├── AdvancedMacCleaner.adf ├── Apple-HT203987.adf ├── AskToolbar.adf ├── AwesomeScreenshot.adf ├── BestYouTubeDownloader.adf ├── ChatZum.adf ├── Conduit.adf ├── Crossrider.adf ├── CustomSearch.adf ├── FkCodec.adf ├── Genieo.adf ├── GoPhoto.adf ├── Hola.adf ├── JDIBackup.adf ├── ListenToYouTube.adf ├── MacKeeper.adf ├── MegaBackup.adf ├── OperatorMac.adf ├── PremierOpinion.adf ├── README.MD ├── SaveKeep.adf ├── Spigot.adf ├── VSearch.adf ├── Vidx-MacVX.adf ├── Yontoo.adf ├── ZipCloud.adf └── multimalware.adf /AdvancedMacCleaner.adf: -------------------------------------------------------------------------------- 1 | 2 | 90 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | 7 | PUP.Advanced Mac Cleaner 8 | /Applications/Advanced Mac Cleaner.app 9 | /Library/Application Support/amc/ 10 | /Users/*/Library/Advanced Mac Cleaner 11 | /Users/*/Library/hlpramc 12 | /Users/*/Library/Application Support/Advanced Mac Cleaner 13 | /Users/*/Library/Application Support/amc 14 | /Users/*/Library/LaunchAgents/com.pcv.hlpramc.plist 15 | 16 | 17 | -------------------------------------------------------------------------------- /Apple-HT203987.adf: -------------------------------------------------------------------------------- 1 | 2 | 1.1 3 | 1.1.0 4 | Shea Craig 5 | https://support.apple.com/en-us/ht203987 6 | 10 | 11 | Downlite and VSearch Variants 12 | 13 | http://www.deal-top.com 14 | /System/Library/Frameworks/v.framework 15 | /System/Library/Frameworks/VSearch.framework 16 | /Library/PrivilegedHelperTools/Jack 17 | /Library/LaunchDaemons/Jack.plist 18 | /Users/*/Library/Caches/com.VSearch.bulk.installer 19 | /Users/*/Library/Caches/com.VSearch.VSinstaller 20 | /Users/*/Library/Saved Application State/com.VSearch.bulk.installer.savedstate 21 | 23 | 24 | /Library/LaunchAgents/com.*.agent.plist 25 | /Library/LaunchDaemons/com.*.helper.plist 26 | /Library/LaunchDaemons/com.*.daemon.plist 27 | .*/Library/Application Support/(.*)/Agent/agent.app/Contents/MacOS/agent 28 | AGENT 29 | 30 | /Library/Application Support/%AGENT% 31 | 32 | 33 | Conduit, Trovi, MyBrand, and Search Protect Variants 34 | 35 | /Library/InputManagers/CTLoader/ 36 | /Library/Application Support/Conduit/ 37 | /Users/*/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin 38 | /Users/*/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin 39 | /Applications/SearchProtect.app 40 | /Users/*/Conduit/ 41 | /Users/*/Trovi/ 42 | /Users/*/Library/Caches/com.Conduit.takeOverSearchAssetsMac 43 | 44 | 45 | Genieo and InstallMac 46 | 47 | /private/etc/launchd.conf 48 | /Applications/Genieo 49 | /Applications/InstallMac 50 | /Applications/Uninstall Genieo 51 | /Applications/Uninstall IM Completer.app 52 | /usr/lib/libgenkit.dylib 53 | /usr/lib/libgenkitsa.dylib 54 | /usr/lib/libimckit.dylib 55 | /usr/lib/libimckitsa.dylib 56 | /Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client 57 | /Users/*/Library/Application Support/Genieo/ 58 | /Users/*/Library/Application Support/com.genieoinnovation.Installer/ 59 | /Library/Frameworks/GenieoExtra.framework 60 | /Library/LaunchAgents/com.genieo.completer.update.plist 61 | /Library/LaunchAgents/com.genieo.engine.plist 62 | /Library/LaunchAgents/com.genieoinnovation.macextension.client.plist 63 | /Library/LaunchAgents/com.genieoinnovation.macextension.plist 64 | /Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist 65 | /Users/*/Library/LaunchAgents/com.genieo.completer.download.plist 66 | /Users/*/Library/LaunchAgents/com.genieo.completer.ltvbit.plist 67 | /Users/*/Library/LaunchAgents/com.genieo.completer.update.plist 68 | /Users/*/Library/Preferences/com.genieo.global.settings.plist.lockFile 69 | /Users/*/Library/Preferences/com.geneio.settings.plist.lockFile 70 | /Users/*/Library/Preferences/com.geneio.global.settings.plist 71 | /Users/*/Library/Saved Application State/com.genieo.RemoveGenieoMac.savedState 72 | 73 | -------------------------------------------------------------------------------- /AskToolbar.adf: -------------------------------------------------------------------------------- 1 | 2 | 1.0 3 | 1.1.0 4 | Elliot Jordan 5 | Linde Group 6 | 7 | Ask Toolbar 8 | 9 | /Users/*/Library/Application Support/Sponsors.framework 10 | /Library/Application Support/ASK 11 | /Library/Application Support/Firefox/Profiles/*/searchplugins/toolbar_*@apn.ask.com.xpi 12 | /Library/Application Support/Firefox/Profiles/*/searchplugins/ask-search.xml 13 | /Library/Application Support/Chrome/*/Extensions/aaaaaogokkamlflcoccdihncmbgcmfln 14 | /Library/Application Support/Chrome/External Extensions/aaaaaogokkamlflcoccdihncmbgcmfln.json 15 | /Users/*/Safari/Extensions/Search App by Ask*.safariextz 16 | 17 | 18 | -------------------------------------------------------------------------------- /AwesomeScreenshot.adf: -------------------------------------------------------------------------------- 1 | 2 | 1.0 3 | 1.1.0 4 | Elliot Jordan 5 | Linde Group 6 | 7 | Awesome Screenshot 8 | 9 | 10 | /Users/*/Library/Application Support/Google/Chrome/Default/Extensions/alelhddbbhepgpmgidjdcjakblofbmce 11 | 12 | 13 | -------------------------------------------------------------------------------- /BestYouTubeDownloader.adf: -------------------------------------------------------------------------------- 1 | 2 | 95 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | 7 | Best YouTube Downloader 8 | 9 | /Users/*/Library/LaunchAgents/com.moeppfdpoohhdcaefbfpmabjipnohiif.updater.plist 10 | 11 | 12 | -------------------------------------------------------------------------------- /ChatZum.adf: -------------------------------------------------------------------------------- 1 | 2 | 95 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | 7 | ChatZum 8 | 9 | /Applications/ChatZumUninstaller.pkg 10 | /Library/Application Support/SIMBL/Plugins/SafariOmnibar.bundle 11 | /Library/Internet Plug-Ins/uid.plist 12 | /Library/Internet Plug-Ins/zako.plugin 13 | 14 | 15 | -------------------------------------------------------------------------------- /Conduit.adf: -------------------------------------------------------------------------------- 1 | 2 | 95 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | This definition is based on the AdwareMedic list of files, not the Apple kbase article. It includes some different things. 7 | 8 | Conduit 9 | 12 | /Users/*/Library/Application Support/Google/Chrome/Default/Extensions/cbmjmfcldbpelhknnfjbkobmabafpoed 13 | /Library/InputManagers/CTLoader/ 14 | /Library/LaunchAgents/com.conduit.loader.agent.plist 15 | /Library/LaunchDaemons/com.perion.searchprotectd.plist 16 | /Library/Application Support/SIMBL/Plugins/CT2285220.bundle 17 | /Library/Application Support/Conduit/ 18 | /Applications/SearchProtect.app 19 | SearchProtect 20 | searchprotect 21 | /Applications/SearchProtect/ 22 | /Users/*/Conduit 23 | /Users/*/Trovi 24 | 25 | /Users/*/Conduit 26 | search\.conduit\.com 27 | 28 | /Users/*/Library/Application Support/Conduit 29 | 30 | /Users/*/Library/Application Support/Conduit 31 | /Library/Application Support/Conduit 32 | search\.conduit\.com 33 | 34 | /Users/*/Library/Caches/com.Conduit.takeOverSearchAssetsMac 35 | /Users/*/Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin 36 | /Users/*/Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin 37 | /Users/*/Library/Application Support/Firefox/Profiles/*/searchplugins/conduit.xml 38 | /Users/*/Library/Application Support/Firefox/Profiles/*/searchplugins/MyBrand.xml 39 | /Users/*/Library/Application Support/Firefox/Profiles/*/searchplugins/'Conduit Customized Web Search'.xml 40 | /Users/*/Library/Application Support/Firefox/Profiles/*/takeOverNewTab.txt 41 | /Users/*/Library/Application Support/Firefox/Profiles/*/abstraction.js 42 | 43 | 44 | -------------------------------------------------------------------------------- /Crossrider.adf: -------------------------------------------------------------------------------- 1 | 2 | 95 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | This is a work in progress, and as such, many lines are as of yet unconverted to ADF format. 