SurfBuyer Adware (Mac)

Also Known As: Ads by SurfBuyer
Type: Adware
Distribution: Moderate
Damage level: Medium

How to remove SurfBuyer from Mac?

What is SurfBuyer?

SurfBuyer is a rogue application claiming to save time and money by notifying users of special deals/discounts available on various e-shops, providing coupons, enabling price comparison, and other similar features. These claims often trick users into believing that SurfBuyer is legitimate and useful. In fact, this app is categorized as a potentially unwanted program (PUP) and adware. There are three main reasons for these negative associations: 1) infiltration without users' consent; 2) display of intrusive online advertisements, and; 3) tracking of Internet browsing activity.

SurfBuyer adware

Following infiltration, SurfBuyer employs a 'virtual layer' to generate pop-up, coupon, banner, and other similar advertisements. The virtual layer enables placement of third party graphical content on any site. Therefore, the displayed ads often conceal underlying web content, thereby significantly diminishing the web browsing experience. Furthermore, they often generate results leading to malicious websites - clicking them is risky and can result in further adware or malware infections. Another downside is information tracking. SurfBuyer records IP addresses, websites visited, pages viewed, queries entered into search engines, and other similar data relating to web browsing activity. Note that this collected data might include personal details that SurfBuyer's developers share with cooperating third party companies. There is a high probability that personal information will be misused to generate revenue. Therefore, the presence of an information-tracking app such as SurfBuyer on your system can lead to serious privacy issues or even identity theft. You are strongly advised to eliminate this adware immediately.

SurfBuyer is identical to MyShopBot, My WebEnhancer, My ShopMate, and a number of other applications. Furthermore, it shares many similarities with hundreds of other adware-type programs. All claim to enhance the web browsing experience by providing 'useful features', however, these promises are merely attempts to give the impression of legitimacy. Adware-type applications are designed only to generate revenue for the developers and regular users receive no value. These applications deliver intrusive online advertisements and continually record various data.

How did SurfBuyer install on my computer?

SurfBuyer has an official download website, however, developers also promote it using a deceptive marketing method called "bundling". Research shows that many users rush the download/installation processes and skip most steps. Therefore, bundled applications are hidden within the "Custom" or "Advanced" settings. Skipping this section often leads to inadvertent installation of bogus programs.

How to avoid installation of potentially unwanted applications?

This situation can be prevented by taking two simple steps. Firstly, never rush when downloading and installing software - select the "Custom/Advanced" settings and closely analyze each step. Secondly, decline offers to download/install additional applications and opt-out of those already included. The key to computer safety is caution.

Here's how ads generated by SurfBuyer adware looks like on an infected computer:

surfbuyer adware sample ads

SurfBuyer adware generating intrusive online ads (marked as 'Powered by SurfBuyer' or 'Ad by SurfBuyer'):

surfbuyer adware pop-up ads surfbuyer adware generating online ads

Deceptive application installer promoting SurfBuyer adware:

Delusive installer used to promote SurfBuyer

Website promoting SurfBuye adwarer:

Dubious website used to promote SurfBuyer

Quick menu:

Video showing how to remove adware and browser hijackers from a Mac computer:

SurfBuyer adware removal:

Remove SurfBuyer-related potentially unwanted applications from your "Applications" folder:

mac adware removal from applications folder

Click the Finder icon. In the Finder window, select “Applications”. In the applications folder, look for “MPlayerX”,“NicePlayer”, or other suspicious applications and drag them to the Trash. After removing the potentially unwanted application(s) that cause online ads, scan your Mac for any remaining unwanted components.


Download remover for Ads by SurfBuyer

Remove ads by surfbuyer adware related files and folders:

Finder go to folder command

Click the Finder icon, from the menu bar. Choose Go, and click Go to Folder...

step1Check for adware-generated files in the /Library/LaunchAgents folder:

removing adware from launch agents folder step 1

In the Go to Folder... bar, type: /Library/LaunchAgents

removing adware from launch agents folder step 2
In the “LaunchAgents” folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - “installmac.AppRemoval.plist”, “myppes.download.plist”, “mykotlerino.ltvbit.plist”, “kuklorest.update.plist”, etc. Adware commonly installs several files with the same string.

step2Check for adware generated files in the /Library/Application Support folder:

removing adware from application support folder step 1

In the Go to Folder... bar, type: /Library/Application Support

removing adware from application support folder step 2
In the “Application Support” folder, look for any recently-added suspicious folders. For example, “MplayerX” or “NicePlayer”, and move these folders to the Trash.

step3Check for adware-generated files in the ~/Library/LaunchAgents folder:

removing adware from ~launch agents folder step 1


In the Go to Folder bar, type: ~/Library/LaunchAgents

removing adware from ~launch agents folder step 2

In the “LaunchAgents” folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - “installmac.AppRemoval.plist”, “myppes.download.plist”, “mykotlerino.ltvbit.plist”, “kuklorest.update.plist”, etc. Adware commonly installs several files with the same string.

step4Check for adware-generated files in the /Library/LaunchDaemons folder:

removing adware from launch daemons folder step 1
In the Go to Folder... bar, type: /Library/LaunchDaemons

removing adware from launch daemons folder step 2
In the “LaunchDaemons” folder, look for recently-added suspicious files. For example “com.aoudad.net-preferences.plist”, “com.myppes.net-preferences.plist”, "com.kuklorest.net-preferences.plist”, “com.avickUpd.plist”, etc., and move them to the Trash.

After removing files and folders generated by the adware, continue to remove rogue extensions from your Internet browsers.

Ads by SurfBuyer adware removal from Internet browsers:

safari browser iconRemove malicious extensions from Safari:

Remove ads by surfbuyer related Safari extensions:

safari browser preferences

Open Safari browser, from the menu bar, select "Safari" and click "Preferences...".

safari extensions window

In the preferences window, select "Extensions" and look for any recently-installed suspicious extensions. When located, click the "Uninstall" button next to it/them. Note that you can safely uninstall all extensions from your Safari browser - none are crucial for normal browser operation.

  • If you continue to have problems with browser redirects and unwanted advertisements - Reset Safari.

firefox browser iconRemove malicious plug-ins from Mozilla Firefox:

Remove ads by surfbuyer related Mozilla Firefox add-ons:

accessing mozilla firefox add-ons

Open your Mozilla Firefox browser. At the top right corner of the screen, click the "Open Menu" (three horizontal lines) button. From the opened menu, choose "Add-ons".

removing malicious add-ons from mozilla firefox

Choose the "Extensions" tab and look for any recently-installed suspicious add-ons. When located, click the "Remove" button next to it/them. Note that you can safely uninstall all extensions from your Mozilla Firefox browser - none are crucial for normal browser operation.

  • If you continue to have problems with browser redirects and unwanted advertisements - Reset Mozilla Firefox.

chrome-browser-iconRemove malicious extensions from Google Chrome:

Remove ads by surfbuyer related Google Chrome add-ons:

removing malicious google chrome extensions step 1

Open Google Chrome and click the "Chrome menu" (three horizontal lines) button located in the top-right corner of the browser window. From the drop-down menu, choose "More Tools" and select "Extensions".

removing malicious Google Chrome extensions step 2

In the "Extensions" window, look for any recently-installed suspicious add-ons. When located, click the "Trash" button next to it/them. Note that you can safely uninstall all extensions from your Google Chrome browser - none are crucial for normal browser operation.

  • If you continue to have problems with browser redirects and unwanted advertisements - Reset Google Chrome.