├── AdvancedMacCleaner.adf
├── Apple-HT203987.adf
├── AskToolbar.adf
├── AwesomeScreenshot.adf
├── BestYouTubeDownloader.adf
├── ChatZum.adf
├── Conduit.adf
├── Crossrider.adf
├── CustomSearch.adf
├── FkCodec.adf
├── Genieo.adf
├── GoPhoto.adf
├── Hola.adf
├── JDIBackup.adf
├── ListenToYouTube.adf
├── MacKeeper.adf
├── MegaBackup.adf
├── OperatorMac.adf
├── PremierOpinion.adf
├── README.MD
├── SaveKeep.adf
├── Spigot.adf
├── VSearch.adf
├── Vidx-MacVX.adf
├── Yontoo.adf
├── ZipCloud.adf
└── multimalware.adf
/AdvancedMacCleaner.adf:
--------------------------------------------------------------------------------
1 |
2 | 90
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 |
7 | PUP.Advanced Mac Cleaner
8 | /Applications/Advanced Mac Cleaner.app
9 | /Library/Application Support/amc/
10 | /Users/*/Library/Advanced Mac Cleaner
11 | /Users/*/Library/hlpramc
12 | /Users/*/Library/Application Support/Advanced Mac Cleaner
13 | /Users/*/Library/Application Support/amc
14 | /Users/*/Library/LaunchAgents/com.pcv.hlpramc.plist
15 |
16 |
17 |
--------------------------------------------------------------------------------
/Apple-HT203987.adf:
--------------------------------------------------------------------------------
1 |
2 | 1.1
3 | 1.1.0
4 | Shea Craig
5 | https://support.apple.com/en-us/ht203987
6 |
10 |
11 | Downlite and VSearch Variants
12 |
13 | http://www.deal-top.com
14 | /System/Library/Frameworks/v.framework
15 | /System/Library/Frameworks/VSearch.framework
16 | /Library/PrivilegedHelperTools/Jack
17 | /Library/LaunchDaemons/Jack.plist
18 | /Users/*/Library/Caches/com.VSearch.bulk.installer
19 | /Users/*/Library/Caches/com.VSearch.VSinstaller
20 | /Users/*/Library/Saved Application State/com.VSearch.bulk.installer.savedstate
21 |
23 |
24 | /Library/LaunchAgents/com.*.agent.plist
25 | /Library/LaunchDaemons/com.*.helper.plist
26 | /Library/LaunchDaemons/com.*.daemon.plist
27 | .*/Library/Application Support/(.*)/Agent/agent.app/Contents/MacOS/agent
28 | AGENT
29 |
30 | /Library/Application Support/%AGENT%
31 |
32 |
33 | Conduit, Trovi, MyBrand, and Search Protect Variants
34 |
35 | /Library/InputManagers/CTLoader/
36 | /Library/Application Support/Conduit/
37 | /Users/*/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
38 | /Users/*/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin
39 | /Applications/SearchProtect.app
40 | /Users/*/Conduit/
41 | /Users/*/Trovi/
42 | /Users/*/Library/Caches/com.Conduit.takeOverSearchAssetsMac
43 |
44 |
45 | Genieo and InstallMac
46 |
47 | /private/etc/launchd.conf
48 | /Applications/Genieo
49 | /Applications/InstallMac
50 | /Applications/Uninstall Genieo
51 | /Applications/Uninstall IM Completer.app
52 | /usr/lib/libgenkit.dylib
53 | /usr/lib/libgenkitsa.dylib
54 | /usr/lib/libimckit.dylib
55 | /usr/lib/libimckitsa.dylib
56 | /Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client
57 | /Users/*/Library/Application Support/Genieo/
58 | /Users/*/Library/Application Support/com.genieoinnovation.Installer/
59 | /Library/Frameworks/GenieoExtra.framework
60 | /Library/LaunchAgents/com.genieo.completer.update.plist
61 | /Library/LaunchAgents/com.genieo.engine.plist
62 | /Library/LaunchAgents/com.genieoinnovation.macextension.client.plist
63 | /Library/LaunchAgents/com.genieoinnovation.macextension.plist
64 | /Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist
65 | /Users/*/Library/LaunchAgents/com.genieo.completer.download.plist
66 | /Users/*/Library/LaunchAgents/com.genieo.completer.ltvbit.plist
67 | /Users/*/Library/LaunchAgents/com.genieo.completer.update.plist
68 | /Users/*/Library/Preferences/com.genieo.global.settings.plist.lockFile
69 | /Users/*/Library/Preferences/com.geneio.settings.plist.lockFile
70 | /Users/*/Library/Preferences/com.geneio.global.settings.plist
71 | /Users/*/Library/Saved Application State/com.genieo.RemoveGenieoMac.savedState
72 |
73 |
--------------------------------------------------------------------------------
/AskToolbar.adf:
--------------------------------------------------------------------------------