7 | 8 | Crossrider 9 | 14 | /Users/*/Library/Application Support/Google/Chrome/External Extensions/phpdijfdkggndfmgcfdhcimlflflnega.json 15 | /Users/*/Library/LaunchAgents/Safari Security 16 | 17 | /Library 18 | (cinema(s?)[- \+]*(plus|\+)?[- \+]*(pro|hd)?)|(cinema(s?) ?pl[aeiou]+s) 19 | com\.(cinema(s?)[- \+]*(plus|\+)?[- \+]*(pro|hd)?)|(cinema(s?) ?pl[aeiou]+s)\.Service 20 | 21 | 22 | /Users/*/Library/LaunchAgents 23 | flashmall 24 | shopp?y.?mate 25 | palmall 26 | 27 | 28 | /Users/*/Library/LaunchAgents 29 | /Library/LaunchAgents 30 | /Library/LaunchDaemons 31 | (cinema(s?)[- \+]*(plus|\+)?[- \+]*(pro|hd)?)|(cinema(s?) ?pl[aeiou]+s) 32 | 33 | 34 | /Users/*/Library/LaunchAgents 35 | com\.crossrider\.wss\d+\.agent\.plist 36 | 37 | /Users/*/Library/LaunchAgents/WebSocketServerApp 38 | /Users/*/Library/LaunchAgents/com.webhelper.plist 39 | /Users/*/Library/LaunchAgents/com.webtools.update.agent.plist 40 | /Users/*/Library/LaunchAgents/com.webtools.uninstaller.plist 41 | 42 | /Library/LaunchAgents 43 | com\.webhelper\..*\.plist 44 | /Library/Application Support/webhelper 45 | 46 | 47 | /Library/LaunchAgents 48 | com\.webshopper\..*\.plist 49 | /Library/Application Support/WebShopper 50 | 51 | 52 | /Users/*/Library/LaunchAgents 53 | com\.webtools\..*\.plist 54 | /Library/Application Support/WebTools 55 | 56 | /Users/*/Library/Application Support/webHelperApp/ 57 | /Users/*/Library/Application Support/webhelper/ 58 | /Users/*/Library/Application Support/WebTools/ 59 | /Users/*/Library/Application Support/WebShopper/ 60 | /Users/*/Library/WebTools/ 61 | /Users/*/Library/flashmall/ 62 | /Applications/WebTools.app 63 | /Applications/WebShopper.app 64 | /Users/*/Applications/flashmall.app 65 | 66 | /Applications 67 | /Users/*/Applications 68 | cinema(s?)[- \+]*((plus)|(pro))[- \+0123456789]* 69 | 70 | 71 | /Users/*/Library/cinemapro1-2 72 | /Users/*/Library/LaunchAgents/UpdateDownloader 73 | 74 | /Users/*/Library/LaunchAgents 75 | \.agent\.plist 76 | UpdateDownloader 77 | 78 | 79 | /Users/*/Library/LaunchAgents 80 | com\.extensions\.updater[0123456789]*\.ver 81 | 82 | /Users/*/Library/ScriptingAdditions/BrowserHelper.osax 83 | 84 | 85 | -------------------------------------------------------------------------------- /CustomSearch.adf: -------------------------------------------------------------------------------- 1 | 2 | 95 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | 7 | CustomSearch 8 | 9 | /Users/*/Applications/SilentInstaller.app 10 | SilentInstaller 11 | silentinstaller 12 | LinkuryMac 13 | linkurymac 14 | 15 | 16 | -------------------------------------------------------------------------------- /FkCodec.adf: -------------------------------------------------------------------------------- 1 | 2 | 95 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | 7 | FkCodec 8 | 9 | /Users/*/Library/Application Support/Codec-M 10 | /Users/*/Library/LaunchAgents/com.codecm.uploader.plist 11 | /Applications/Codec-M.app 12 | Codec-M 13 | codec-m 14 | 15 | 16 | -------------------------------------------------------------------------------- /Genieo.adf: -------------------------------------------------------------------------------- 1 | 2 | 95 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | This definition is based on the AdwareMedic list of files, not the Apple kbase article. It includes some different things. 7 | This is a work in progress, and as such, many lines are as of yet unconverted to ADF format. 8 | 9 | Genieo 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | /Users/*/Library/LaunchAgents 18 | /private/var/root/Library/LaunchAgents 19 | \.((download)|(update)|(ltvbit))\.plist 20 | \-firstAppId 21 | 22 | /Library/LaunchAgents/com.genieoinnovation.macextension.plist 23 | /Library/LaunchAgents/com.genieoinnovation.macextension.client.plist 24 | /Library/LaunchAgents/com.genieo.engine.plist 25 | /Library/LaunchAgents/com.genieo.completer.update.plist 26 | /Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist 27 | /Applications/Celipsow.app 28 | /Applications/Feelbegin.app 29 | /Applications/Epolife.app 30 | /Applications/Genieo.app.app 31 | /Applications/InKeepr.app.app 32 | /Applications/InKeepr.app 33 | /Applications/InstallGenieo.app.app 34 | /Applications/InstallMac.app 35 | /Applications/JakeCares.app 36 | /Applications/Javeview.app 37 | /Applications/Jimbrie.app 38 | /Applications/Kuklorest.app 39 | /Applications/Leperdvil.app 40 | /Applications/Listchack.app 41 | /Applications/Lunaticake.app 42 | /Applications/mainorne.app 43 | /Applications/montageobox.app 44 | /Applications/Myppes.app 45 | /Applications/Nariabox.app 46 | /Applications/Olivernetko.app 47 | /Applications/Oliverto.app 48 | /Applications/Opinteks.app 49 | /Applications/Otwexplain.app 50 | /Applications/Portsayd.app 51 | /Applications/Qamails.app 52 | /Applications/Quitelex.app 53 | /Applications/Reset Search.app.app 54 | /Applications/Texiday.app 55 | /Applications/Totiteck.app 56 | /Applications/Uninstall Genieo.app 57 | /Applications/Uninstall IM Completer.app 58 | /Applications/Epolife 59 | /Applications/FriendlySocket 60 | /Applications/pdf/pdf.pronto 61 | /Applications/pdf/Uninstallpdf.pronto 62 | /Applications/pronto/pdf.pronto 63 | AppYM 64 | genieo 65 | Genieo 66 | inkeepr 67 | InKeepr 68 | installgenieo 69 | InstallGenieo 70 | /Users/*/Library/Application Support/Asistents 71 | /Users/*/Library/Application Support/Celipsow 72 | /Users/*/Library/Application Support/com.genieoinnovation.Installer 73 | /Users/*/Library/Application Support/Epolife 74 | /Users/*/Library/Application Support/Feelbegin 75 | /Users/*/Library/Application Support/Genieo 76 | /Users/*/Library/Application Support/IM.Installer 77 | /Users/*/Library/Application Support/InKeepr 78 | /Users/*/Library/Application Support/JakeCares 79 | /Users/*/Library/Application Support/Javeview 80 | /Users/*/Library/Application Support/Jimbrie 81 | /Users/*/Library/Application Support/Kuklorest 82 | /Users/*/Library/Application Support/Leperdvil 83 | /Users/*/Library/Application Support/Listchack 84 | /Users/*/Library/Application Support/Lunaticake 85 | /Users/*/Library/Application Support/mainorne 86 | /Users/*/Library/Application Support/Manroling 87 | /Users/*/Library/Application Support/montageobox 88 | /Users/*/Library/Application Support/Myppes 89 | /Users/*/Library/Application Support/Nariabox 90 | /Users/*/Library/Application Support/Olivernetko 91 | /Users/*/Library/Application Support/Oliverto 92 | /Users/*/Library/Application Support/Opinteks 93 | /Users/*/Library/Application Support/Otwexplain 94 | /Users/*/Library/Application Support/Portsayd 95 | /Users/*/Library/Application Support/ProntoApp 96 | /Users/*/Library/Application Support/Qamails 97 | /Users/*/Library/Application Support/Quitelex 98 | /Users/*/Library/Application Support/Smokyashan 99 | /Users/*/Library/Application Support/Smacklek 100 | /Users/*/Library/Application Support/Totiteck 101 | /Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client 102 | /Library/Frameworks/GenieoExtra.framework 103 | /Users/*/Library/Application Support/Firefox/Profiles/*/searchplugins/my-homepage.xml 104 | /Users/*/Library/LaunchAgents/com.genieo.completer.download.plist 105 | /Users/*/Library/LaunchAgents/com.genieo.completer.ltvbit.plist 106 | /Users/*/Library/LaunchAgents/com.genieo.completer.update.plist 107 | /Users/*/Library/LaunchAgents/com.installer.completer.download.plist 108 | /Users/*/Library/LaunchAgents/com.installer.completer.ltvbit.plist 109 | /Users/*/Library/LaunchAgents/com.installer.completer.update.plist 110 | /Users/*/Library/LaunchAgents/Feelbegin.AppRemoval.plist 111 | /Users/*/Library/LaunchAgents/Javeview.download.plist 112 | /Users/*/Library/LaunchAgents/Javeview.ltvbit.plist 113 | /Users/*/Library/LaunchAgents/Javeview.update.plist 114 | /Users/*/Library/LaunchAgents/Kuklorest.AppVemoral.plist 115 | /Users/*/Library/LaunchAgents/Kuklorest.btvlit.plist 116 | /Users/*/Library/LaunchAgents/Kuklorest.dowlnoad.plist 117 | /Users/*/Library/LaunchAgents/Kuklorest.uadpte.plist 118 | /Users/*/Library/LaunchAgents/Lunaticake.AppVemoral.plist 119 | /Users/*/Library/LaunchAgents/Lunaticake.dowlnoad.plist 120 | /Users/*/Library/LaunchAgents/Lunaticake.btvlit.plist 121 | /Users/*/Library/LaunchAgents/Lunaticake.uadpte.plist 122 | /Users/*/Library/LaunchAgents/Pagerpost.AppRemoval.plist 123 | /Users/*/Library/LaunchAgents/pronto.notification.plist 124 | /Users/*/Library/LaunchAgents/pronto.update.plist 125 | /Users/*/Library/LaunchAgents/Smokyashan.update.plist 126 | /Users/*/Library/LaunchAgents/Smacklek.AppVemoral.plist 127 | /Users/*/Library/LaunchAgents/Smacklek.dolnwoad.plist 128 | /Users/*/Library/LaunchAgents/Smacklek.btvlit.plist 129 | /Users/*/Library/LaunchAgents/Smacklek.uadpte.plist 130 | /Users/*/Library/LaunchAgents/texiday.download.plist 131 | /Users/*/Library/LaunchAgents/texiday.ltvbit.plist 132 | /Users/*/Library/LaunchAgents/texiday.update.plist 133 | /Users/*/Library/LaunchAgents/Mainorne.AppRemoval.plist 134 | /Users/*/Library/LaunchAgents/Mainorne.AppVemoral.plist 135 | /Users/*/Library/LaunchAgents/Mainorne.dolnwoad.plist 136 | /Users/*/Library/LaunchAgents/Mainorne.btvlit.plist 137 | /Users/*/Library/LaunchAgents/Mainorne.upadte.plist 138 | 139 | /private/etc/launchd.conf 140 | lib(gen|imc)kit(sa)?\.dylib 141 | 142 | /usr/lib/libgenkit.dylib 143 | /usr/lib/libgenkitsa.dylib 144 | /usr/lib/libimckit.dylib 145 | /usr/lib/libimckitsa.dylib 146 | /Users/*/Library/Safari/Extensions/Friendlysocket* 147 | /Users/*/Library/Safari/Extensions/Lunaticake.safariextz 148 | /Users/*/Library/Safari/Extensions/Mainorne.safariextz 149 | /Users/*/Library/Safari/Extensions/Nariabox.safariextz 150 | /Users/*/Library/Safari/Extensions/Oliverto.safariextz 151 | /Users/*/Library/Safari/Extensions/Omnibar.safariextz 152 | /Users/*/Library/Safari/Extensions/Poptotop.safariextz 153 | /Users/*/Library/Safari/Extensions/Ratplee.safariextz 154 | 155 | 156 | -------------------------------------------------------------------------------- /GoPhoto.adf: -------------------------------------------------------------------------------- 1 | 2 | 90 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | The source for this adware seems to no longer specify this in its definitions. 7 | 8 | GoPhoto 9 | /Users/*/Library/Application Support/Google/Chrome/External Extensions/ccfjbdjailljfihgkoccfbiljjapiijb.json 10 | 11 | 12 | 13 | 14 | -------------------------------------------------------------------------------- /Hola.adf: -------------------------------------------------------------------------------- 1 | 2 | 1.0 3 | 1.1.0 4 | David West 5 | David West 6 | 7 | Hola 8 | /Users/*/Library/Application Support/Google/Chrome/Default/Extensions/gkojfkhlekighikafcpjkiklfbnlmeio 9 | 10 | 11 | -------------------------------------------------------------------------------- /JDIBackup.adf: -------------------------------------------------------------------------------- 1 | 2 | 1.1 3 | 1.1.0 4 | Shea Craig 5 | Durham Academy 6 | 7 | ZipCloud/JustCloud 8 | 9 | /Applications/JustCloud.app 10 | /Users/*/Library/LaunchAgents/com.jdibackup.JustCloud.autostart.plist 11 | /Users/*/Library/LaunchAgents/com.jdibackup.JustCloud.backupstart.plist 12 | /Users/*/Library/LaunchAgents/com.jdibackup.JustCloud.notify.plist 13 | /Users/*/Library/Logs/JustCloud 14 | /Users/*/Library/Preferences/com.jdibackup.JustCloud.plist 15 | /Users/*/Library/Saved Application State/com.jdibackup.JustCloud.savedState 16 | JustCloud 17 | 18 | /Applications/ZipCloud.app 19 | /Users/*/Library/LaunchAgents/com.jdibackup.ZipCloud.autostart.plist 