Moon Browser adware (Virus removal guide)

What is Moon Browser

Moon Browser is supposed to be an “internet browser” that will improve the browsing experience, but according to security specialists, this application acts as Adware. Adware is a form of software that displays unwanted advertisements to computer users. Some examples include pop-up ads, push notifications or unclosable windows. Maybe you approve the idea that the advertisements or pop ups is just a small problem. But these unwanted ads eat system resources and slow down your Mac computer performance.

Most often, adware software promote fake search providers by setting their address as the default search engine. In this case, the adware uses feed.moonbrowser.com as a search provider. This means that users who use Moon Browser as a web browser are forced to visit moonbrowser.com each time they search in the Net, open a new window or tab. And since moonbrowser.com is not a real search provider and does not have the ability to find the information users need, this web-page redirects the user’s web browser to the Google or Yahoo search engines. The devs behind Moon Browser hijacker are most probably doing this to generate advertisement money from the ads shown in the search results.

The worst is, adware software can monetize its functionality by collecting sensitive information from your browsing sessions. This confidential information, afterwards, can be easily transferred to third parties. This puts your privacy information at a security risk.

The adware can gather privacy information, including:

• IP addresses;
• URLs visited;
• search queries/terms;
• clicks on links and advertisements;
• internet browser version information.

In this blog post we will discuss how can you remove the adware from the personal computer manually or with free adware removal utilities compatible with modern operating systems.

How does Moon Browser get on your Mac

Adware usually gets on Mac computers as a part of free software. So, when you installing free apps, carefully read the disclaimers, select the Custom or Advanced installation method to watch for additional applications that are being installed, because some of the applications are PUAs and adware.

Threat Summary

Name	Moon Browser
Type	adware, potentially unwanted program (PUP), Mac virus, Mac malware
Detection Names	Adware.MAC.Generic, Trojan-Downloader.OSX.Adload, ApplicUnwnt, MacOS.Agent-MT, Osx.Adware.Cimpli, OSX.Trojan.Gen, Program:MacOS/Vigram.A and Adware/Adload!OSX
Distribution	Free software installers, malicious popup ads, torrent downloads and fake software updaters
Symptoms	Every time you perform an Internet search, your web-browser is redirected to another web-site, pop ups and new tab pages are loaded without your request, unexpected program installed without your say-so, new extensions suddenly added on your web-browser, unexpected changes in your internet browser such as displaying new tabs you did not open, slow browsing Internet.
Removal	Moon Browser removal guide

How to Remove Moon Browser adware (removal steps)

Fortunately, we have an effective method that will assist you manually or/and automatically delete Moon Browser from your browser and bring your web-browser settings, including newtab, search provider and start page, back to normal. Below you’ll find a removal tutorial with all the steps you may need to successfully remove adware and its components. Some of the steps below will require you to close this webpage. So, please read the step-by-step instructions carefully, after that bookmark it or open it on your smartphone for later reference.

To remove Moon Browser, use the steps below:

1. Remove unwanted profiles on Mac device
2. Check the list of installed software
3. Remove adware related files and folders
4. Scan your Mac with MalwareBytes
5. How to stay safe online

Remove unwanted profiles on Mac device

Adware can make changes to the Mac system such as malicious changes to browser settings, and the addition of malicious system profiles. You need to check the system preferences, find and remove malicious profiles and ensure your settings are as you expect.

Click the System Preferences icon ( ) in the Dock, or choose Apple menu ( ) > System Preferences.

In System Preferences, click Profiles, then select a profile related to adware software.

Click the minus button ( – ) located at the bottom-left of the Profiles screen to remove the profile.
Note: if you do not see Profiles in the System Preferences, that means there are no profiles installed on your Mac, which is normal.

Check the list of installed software

In order to remove Moon Browser you need to do is to uninstall unknown and questionable applications from your Mac using the Finder. When deleting potentially unwanted programs, adware software and browser hijackers, check the list of installed apps and try to find suspicious programs and remove them all. Pay special attention to recently installed programs, as it is most probably that Moon Browser сame along with it.

Open Finder and click “Applications”.