1 |
2 | 1.0
3 | 1.1.0
4 | Elliot Jordan
5 | Linde Group
6 |
7 | Ask Toolbar
8 |
9 | /Users/*/Library/Application Support/Sponsors.framework
10 | /Library/Application Support/ASK
11 | /Library/Application Support/Firefox/Profiles/*/searchplugins/toolbar_*@apn.ask.com.xpi
12 | /Library/Application Support/Firefox/Profiles/*/searchplugins/ask-search.xml
13 | /Library/Application Support/Chrome/*/Extensions/aaaaaogokkamlflcoccdihncmbgcmfln
14 | /Library/Application Support/Chrome/External Extensions/aaaaaogokkamlflcoccdihncmbgcmfln.json
15 | /Users/*/Safari/Extensions/Search App by Ask*.safariextz
16 |
17 |
18 |
--------------------------------------------------------------------------------
/AwesomeScreenshot.adf:
--------------------------------------------------------------------------------
1 |
2 | 1.0
3 | 1.1.0
4 | Elliot Jordan
5 | Linde Group
6 |
7 | Awesome Screenshot
8 |
9 |
10 | /Users/*/Library/Application Support/Google/Chrome/Default/Extensions/alelhddbbhepgpmgidjdcjakblofbmce
11 |
12 |
13 |
--------------------------------------------------------------------------------
/BestYouTubeDownloader.adf:
--------------------------------------------------------------------------------
1 |
2 | 95
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 |
7 | Best YouTube Downloader
8 |
9 | /Users/*/Library/LaunchAgents/com.moeppfdpoohhdcaefbfpmabjipnohiif.updater.plist
10 |
11 |
12 |
--------------------------------------------------------------------------------
/ChatZum.adf:
--------------------------------------------------------------------------------
1 |
2 | 95
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 |
7 | ChatZum
8 |
9 | /Applications/ChatZumUninstaller.pkg
10 | /Library/Application Support/SIMBL/Plugins/SafariOmnibar.bundle
11 | /Library/Internet Plug-Ins/uid.plist
12 | /Library/Internet Plug-Ins/zako.plugin
13 |
14 |
15 |
--------------------------------------------------------------------------------
/Conduit.adf:
--------------------------------------------------------------------------------
1 |
2 | 95
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 | This definition is based on the AdwareMedic list of files, not the Apple kbase article. It includes some different things.
7 |
8 | Conduit
9 |
12 | /Users/*/Library/Application Support/Google/Chrome/Default/Extensions/cbmjmfcldbpelhknnfjbkobmabafpoed
13 | /Library/InputManagers/CTLoader/
14 | /Library/LaunchAgents/com.conduit.loader.agent.plist
15 | /Library/LaunchDaemons/com.perion.searchprotectd.plist
16 | /Library/Application Support/SIMBL/Plugins/CT2285220.bundle
17 | /Library/Application Support/Conduit/
18 | /Applications/SearchProtect.app
19 | SearchProtect
20 | searchprotect
21 | /Applications/SearchProtect/
22 | /Users/*/Conduit
23 | /Users/*/Trovi
24 |
25 | /Users/*/Conduit
26 | search\.conduit\.com
27 |
28 | /Users/*/Library/Application Support/Conduit
29 |
30 | /Users/*/Library/Application Support/Conduit
31 | /Library/Application Support/Conduit
32 | search\.conduit\.com
33 |
34 | /Users/*/Library/Caches/com.Conduit.takeOverSearchAssetsMac
35 | /Users/*/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin
36 | /Users/*/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin
37 | /Users/*/Library/Application Support/Firefox/Profiles/*/searchplugins/conduit.xml
38 | /Users/*/Library/Application Support/Firefox/Profiles/*/searchplugins/MyBrand.xml
39 | /Users/*/Library/Application Support/Firefox/Profiles/*/searchplugins/'Conduit Customized Web Search'.xml
40 | /Users/*/Library/Application Support/Firefox/Profiles/*/takeOverNewTab.txt
41 | /Users/*/Library/Application Support/Firefox/Profiles/*/abstraction.js
42 |
43 |
44 |
--------------------------------------------------------------------------------
/Crossrider.adf:
--------------------------------------------------------------------------------
1 |
2 | 95
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 | This is a work in progress, and as such, many lines are as of yet unconverted to ADF format.
7 |
8 | Crossrider
9 |
14 | /Users/*/Library/Application Support/Google/Chrome/External Extensions/phpdijfdkggndfmgcfdhcimlflflnega.json
15 | /Users/*/Library/LaunchAgents/Safari Security
16 |
17 | /Library
18 | (cinema(s?)[- \+]*(plus|\+)?[- \+]*(pro|hd)?)|(cinema(s?) ?pl[aeiou]+s)
19 | com\.(cinema(s?)[- \+]*(plus|\+)?[- \+]*(pro|hd)?)|(cinema(s?) ?pl[aeiou]+s)\.Service
20 |
21 |
22 | /Users/*/Library/LaunchAgents
23 | flashmall
24 | shopp?y.?mate
25 | palmall
26 |
27 |
28 | /Users/*/Library/LaunchAgents
29 | /Library/LaunchAgents
30 | /Library/LaunchDaemons
31 | (cinema(s?)[- \+]*(plus|\+)?[- \+]*(pro|hd)?)|(cinema(s?) ?pl[aeiou]+s)
32 |
33 |
34 | /Users/*/Library/LaunchAgents
35 | com\.crossrider\.wss\d+\.agent\.plist
36 |
37 | /Users/*/Library/LaunchAgents/WebSocketServerApp
38 | /Users/*/Library/LaunchAgents/com.webhelper.plist
39 | /Users/*/Library/LaunchAgents/com.webtools.update.agent.plist
40 | /Users/*/Library/LaunchAgents/com.webtools.uninstaller.plist
41 |
42 | /Library/LaunchAgents
43 | com\.webhelper\..*\.plist
44 | /Library/Application Support/webhelper
45 |
46 |
47 | /Library/LaunchAgents
48 | com\.webshopper\..*\.plist
49 | /Library/Application Support/WebShopper
50 |
51 |
52 | /Users/*/Library/LaunchAgents
53 | com\.webtools\..*\.plist
54 | /Library/Application Support/WebTools
55 |
56 | /Users/*/Library/Application Support/webHelperApp/
57 | /Users/*/Library/Application Support/webhelper/
58 | /Users/*/Library/Application Support/WebTools/
59 | /Users/*/Library/Application Support/WebShopper/
60 | /Users/*/Library/WebTools/
61 | /Users/*/Library/flashmall/
62 | /Applications/WebTools.app
63 | /Applications/WebShopper.app
64 | /Users/*/Applications/flashmall.app
65 |
66 | /Applications
67 | /Users/*/Applications
68 | cinema(s?)[- \+]*((plus)|(pro))[- \+0123456789]*
69 |
70 |
71 | /Users/*/Library/cinemapro1-2
72 | /Users/*/Library/LaunchAgents/UpdateDownloader
73 |
74 | /Users/*/Library/LaunchAgents
75 | \.agent\.plist
76 | UpdateDownloader
77 |
78 |
79 | /Users/*/Library/LaunchAgents
80 | com\.extensions\.updater[0123456789]*\.ver
81 |
82 | /Users/*/Library/ScriptingAdditions/BrowserHelper.osax
83 |
84 |
85 |
--------------------------------------------------------------------------------
/CustomSearch.adf:
--------------------------------------------------------------------------------
1 |
2 | 95
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 |
7 | CustomSearch
8 |
9 | /Users/*/Applications/SilentInstaller.app
10 | SilentInstaller
11 | silentinstaller
12 | LinkuryMac
13 | linkurymac
14 |
15 |
16 |
--------------------------------------------------------------------------------
/FkCodec.adf:
--------------------------------------------------------------------------------
1 |
2 | 95
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 |
7 | FkCodec
8 |
9 | /Users/*/Library/Application Support/Codec-M
10 | /Users/*/Library/LaunchAgents/com.codecm.uploader.plist
11 | /Applications/Codec-M.app
12 | Codec-M
13 | codec-m
14 |
15 |
16 |
--------------------------------------------------------------------------------
/Genieo.adf:
--------------------------------------------------------------------------------
1 |
2 | 95
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 | This definition is based on the AdwareMedic list of files, not the Apple kbase article. It includes some different things.
7 | This is a work in progress, and as such, many lines are as of yet unconverted to ADF format.