20 | /Users/*/Library/LaunchAgents/com.jdibackup.ZipCloud.backupstart.plist 21 | /Users/*/Library/LaunchAgents/com.jdibackup.ZipCloud.notify.plist 22 | /Users/*/Library/Logs/ZipCloud 23 | /Users/*/Library/Preferences/com.jdibackup.ZipCloud.plist 24 | /Users/*/Library/Saved Application State/com.jdibackup.ZipCloud.savedState 25 | ZipCloud 26 | 27 | /Users/*/Library/Services/Add to Backup Selection.workflow 28 | /Users/*/Library/Services/Instant Backup.workflow 29 | /Users/*/Library/Services/Remove from Backup Selection.workflow 30 | /Users/*/Library/Services/View Previous Versions.workflow 31 | 32 | 33 | -------------------------------------------------------------------------------- /ListenToYouTube.adf: -------------------------------------------------------------------------------- 1 | 2 | 95 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | This is a work in progress, and as such, many lines are as of yet unconverted to ADF format. 7 | 8 | ListenToYouTube 9 | 10 | /Library/LaunchDaemons/* 11 | <string>/Library/Application Support/ListenToYoutube/[^/]*/ListenToYoutube</string> 12 | 13 | /Library/Application Support/ListenToYoutube 14 | 15 | 16 | -------------------------------------------------------------------------------- /MacKeeper.adf: -------------------------------------------------------------------------------- 1 | 2 | 1.0 3 | 1.1.0 4 | Shea Craig 5 | Durham Academy 6 | 7 | MacKeeper 8 | /Users/*/Library/LaunchAgents/com.*.MacKeeper.Helper.plist 9 | /Users/*/Documents/MacKeeper Backups 10 | /Applications/MacKeeper.app 11 | /Users/*/Library/Application Support/MacKeeper Helper 12 | /Users/*/Library/Caches/com.mackeeper.MacKeeper 13 | MacKeeper 14 | 15 | 16 | 17 | -------------------------------------------------------------------------------- /MegaBackup.adf: -------------------------------------------------------------------------------- 1 | 2 | 90 3 | 1.1.0 4 | Zack McCauley 5 | Infected Machine, App Cleaner output 6 | 7 | MegaBackup 8 | /Applications/MegaBackup.app 9 | /Users/*/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.megabackup.megabackup-uninstaller.sfl 10 | /Users/*/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/ com.megabackup.megabackup.sfl 11 | /Users/*/Library/Caches/com.megabackup.* 12 | /Users/*/Library/Preferences/com.megabackup.* 13 | megabackup 14 | MegaBackup 15 | 16 | 17 | -------------------------------------------------------------------------------- /OperatorMac.adf: -------------------------------------------------------------------------------- 1 | 2 | 95 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | Do not use this ADF! At the moment, it only deletes your Chrome preferences. 7 | This is a work in progress, and as such, many lines are as of yet unconverted to ADF format. 8 | 9 | OperatorMac 10 | 11 | 12 | 13 | /Users/*/Library/Application Support/Firefox/Profiles/*/searchplugins/mySearchPlug.xml 14 | Opti[ -]?Page 15 | 16 | 17 | 18 | /Users/*/Library/Application Support/mediahm/ 19 | 20 | /Users/*/Library/LaunchDaemons/com.mediahm.operator.update.plist 21 | 22 | 23 | -------------------------------------------------------------------------------- /PremierOpinion.adf: -------------------------------------------------------------------------------- 1 | 2 | 95 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | 7 | PremierOpinion 8 | /Applications/PremierOpinion 9 | /Library/LaunchAgents/PremierOpinionAgent.plist 10 | /Library/LaunchDaemons/PremierOpinion.plist 11 | 12 | 13 | / 14 | ^[a-z]$ 15 | <MACSNIFFER> 16 | 17 | 18 | 19 | -------------------------------------------------------------------------------- /README.MD: -------------------------------------------------------------------------------- 1 | Adware Definition Files 2 | ======================= 3 | 4 | This repository collects Adware Definition Files (ADF) for [SavingThrow](https://github.com/sheagcraig/SavingThrow) which have been tested and are generally considered to be safe and effectively designed. 