Very carefully look around the entire list of software installed on your machine. Most likely, one of them is the Moon Browser adware. Once you’ve found a questionable, unwanted or unused application, right click to it and select “Move to Trash”. Another method is drag the program from the Applications folder to the Trash.

Don’t forget, choose Finder -> “Empty Trash”.

Remove adware related files and folders

Now you need to try to find adware related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

Some files created by adware are hidden from the user. To find and delete them, you need to enable “show hidden files”. To do this, use the shortcut CMD + SHIFT + . Press once to show hidden files and again to hide them. There is another way. Click Finder -> Applications -> Utilities -> Terminal. In Terminal, paste the following text: defaults write com.apple.finder AppleShowAllFiles YES

Press Enter. Hold the ‘Option/alt’ key, then right click on the Finder icon in the dock and click Relaunch.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for adware generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files: search.plist, installapp.plist, com.net-preferences.plist, macsearch.plist, com.machelper.plist and com.google.defaultsearch.plist, . Most often, PUPs, browser hijackers and adware software create several files with similar names.

Check for adware generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folders and files. Check the contents of suspicious folders. Move all suspicious folders and files to the Trash.

Check for adware generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for adware generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files to be deleted: com.macsearch.system.plist, com.machelper.system.plist, com.installapp.system.plist and com.search.system.plist. In most cases, adware, browser hijackers and potentially unwanted programs create several files with similar names.

Scan your Mac with MalwareBytes

We recommend using MalwareBytes AntiMalware to scan the Mac computer for browser hijackers, adware software and potentially unwanted programs. This free tool is an advanced malware removal program developed by (c) Malwarebytes lab. This program uses the world’s most popular anti malware technology. It is able to help you remove malicious software and other security threats from your Mac for free.

MalwareBytes AntiMalware can be downloaded from the following link.

When downloading is complete, run it and follow the prompts. Click the “Scan” button to perform a system scan for adware. Depending on your computer, the scan can take anywhere from a few minutes to close to an hour. Review the results once the tool has complete the system scan. If you think an entry should not be quarantined, then uncheck it. Otherwise, simply click the “Quarantine” button.

The MalwareBytes AntiMalware is a free program that you can use to remove all detected folders, files, malicious services and so on.

Remove unwanted ads from Safari, Chrome, Firefox

Unwanted ads or other symptoms of adware in your web-browser is a good reason to find and get rid of harmful addons. This is an easy way to restore web-browsers settings and not lose any important information.

Google Chrome	Mozilla Firefox
In the top right hand corner, click on ‘three vertical dots’, and this will open up the main menu on Google Chrome. When the drop-down menu appears, choose ‘More tools’ and click on ‘Extensions’. Click ‘Remove’ to uninstall an extension. Click ‘Remove’ in the dialog box. You can also try to remove unwanted ads by reset Chrome settings.	Click on ‘menu’ button and select ‘Add-ons’. Go to ‘Extensions’ tab. To uninstall an add-on, click on ‘Remove’ button next to it. If you are still experiencing problems with ads removal, you need to reset Mozilla Firefox browser.
Safari
On the top menu select ‘Safari’, then ‘Preferences’. Select ‘Extensions’ tab. Select an extension you want to delete and click ‘Uninstall’ button next to it.

How to stay safe online

Enabling an adblocker program such as AdGuard is an effective way to alleviate the risks. Additionally, ad-blocking programs will also protect you from harmful ads and web-sites, and, of course, stop redirection chain to misleading, scam and similar web sites.

Installing the AdGuard is simple. First you will need to download AdGuard from the following link.

Once the downloading process is done, run the downloaded file. The “Setup Wizard” window will show up on the computer screen.

Follow the prompts. AdGuard will then be installed. A window will show up asking you to confirm that you want to see a quick guide. Click “Skip” button to close the window and use the default settings, or click “Get Started” to see an quick tutorial that will allow you get to know AdGuard better.

Each time, when you start your MAC, AdGuard will start automatically and stop unwanted pop up advertisements, block harmful and misleading web-pages.

Finish words

Once you have removed the Moon Browser adware using the few simple steps, your Mac will no longer display any unwanted ads. Unfortunately, if the instructions does not help you, then you have caught a new adware, and then the best way – ask for help here.