8 |
9 | Genieo
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 | /Users/*/Library/LaunchAgents
18 | /private/var/root/Library/LaunchAgents
19 | \.((download)|(update)|(ltvbit))\.plist
20 | \-firstAppId
21 |
22 | /Library/LaunchAgents/com.genieoinnovation.macextension.plist
23 | /Library/LaunchAgents/com.genieoinnovation.macextension.client.plist
24 | /Library/LaunchAgents/com.genieo.engine.plist
25 | /Library/LaunchAgents/com.genieo.completer.update.plist
26 | /Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist
27 | /Applications/Celipsow.app
28 | /Applications/Feelbegin.app
29 | /Applications/Epolife.app
30 | /Applications/Genieo.app.app
31 | /Applications/InKeepr.app.app
32 | /Applications/InKeepr.app
33 | /Applications/InstallGenieo.app.app
34 | /Applications/InstallMac.app
35 | /Applications/JakeCares.app
36 | /Applications/Javeview.app
37 | /Applications/Jimbrie.app
38 | /Applications/Kuklorest.app
39 | /Applications/Leperdvil.app
40 | /Applications/Listchack.app
41 | /Applications/Lunaticake.app
42 | /Applications/mainorne.app
43 | /Applications/montageobox.app
44 | /Applications/Myppes.app
45 | /Applications/Nariabox.app
46 | /Applications/Olivernetko.app
47 | /Applications/Oliverto.app
48 | /Applications/Opinteks.app
49 | /Applications/Otwexplain.app
50 | /Applications/Portsayd.app
51 | /Applications/Qamails.app
52 | /Applications/Quitelex.app
53 | /Applications/Reset Search.app.app
54 | /Applications/Texiday.app
55 | /Applications/Totiteck.app
56 | /Applications/Uninstall Genieo.app
57 | /Applications/Uninstall IM Completer.app
58 | /Applications/Epolife
59 | /Applications/FriendlySocket
60 | /Applications/pdf/pdf.pronto
61 | /Applications/pdf/Uninstallpdf.pronto
62 | /Applications/pronto/pdf.pronto
63 | AppYM
64 | genieo
65 | Genieo
66 | inkeepr
67 | InKeepr
68 | installgenieo
69 | InstallGenieo
70 | /Users/*/Library/Application Support/Asistents
71 | /Users/*/Library/Application Support/Celipsow
72 | /Users/*/Library/Application Support/com.genieoinnovation.Installer
73 | /Users/*/Library/Application Support/Epolife
74 | /Users/*/Library/Application Support/Feelbegin
75 | /Users/*/Library/Application Support/Genieo
76 | /Users/*/Library/Application Support/IM.Installer
77 | /Users/*/Library/Application Support/InKeepr
78 | /Users/*/Library/Application Support/JakeCares
79 | /Users/*/Library/Application Support/Javeview
80 | /Users/*/Library/Application Support/Jimbrie
81 | /Users/*/Library/Application Support/Kuklorest
82 | /Users/*/Library/Application Support/Leperdvil
83 | /Users/*/Library/Application Support/Listchack
84 | /Users/*/Library/Application Support/Lunaticake
85 | /Users/*/Library/Application Support/mainorne
86 | /Users/*/Library/Application Support/Manroling
87 | /Users/*/Library/Application Support/montageobox
88 | /Users/*/Library/Application Support/Myppes
89 | /Users/*/Library/Application Support/Nariabox
90 | /Users/*/Library/Application Support/Olivernetko
91 | /Users/*/Library/Application Support/Oliverto
92 | /Users/*/Library/Application Support/Opinteks
93 | /Users/*/Library/Application Support/Otwexplain
94 | /Users/*/Library/Application Support/Portsayd
95 | /Users/*/Library/Application Support/ProntoApp
96 | /Users/*/Library/Application Support/Qamails
97 | /Users/*/Library/Application Support/Quitelex
98 | /Users/*/Library/Application Support/Smokyashan
99 | /Users/*/Library/Application Support/Smacklek
