Advanced Mac Cleaner strikes again!

It’s been a truism on macOS for some time that the most reviled piece of software on the platform is MacKeeper, but brother-in-arms Advanced Mac Cleaner must be running it a close second.

Advanced Mac Cleaner is produced by PCVark and has many incarnations. Aside from ‘AMC’, it’s also distributed as Mac Tonic, Mac Mechanic, Malware-Crusher, Mac Optimizer and now, the most recent form we’re seeing, Mac Auto Fixer.







Like all the other forms of AMC, this app gets bundled in with fake Flash installers and writes itself all over your Mac to multiple places inside your user and local domain Library folders. Here’s a 40-second video showing how Mac users get tricked into installing AMC and its fake virus scanner:



https://www.youtube.com/embed/ZeU72ihgApE?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent

For those of you that want to remove Mac Auto Fixer and related manually, here’s a list of most of the paths you should look for:

/Applications/Mac Auto Fixer.app
/Library/Advanced Mac Cleaner
/Library/Application Support/Advanced Mac Cleaner
/Library/Application Support/amc
/Library/Application Support/Mac Mechanic
/Library/Application Support/Mac Tonic
/Library/Application Support/MacOptimizer
/Library/Application Support/maf
/Library/hlprmaf/mafgset.plist
/Library/LaunchAgents/com.pcv.amcuninstall.plist
/Library/LaunchAgents/com.pcv.hlpramcn.plist
/Library/LaunchAgents/com.techyutil.maftask.plist
/Library/LaunchAgents/com.techyutil.mafuninstaller.plist
/Library/Mac Mechanic
/Library/Mac Tonic
/Library/MacOptimizer
/Library/Preferences/com.techyutils.cleaner.plist
/Volumes/MacAutoFixer/.hlpr/Mac Auto Fixer
/Volumes/MacAutoFixer/.hlpr/maf
~/Applications/Mac Auto Fixer.app
~/Library/Advanced Mac Cleaner
~/Library/Application Support/Advanced Mac Cleaner
~/Library/Application Support/amc
~/Library/Application Support/Mac Auto Fixer
~/Library/Application Support/Mac Mechanic
~/Library/Application Support/Mac Tonic
~/Library/Application Support/MacOptimizer
~/Library/Application Support/maf
~/Library/Caches/com.pcv.amcuninstallhelper
~/Library/Caches/com.pcv.rlistupdater
~/Library/Caches/com.PCvark.Advanced-Mac-Cleaner
~/Library/Caches/com.techyutil.macautofixer
~/Library/Caches/com.techyutil.maftask
~/Library/Caches/com.techyutil.maftaskreviser
~/Library/Caches/com.techyutil.mafuninstaller
~/Library/Caches/com.techyutils.cleaner
~/Library/hlprmaf
~/Library/hlprmaf/mafgset.plist
~/Library/LaunchAgents/com.pcv.amcuninstall.plist
~/Library/LaunchAgents/com.pcv.hlpramcn.plist
~/Library/LaunchAgents/com.techyutil.maftask.plist
~/Library/LaunchAgents/com.techyutil.mafuninstaller.plist
~/Library/Logs/Advanced Mac Cleaner.log
~/Library/Logs/helperamc.log
~/Library/Logs/Mac Auto Fixer.log
~/Library/Logs/maftask.log
~/Library/Mac Auto Fixer
~/Library/Mac Mechanic
~/Library/Mac Tonic
~/Library/MacOptimizer
~/Library/Preferences/com.pcv.hlpramc.plist
~/Library/Preferences/com.PCvark.Advanced-Mac-Cleaner.plist
~/Library/Preferences/com.techyutil.macautofixer.plist
~/Library/Preferences/com.techyutil.maftask.plist
~/Library/Preferences/com.techyutil.mafuninstaller.plist
~/Library/Preferences/com.techyutils.cleaner.plist

You can also save yourself a whole lot of grief by using my shareware troubleshooting tool DetectX Swift, which will not only find all these pesky elements for you, it’ll remove them all for you, too. There’s no requirement to pay, we don’t mind ridding your Mac of this stuff for free!

Enjoy! 😃

About philastokes

Independent Software Developer, Technical Writer and Researcher at SentinelOne. Explaining the unexplainable with images, video and text. Scripting anything imaginable in AppleScript, Bash, Python and Swift.

Posted on August 16, 2018, in DetectX, Security-2, Sqwarq. Bookmark the permalink. Leave a comment.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: