSearchCharacter.system
• ~/Library/Application Support/.(RANDOM)/Services/com.CapitalSearchCharacter.service.app

Some files created by CapitalSearchCharacter are hidden from the user. To find and delete them, you need to enable “show hidden files”. To do this, use the shortcut CMD + SHIFT + . Press once to show hidden files and again to hide them. There is another way. Click Finder -> Applications -> Utilities -> Terminal. In Terminal, paste the following text: defaults write com.apple.finder AppleShowAllFiles YES

Press Enter. Hold the ‘Option/alt’ key, then right click on the Finder icon in the dock and click Relaunch.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for CapitalSearchCharacter generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: com.machelper.plist, com.net-preferences.plist, com.google.defaultsearch.plist, , search.plist, installapp.plist, macsearch.plist and com.CapitalSearchCharacter.service.plist. Most often, potentially unwanted programs, browser hijackers and adware create several files with similar names.

Check for CapitalSearchCharacter generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folders and files. Check the contents of suspicious folders, if there is a file with a name similar to com.CapitalSearchCharacter.system, then this folder must be deleted. Move all suspicious folders and files to the Trash.

Check for CapitalSearchCharacter generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for CapitalSearchCharacter generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.CapitalSearchCharacter.system.plist, com.macsearch.system.plist, com.machelper.system.plist, com.search.system.plist and com.installapp.system.plist. In most cases, adware software, browser hijackers and potentially unwanted programs create several files with similar names.

Scan your Mac with MalwareBytes

If you carefully followed the previous steps, then you should be able to remove CapitalSearchCharacter. Of course, very often browser hijackers, adware and PUPs hides on a Mac, disguising itself as legitimate apps and files. Therefore, in some cases, it is difficult for an inexperienced user to decide whether a particular file is part of adware, PUPs and browser hijackers. Therefore, we recommend you to use MalwareBytes Free to scan the Mac computer.

MalwareBytes Free can be downloaded from the following link.

When the downloading process is complete, run it and follow the prompts. Press the “Scan” button to perform a system scan with this tool for the CapitalSearchCharacter adware. This procedure may take quite a while, so please be patient. When a threat is found, the count of the security threats will change accordingly. Wait until the the scanning is complete. Once you have selected what you want to remove from your MAC press the “Quarantine” button.

The MalwareBytes Anti Malware (MBAM) is a free application that you can use to get rid of all detected folders, files, malicious services and so on.

Remove CapitalSearchCharacter from Safari, Chrome, Firefox

If you’re still seeing CapitalSearchCharacter that won’t go away, you might have harmful addons installed on your web-browser. Check your browser for unwanted add-ons using the steps below.

Google Chrome	Mozilla Firefox
In the top right corner, click on Chrome’s main menu button, represented by three vertical dots. In the menu go to ‘More tools’, then ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to get rid of CapitalSearchCharacter adware software by reset Google Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing problems with CapitalSearchCharacter adware removal, you need to reset Mozilla Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stay safe online

By installing an ad blocker application like AdGuard, you are able to block malicious web sites, stop autoplaying video ads and remove a large amount of distracting and intrusive ads on webpages.

1. Visit the following page to download AdGuard.
   
   

   AdGuard for Mac download
   3677 downloads
   Author: © Adguard
   Category: Security tools
   Update: January 17, 2018
   
2. When the download is done, run the downloaded file. You will see the “Setup Wizard” program window. Follow the prompts.
3. After the installation is done, click “Skip” to close the setup application and use the default settings, or click “Get Started” to see an quick tutorial which will help you get to know AdGuard better.
4. In most cases, the default settings are enough and you don’t need to change anything. Each time, when you start your computer, AdGuard will start automatically and stop annoying advertisements, block harmful and misleading webpages.

Finish words

Now your Apple Mac should be clean of the CapitalSearchCharacter adware. We suggest that you keep AdGuard (to help you block unwanted pop up ads and annoying malicious webpages) and MalwareBytes AntiMalware (MBAM) (to periodically scan your MAC OS for new malicious software, hijackers and adware software). Make sure that you have all the Critical Updates recommended for Mac operating system. Without regular updates you WILL NOT be protected when new hijackers, harmful apps and adware are released.

If you are still having problems while trying to remove CapitalSearchCharacter from your browser, then ask for help here.