100 | /Users/*/Library/Application Support/Totiteck
101 | /Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client
102 | /Library/Frameworks/GenieoExtra.framework
103 | /Users/*/Library/Application Support/Firefox/Profiles/*/searchplugins/my-homepage.xml
104 | /Users/*/Library/LaunchAgents/com.genieo.completer.download.plist
105 | /Users/*/Library/LaunchAgents/com.genieo.completer.ltvbit.plist
106 | /Users/*/Library/LaunchAgents/com.genieo.completer.update.plist
107 | /Users/*/Library/LaunchAgents/com.installer.completer.download.plist
108 | /Users/*/Library/LaunchAgents/com.installer.completer.ltvbit.plist
109 | /Users/*/Library/LaunchAgents/com.installer.completer.update.plist
110 | /Users/*/Library/LaunchAgents/Feelbegin.AppRemoval.plist
111 | /Users/*/Library/LaunchAgents/Javeview.download.plist
112 | /Users/*/Library/LaunchAgents/Javeview.ltvbit.plist
113 | /Users/*/Library/LaunchAgents/Javeview.update.plist
114 | /Users/*/Library/LaunchAgents/Kuklorest.AppVemoral.plist
115 | /Users/*/Library/LaunchAgents/Kuklorest.btvlit.plist
116 | /Users/*/Library/LaunchAgents/Kuklorest.dowlnoad.plist
117 | /Users/*/Library/LaunchAgents/Kuklorest.uadpte.plist
118 | /Users/*/Library/LaunchAgents/Lunaticake.AppVemoral.plist
119 | /Users/*/Library/LaunchAgents/Lunaticake.dowlnoad.plist
120 | /Users/*/Library/LaunchAgents/Lunaticake.btvlit.plist
121 | /Users/*/Library/LaunchAgents/Lunaticake.uadpte.plist
122 | /Users/*/Library/LaunchAgents/Pagerpost.AppRemoval.plist
123 | /Users/*/Library/LaunchAgents/pronto.notification.plist
124 | /Users/*/Library/LaunchAgents/pronto.update.plist
125 | /Users/*/Library/LaunchAgents/Smokyashan.update.plist
126 | /Users/*/Library/LaunchAgents/Smacklek.AppVemoral.plist
127 | /Users/*/Library/LaunchAgents/Smacklek.dolnwoad.plist
128 | /Users/*/Library/LaunchAgents/Smacklek.btvlit.plist
129 | /Users/*/Library/LaunchAgents/Smacklek.uadpte.plist
130 | /Users/*/Library/LaunchAgents/texiday.download.plist
131 | /Users/*/Library/LaunchAgents/texiday.ltvbit.plist
132 | /Users/*/Library/LaunchAgents/texiday.update.plist
133 | /Users/*/Library/LaunchAgents/Mainorne.AppRemoval.plist
134 | /Users/*/Library/LaunchAgents/Mainorne.AppVemoral.plist
135 | /Users/*/Library/LaunchAgents/Mainorne.dolnwoad.plist
136 | /Users/*/Library/LaunchAgents/Mainorne.btvlit.plist
137 | /Users/*/Library/LaunchAgents/Mainorne.upadte.plist
138 |
139 | /private/etc/launchd.conf
140 | lib(gen|imc)kit(sa)?\.dylib
141 |
142 | /usr/lib/libgenkit.dylib
143 | /usr/lib/libgenkitsa.dylib
144 | /usr/lib/libimckit.dylib
145 | /usr/lib/libimckitsa.dylib
146 | /Users/*/Library/Safari/Extensions/Friendlysocket*
147 | /Users/*/Library/Safari/Extensions/Lunaticake.safariextz
148 | /Users/*/Library/Safari/Extensions/Mainorne.safariextz
149 | /Users/*/Library/Safari/Extensions/Nariabox.safariextz
150 | /Users/*/Library/Safari/Extensions/Oliverto.safariextz
151 | /Users/*/Library/Safari/Extensions/Omnibar.safariextz
152 | /Users/*/Library/Safari/Extensions/Poptotop.safariextz
153 | /Users/*/Library/Safari/Extensions/Ratplee.safariextz
154 |
155 |
156 |
--------------------------------------------------------------------------------
/GoPhoto.adf:
--------------------------------------------------------------------------------
1 |
2 | 90
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 | The source for this adware seems to no longer specify this in its definitions.