5 | 6 | A number have just been added thanks to Owen Pragel (@opragel) which have unfinished lines commented out. For the purposes of looking for potential adware on a machine, these commented out lines will not interfere; the ADF may just not be finding everything there is to find. 7 | 8 | To use, feel free to fork, or download and self-host with your own modifications for your own organization. 9 | 10 | Contributions are welcome! (Use Pull Requests to add or correct an ADF). -------------------------------------------------------------------------------- /SaveKeep.adf: -------------------------------------------------------------------------------- 1 | 2 | 90 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | 7 | SaveKeep 8 | 9 | /Applications/Savekeep.app 10 | 11 | 12 | -------------------------------------------------------------------------------- /Spigot.adf: -------------------------------------------------------------------------------- 1 | 2 | 96 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | 7 | Spigot 8 | 9 | /Users/*/Library/Application Support/Firefox/Profiles/*/extensions/searchme@mybrowserbar.com.xpi 10 | /Users/*/Library/LaunchAgents/com.spigot.SearchProtection.plist 11 | /Users/*/Library/LaunchAgents/com.spigot.ApplicationManager.plist 12 | /Users/*/Library/Application Support/Spigot/ 13 | 14 | /Users/*/Library/Application Support/Firefox/Profiles/*/searchplugins 15 | .*\.xml 16 | search\.yahoo\.com/search\?fr=spigot 17 | 18 | 19 | 20 | -------------------------------------------------------------------------------- /VSearch.adf: -------------------------------------------------------------------------------- 1 | 2 | 95 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | This definition is based on the AdwareMedic list of files, not the Apple kbase article. It includes some different things. 7 | This is a work in progress, and as such, many lines are as of yet unconverted to ADF format. 8 | 9 | VSearch 10 | /Library/Application Support/VSearch 11 | /Library/LaunchAgents/com.vsearch.agent.plist 12 | /Library/LaunchDaemons/com.vsearch.daemon.plist 13 | /Library/LaunchDaemons/com.vsearch.helper.plist 14 | /Library/LaunchDaemons/Jack.plist 15 | /Library/PrivilegedHelperTools/Jack 16 | /System/Library/Frameworks/v.framework 17 | /System/Library/Frameworks/VSearch.framework 18 | 19 | /Library/Application Support/*/Version.plist 20 | Frameworks/v\.framework 21 | 22 | 23 | /Library/Application Support/*/f 24 | <string>[0-9a-f]+\.com</string> 25 | 26 | 27 | /Library/Application Support/*/f 28 | zzz.loader 29 | 30 | 31 | /Library/Application Support 32 | ^[0-9a-f]{16}$ 33 | 34 | 35 | /Library/LaunchAgents 36 | com\.[^\.]+\.agent\.plist 37 | (com\.v\.agent)|(/Application Support/[0-9a-f]+/Agent/[^\.]+\.app) 38 | 39 | 40 | /Library/LaunchDaemons 41 | com\.[^\.]+\.(daemon|helper)\.plist 42 | (com\.v\.(daemon|helper))|(/Application Support/[0-9a-f]+/Agent/[^\.]+\.app) 43 | 44 | 45 | /Library/LaunchAgents 46 | /Library/LaunchDaemons 47 | com\.[^\.]+\.agent\.plist 48 | com\.[^\.]+\.(daemon|helper)\.plist 49 | /Agent/agent\.app/Contents/MacOS/agent 50 | 51 | /System/Library/Frameworks/AnoxicMitral.framework 52 | /System/Library/Frameworks/CompurgatorLlanberisslate.framework 53 | /System/Library/Frameworks/courbashguana.framework 54 | /System/Library/Frameworks/Horntail.framework 55 | /System/Library/Frameworks/leptoprosopic.framework 56 | /System/Library/Frameworks/Lycidae.framework 57 | /System/Library/Frameworks/PegasoidVaporizable.framework 58 | /System/Library/Frameworks/Underbeat.framework 59 | /System/Library/Frameworks/v.framework 60 | /Users/*/Library/Caches/com.VSearch.bulk.installer 61 | /Users/*/Library/Caches/com.VSearch.VSinstaller 62 | 63 | 64 | -------------------------------------------------------------------------------- /Vidx-MacVX.adf: -------------------------------------------------------------------------------- 1 | 2 | 95 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | This is a work in progress, and as such, many lines are as of yet unconverted to ADF format. 