7 |
8 | GoPhoto
9 | /Users/*/Library/Application Support/Google/Chrome/External Extensions/ccfjbdjailljfihgkoccfbiljjapiijb.json
10 |
11 |
12 |
13 |
14 |
--------------------------------------------------------------------------------
/Hola.adf:
--------------------------------------------------------------------------------
1 |
2 | 1.0
3 | 1.1.0
4 | David West
5 | David West
6 |
7 | Hola
8 | /Users/*/Library/Application Support/Google/Chrome/Default/Extensions/gkojfkhlekighikafcpjkiklfbnlmeio
9 |
10 |
11 |
--------------------------------------------------------------------------------
/JDIBackup.adf:
--------------------------------------------------------------------------------
1 |
2 | 1.1
3 | 1.1.0
4 | Shea Craig
5 | Durham Academy
6 |
7 | ZipCloud/JustCloud
8 |
9 | /Applications/JustCloud.app
10 | /Users/*/Library/LaunchAgents/com.jdibackup.JustCloud.autostart.plist
11 | /Users/*/Library/LaunchAgents/com.jdibackup.JustCloud.backupstart.plist
12 | /Users/*/Library/LaunchAgents/com.jdibackup.JustCloud.notify.plist
13 | /Users/*/Library/Logs/JustCloud
14 | /Users/*/Library/Preferences/com.jdibackup.JustCloud.plist
15 | /Users/*/Library/Saved Application State/com.jdibackup.JustCloud.savedState
16 | JustCloud
17 |
18 | /Applications/ZipCloud.app
19 | /Users/*/Library/LaunchAgents/com.jdibackup.ZipCloud.autostart.plist
20 | /Users/*/Library/LaunchAgents/com.jdibackup.ZipCloud.backupstart.plist
21 | /Users/*/Library/LaunchAgents/com.jdibackup.ZipCloud.notify.plist
22 | /Users/*/Library/Logs/ZipCloud
23 | /Users/*/Library/Preferences/com.jdibackup.ZipCloud.plist
24 | /Users/*/Library/Saved Application State/com.jdibackup.ZipCloud.savedState
25 | ZipCloud
26 |
27 | /Users/*/Library/Services/Add to Backup Selection.workflow
28 | /Users/*/Library/Services/Instant Backup.workflow
29 | /Users/*/Library/Services/Remove from Backup Selection.workflow
30 | /Users/*/Library/Services/View Previous Versions.workflow
31 |
32 |
33 |
--------------------------------------------------------------------------------
/ListenToYouTube.adf:
--------------------------------------------------------------------------------
1 |
2 | 95
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 | This is a work in progress, and as such, many lines are as of yet unconverted to ADF format.
7 |
8 | ListenToYouTube
9 |
10 | /Library/LaunchDaemons/*
11 | <string>/Library/Application Support/ListenToYoutube/[^/]*/ListenToYoutube</string>
12 |
13 | /Library/Application Support/ListenToYoutube
14 |
15 |
16 |
--------------------------------------------------------------------------------
/MacKeeper.adf:
--------------------------------------------------------------------------------
1 |
2 | 1.0
3 | 1.1.0
4 | Shea Craig
5 | Durham Academy
6 |
7 | MacKeeper
8 | /Users/*/Library/LaunchAgents/com.*.MacKeeper.Helper.plist
9 | /Users/*/Documents/MacKeeper Backups
10 | /Applications/MacKeeper.app
11 | /Users/*/Library/Application Support/MacKeeper Helper
12 | /Users/*/Library/Caches/com.mackeeper.MacKeeper
13 | MacKeeper
14 |
15 |
16 |
17 |
--------------------------------------------------------------------------------
/MegaBackup.adf:
--------------------------------------------------------------------------------
1 |
2 | 90
3 | 1.1.0
4 | Zack McCauley
5 | Infected Machine, App Cleaner output
6 |
7 | MegaBackup
8 | /Applications/MegaBackup.app
9 | /Users/*/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.megabackup.megabackup-uninstaller.sfl
10 | /Users/*/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/ com.megabackup.megabackup.sfl
11 | /Users/*/Library/Caches/com.megabackup.*
12 | /Users/*/Library/Preferences/com.megabackup.*
13 | megabackup
14 | MegaBackup
15 |
16 |
17 |
--------------------------------------------------------------------------------
/OperatorMac.adf:
--------------------------------------------------------------------------------
1 |
2 | 95
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 | Do not use this ADF! At the moment, it only deletes your Chrome preferences.
7 | This is a work in progress, and as such, many lines are as of yet unconverted to ADF format.
8 |
9 | OperatorMac
10 |
11 |
12 |
13 | /Users/*/Library/Application Support/Firefox/Profiles/*/searchplugins/mySearchPlug.xml
14 | Opti[ -]?Page
15 |
16 |
17 |
18 | /Users/*/Library/Application Support/mediahm/
19 |
20 | /Users/*/Library/LaunchDaemons/com.mediahm.operator.update.plist
21 |
22 |
23 |
--------------------------------------------------------------------------------
/PremierOpinion.adf:
--------------------------------------------------------------------------------
1 |
2 | 95
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 |
7 | PremierOpinion
8 | /Applications/PremierOpinion
9 | /Library/LaunchAgents/PremierOpinionAgent.plist
10 | /Library/LaunchDaemons/PremierOpinion.plist
11 |
12 |
13 | /
14 | ^[a-z]$
15 | <MACSNIFFER>
16 |
17 |
18 |
19 |
--------------------------------------------------------------------------------
/README.MD:
--------------------------------------------------------------------------------
1 | Adware Definition Files
2 | =======================
3 |
4 | This repository collects Adware Definition Files (ADF) for [SavingThrow](https://github.com/sheagcraig/SavingThrow) which have been tested and are generally considered to be safe and effectively designed.
5 |
6 | A number have just been added thanks to Owen Pragel (@opragel) which have unfinished lines commented out. For the purposes of looking for potential adware on a machine, these commented out lines will not interfere; the ADF may just not be finding everything there is to find.
7 |
8 | To use, feel free to fork, or download and self-host with your own modifications for your own organization.
9 |
10 | Contributions are welcome! (Use Pull Requests to add or correct an ADF).
--------------------------------------------------------------------------------
/SaveKeep.adf:
--------------------------------------------------------------------------------
1 |
2 | 90
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 |
7 | SaveKeep
8 |
9 | /Applications/Savekeep.app
10 |
11 |
12 |
--------------------------------------------------------------------------------
/Spigot.adf:
--------------------------------------------------------------------------------
1 |
2 | 96
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 |
7 | Spigot
8 |
9 | /Users/*/Library/Application Support/Firefox/Profiles/*/extensions/searchme@mybrowserbar.com.xpi
10 | /Users/*/Library/LaunchAgents/com.spigot.SearchProtection.plist
11 | /Users/*/Library/LaunchAgents/com.spigot.ApplicationManager.plist
12 | /Users/*/Library/Application Support/Spigot/
13 |
14 | /Users/*/Library/Application Support/Firefox/Profiles/*/searchplugins
15 | .*\.xml
16 | search\.yahoo\.com/search\?fr=spigot
17 |
18 |
19 |
20 |
--------------------------------------------------------------------------------
/VSearch.adf:
--------------------------------------------------------------------------------
1 |
2 | 95
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 | This definition is based on the AdwareMedic list of files, not the Apple kbase article. It includes some different things.
7 | This is a work in progress, and as such, many lines are as of yet unconverted to ADF format.
8 |
9 | VSearch
10 | /Library/Application Support/VSearch
11 | /Library/LaunchAgents/com.vsearch.agent.plist
12 | /Library/LaunchDaemons/com.vsearch.daemon.plist
13 | /Library/LaunchDaemons/com.vsearch.helper.plist
14 | /Library/LaunchDaemons/Jack.plist
15 | /Library/PrivilegedHelperTools/Jack
16 | /System/Library/Frameworks/v.framework
17 | /System/Library/Frameworks/VSearch.framework
18 |
19 | /Library/Application Support/*/Version.plist
20 | Frameworks/v\.framework
21 |
22 |
23 | /Library/Application Support/*/f
24 | <string>[0-9a-f]+\.com</string>
25 |
26 |
27 | /Library/Application Support/*/f
28 | zzz.loader
29 |
30 |
31 | /Library/Application Support
32 | ^[0-9a-f]{16}$
33 |
34 |
35 | /Library/LaunchAgents
36 | com\.[^\.]+\.agent\.plist
37 | (com\.v\.agent)|(/Application Support/[0-9a-f]+/Agent/[^\.]+\.app)
38 |
39 |
40 | /Library/LaunchDaemons
41 | com\.[^\.]+\.(daemon|helper)\.plist
42 | (com\.v\.(daemon|helper))|(/Application Support/[0-9a-f]+/Agent/[^\.]+\.app)
43 |
44 |
45 | /Library/LaunchAgents
46 | /Library/LaunchDaemons
47 | com\.[^\.]+\.agent\.plist
48 | com\.[^\.]+\.(daemon|helper)\.plist
49 | /Agent/agent\.app/Contents/MacOS/agent
50 |
51 | /System/Library/Frameworks/AnoxicMitral.framework
52 | /System/Library/Frameworks/CompurgatorLlanberisslate.framework
53 | /System/Library/Frameworks/courbashguana.framework
54 | /System/Library/Frameworks/Horntail.framework
55 | /System/Library/Frameworks/leptoprosopic.framework
56 | /System/Library/Frameworks/Lycidae.framework
57 | /System/Library/Frameworks/PegasoidVaporizable.framework
58 | /System/Library/Frameworks/Underbeat.framework
59 | /System/Library/Frameworks/v.framework
60 | /Users/*/Library/Caches/com.VSearch.bulk.installer
61 | /Users/*/Library/Caches/com.VSearch.VSinstaller
62 |
63 |
64 |
--------------------------------------------------------------------------------
/Vidx-MacVX.adf:
--------------------------------------------------------------------------------
1 |
2 | 95
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 | This is a work in progress, and as such, many lines are as of yet unconverted to ADF format.