7 | 8 | Vidx/MacVX 9 | 10 | 11 | 12 | /Applications/MacMin.app 13 | /Applications/Vidx.app 14 | /Users/*/Applications/MacMin.app 15 | /Users/*/Applications/Vidx.app 16 | macmin 17 | MacMin 18 | vidx 19 | Vidx 20 | 21 | 22 | 23 | /Library/Application Support/VidToMP3/ 24 | 25 | /Library/LaunchDaemons/* 26 | /Library/Application Support/VidToMP3/ 27 | 28 | /Library/Application Support/fa4e8.94b.550d413f/ 29 | /Users/*/Library/Application Support/osxDownloader/ 30 | 31 | 32 | -------------------------------------------------------------------------------- /Yontoo.adf: -------------------------------------------------------------------------------- 1 | 2 | 95 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | 7 | Yontoo 8 | /Users/*/Library/Application Support/Google/Chrome/YontooLayers.crx 9 | 10 | 12 | 13 | 14 | -------------------------------------------------------------------------------- /ZipCloud.adf: -------------------------------------------------------------------------------- 1 | 2 | 1.1 3 | 1.1.0 4 | Shea Craig 5 | Durham Academy 6 | ZipCloud is included in the JDIBackup ADF found in this repo. This is a duplicate of that just to ensure people already using it don't lose the ability to scan for those files. 7 | 8 | ZipCloud/JustCloud 9 | 10 | /Applications/JustCloud.app 11 | /Users/*/Library/LaunchAgents/com.jdibackup.JustCloud.autostart.plist 12 | /Users/*/Library/LaunchAgents/com.jdibackup.JustCloud.backupstart.plist 13 | /Users/*/Library/LaunchAgents/com.jdibackup.JustCloud.notify.plist 14 | /Users/*/Library/Logs/JustCloud 15 | /Users/*/Library/Preferences/com.jdibackup.JustCloud.plist 16 | /Users/*/Library/Saved Application State/com.jdibackup.JustCloud.savedState 17 | JustCloud 18 | 19 | /Applications/ZipCloud.app 20 | /Users/*/Library/LaunchAgents/com.jdibackup.ZipCloud.autostart.plist 21 | /Users/*/Library/LaunchAgents/com.jdibackup.ZipCloud.backupstart.plist 22 | /Users/*/Library/LaunchAgents/com.jdibackup.ZipCloud.notify.plist 23 | /Users/*/Library/Logs/ZipCloud 24 | /Users/*/Library/Preferences/com.jdibackup.ZipCloud.plist 25 | /Users/*/Library/Saved Application State/com.jdibackup.ZipCloud.savedState 26 | ZipCloud 27 | 28 | /Users/*/Library/Services/Add to Backup Selection.workflow 29 | /Users/*/Library/Services/Instant Backup.workflow 30 | /Users/*/Library/Services/Remove from Backup Selection.workflow 31 | /Users/*/Library/Services/View Previous Versions.workflow 32 | 33 | 34 | -------------------------------------------------------------------------------- /multimalware.adf: -------------------------------------------------------------------------------- 1 | 2 | 90 3 | 1.1.0 4 | Owen Pragel 5 | http://www.adwaremedic.com/signatures.xml 6 | This is a work in progress, and as such, many lines are as of yet unconverted to ADF format. 7 | 8 | MacShop 9 | 10 | 11 | MacSmart 12 | 13 | 14 | News Ticker Remover 15 | 16 | 17 | PhotoZoom 18 | 19 | 20 | Shopper Helper Pro 21 | 22 | 23 | ArcadeYum 24 | 25 | 26 | DreamsAdNetwork 27 | 28 | 29 | FlashFree 30 | 31 | 32 | Recipe Hub 33 | 34 | 35 | ClickAgent 36 | 37 | 38 | Adware.MediaPlayer 39 | 40 | 41 | 42 | Adware.MusixLib 43 | 44 | 45 | 46 | Adware.GoMovix 47 | 48 | 49 | 50 | Adware.Adblock Super 51 | 52 | 53 | 54 | 55 | Adware.Webpage Screenshot 56 | 57 | 58 | 59 | Adware.Download Helper 60 | 61 | 62 | 63 | 64 | PUP.WalletBee 65 | 66 | 67 | 68 | PUP.NewTabTV 69 | 70 | 71 | 72 | PUP.MovixHub 73 | 74 | 75 | 76 | PUP.MusixHub 77 | 78 | 79 | 80 | PUP.SaveFrom.net Helper 81 | 82 | 83 | 84 | PUP.GeniusBox 85 | 86 | 87 | 88 | Adware.AdBeaver 89 | 90 | 91 | 92 | PUP.ShowIP 93 | 94 | 95 | 96 | --------------------------------------------------------------------------------