7 |
8 | Vidx/MacVX
9 |
10 |
11 |
12 | /Applications/MacMin.app
13 | /Applications/Vidx.app
14 | /Users/*/Applications/MacMin.app
15 | /Users/*/Applications/Vidx.app
16 | macmin
17 | MacMin
18 | vidx
19 | Vidx
20 |
21 |
22 |
23 | /Library/Application Support/VidToMP3/
24 |
25 | /Library/LaunchDaemons/*
26 | /Library/Application Support/VidToMP3/
27 |
28 | /Library/Application Support/fa4e8.94b.550d413f/
29 | /Users/*/Library/Application Support/osxDownloader/
30 |
31 |
32 |
--------------------------------------------------------------------------------
/Yontoo.adf:
--------------------------------------------------------------------------------
1 |
2 | 95
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 |
7 | Yontoo
8 | /Users/*/Library/Application Support/Google/Chrome/YontooLayers.crx
9 |
10 |
12 |
13 |
14 |
--------------------------------------------------------------------------------
/ZipCloud.adf:
--------------------------------------------------------------------------------
1 |
2 | 1.1
3 | 1.1.0
4 | Shea Craig
5 | Durham Academy
6 | ZipCloud is included in the JDIBackup ADF found in this repo. This is a duplicate of that just to ensure people already using it don't lose the ability to scan for those files.
7 |
8 | ZipCloud/JustCloud
9 |
10 | /Applications/JustCloud.app
11 | /Users/*/Library/LaunchAgents/com.jdibackup.JustCloud.autostart.plist
12 | /Users/*/Library/LaunchAgents/com.jdibackup.JustCloud.backupstart.plist
13 | /Users/*/Library/LaunchAgents/com.jdibackup.JustCloud.notify.plist
14 | /Users/*/Library/Logs/JustCloud
15 | /Users/*/Library/Preferences/com.jdibackup.JustCloud.plist
16 | /Users/*/Library/Saved Application State/com.jdibackup.JustCloud.savedState
17 | JustCloud
18 |
19 | /Applications/ZipCloud.app
20 | /Users/*/Library/LaunchAgents/com.jdibackup.ZipCloud.autostart.plist
21 | /Users/*/Library/LaunchAgents/com.jdibackup.ZipCloud.backupstart.plist
22 | /Users/*/Library/LaunchAgents/com.jdibackup.ZipCloud.notify.plist
23 | /Users/*/Library/Logs/ZipCloud
24 | /Users/*/Library/Preferences/com.jdibackup.ZipCloud.plist
25 | /Users/*/Library/Saved Application State/com.jdibackup.ZipCloud.savedState
26 | ZipCloud
27 |
28 | /Users/*/Library/Services/Add to Backup Selection.workflow
29 | /Users/*/Library/Services/Instant Backup.workflow
30 | /Users/*/Library/Services/Remove from Backup Selection.workflow
31 | /Users/*/Library/Services/View Previous Versions.workflow
32 |
33 |
34 |
--------------------------------------------------------------------------------
/multimalware.adf:
--------------------------------------------------------------------------------
1 |
2 | 90
3 | 1.1.0
4 | Owen Pragel
5 | http://www.adwaremedic.com/signatures.xml
6 | This is a work in progress, and as such, many lines are as of yet unconverted to ADF format.
7 |
8 | MacShop
9 |
10 |
11 | MacSmart
12 |
13 |
14 | News Ticker Remover
15 |
16 |
17 | PhotoZoom
18 |
19 |
20 | Shopper Helper Pro
21 |
22 |
23 | ArcadeYum
24 |
25 |
26 | DreamsAdNetwork
27 |
28 |
29 | FlashFree
30 |
31 |
32 | Recipe Hub
33 |
34 |
35 | ClickAgent
36 |
37 |
38 | Adware.MediaPlayer
39 |
40 |
41 |
42 | Adware.MusixLib
43 |
44 |
45 |
46 | Adware.GoMovix
47 |
48 |
49 |
50 | Adware.Adblock Super
51 |
52 |
53 |
54 |
55 | Adware.Webpage Screenshot
56 |
57 |
58 |
59 | Adware.Download Helper
60 |
61 |
62 |
63 |
64 | PUP.WalletBee
65 |
66 |
67 |
68 | PUP.NewTabTV
69 |
70 |
71 |
72 | PUP.MovixHub
73 |
74 |
75 |
76 | PUP.MusixHub
77 |
78 |
79 |
80 | PUP.SaveFrom.net Helper
81 |
82 |
83 |
84 | PUP.GeniusBox
85 |
86 |
87 |
88 | Adware.AdBeaver
89 |
90 |
91 |
92 | PUP.ShowIP
93 |
94 |
95 |
96 |
--------------------------------------------------------------------------------