You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

An couple of apps keep installing on my mac. Green with white magnifying glass. One says "extrabrowser" and the other says "centralstructured". What are these?

A couple of apps keep installing on my Mac. A white screen will come on my desktop and say "loading" then say "installation complete". One is called "extrabrowser" and the other is "centralstructured". I do not use Safari, I use Firefox. I have Mojave 10.14.6. I keep moving them to the trash but they keep coming back.

iMac Line (2012 and Later)

Posted on Oct 11, 2019 6:20 AM

Reply
Question marked as Top-ranking reply

Posted on Oct 11, 2019 6:49 AM

Navigate to the following folder, and post its contents in a screenshot:


~/Library/LaunchAgents


To open that folder, copy the entire line above and paste it in the Finder's Go menu > Go to Folder... field. Make it look like this:





... and click the Go button.


A Finder window will open. Take a screenshot showing all that folder's contents, and post it in a reply. To learn how to do that please read the Appendix in the following User Tip: Writing an effective Apple Support Communities question.


Usually, there is nothing in that folder so don't be surprised to find it empty. The reason for starting with that folder is to eliminate other potential causes before proceeding with steps that will identify and eradicate whatever is affecting that Mac.


There will be additional instructions to follow and this is just the first step.


For a description of how this may have occurred, how to avoid it in the future, and for Apple's recommended actions read How to install adware.


Review your Gatekeeper settings. To learn about Gatekeeper read Safely open apps on your Mac. Gatekeeper is designed to help prevent you from inadvertently installing garbage software.

Similar questions

8 replies
Question marked as Top-ranking reply

Oct 11, 2019 6:49 AM in response to Marfy33

Navigate to the following folder, and post its contents in a screenshot:


~/Library/LaunchAgents


To open that folder, copy the entire line above and paste it in the Finder's Go menu > Go to Folder... field. Make it look like this:





... and click the Go button.


A Finder window will open. Take a screenshot showing all that folder's contents, and post it in a reply. To learn how to do that please read the Appendix in the following User Tip: Writing an effective Apple Support Communities question.


Usually, there is nothing in that folder so don't be surprised to find it empty. The reason for starting with that folder is to eliminate other potential causes before proceeding with steps that will identify and eradicate whatever is affecting that Mac.


There will be additional instructions to follow and this is just the first step.


For a description of how this may have occurred, how to avoid it in the future, and for Apple's recommended actions read How to install adware.


Review your Gatekeeper settings. To learn about Gatekeeper read Safely open apps on your Mac. Gatekeeper is designed to help prevent you from inadvertently installing garbage software.

Oct 11, 2019 11:50 AM in response to Marfy33

First, ensure you have a reliable backup of your Mac, in case something should go wrong with continued troubleshooting. To learn how to do that, please read Back up your Mac with Time Machine.


  • A backup is a fundamental prerequisite regardless of whatever method you may choose uninstall adware, and would apply even if your Mac were running perfectly well. Do not overlook this fundamental requirement. It's important.


Next: This step is optional, but will preclude any related inability to use your Mac due to the adware's excessive demands imposed upon it. Restart in "Safe Mode", and log in: Use safe mode to isolate issues with your Mac. Starting in Safe Mode takes longer than usual so let it finish. The resource-demanding process will not appear while you are using your Mac in that mode.


The following files and / or folders need to be deleted while using your Mac in "Safe Mode":


~/Library/LaunchAgents:




/Library/LaunchDaemons:




Nothing needs to be deleted from /Library/LaunchAgents


Drag those selections of files to the Trash. You may be asked to authenticate. Confirm they are no longer present in that folder. Leave all the others alone for now.


Next: open Safari and select the Safari menu > Preferences... > Extensions. If you see any Extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone. No Safari Extensions are required for normal operation. Then, select the General pane and review your Homepage selection. Repeat those equivalent actions for any other browser you may use (Firefox in your case).


There may also be adware-associated app icons in your Mac's Applications folder. Open it and examine its contents. Any unwanted or mysterious app icons should be obvious to you, but again please don't remove anything if you are uncertain—ask first. Their names and icons will probably be identical to the ones in your Dock, but it's possible for them to be different or for them not to appear in Applications at all. Identify any suspicious apps by name, or post another screenshot.


Next: In an abundance of caution, examine System Preferences > Extensions. Determine if there are any Extensions that may have been installed without your knowledge. Ask if you're uncertain.


While you're there, check for the presence of any Profiles. Profiles are installed by organizations with a need to manage Macs deployed in institutional corporate or educational environments (for example), but have also been exploited by adware creators and similar malcontents.


Remaining within System Preferences, open Users & Groups. Select your User Account's Login Items. You may or may not find those Applications in its list. If you do, select them then click the [—] (minus) button to remove them from Login Items.


You can then restart your Mac and log in as usual. You may find those dock icons replaced with generic "question mark" icons, so just drag them away from the Dock. Confirm those rogue process(es) no longer appear in Activity Monitor, and that your Mac's operation generally returns to normal.


Next: if you want to eradicate all remaining adware remnants post a screenshot of the following folder, in the same manner as you did earlier:


~/Library/Application Support


It is normal for that folder to contain many items, but anything associated with the above adware will bear identical names ("ExtraBrowser" etc). If you find a folder or folders bearing that name, drag them to the Trash. Without the files you already removed or the reintroduction of similar malware, they can do nothing but occupy space. These can be removed if you wish, but again don't remove anything if you are uncertain.


Finally: If any of the above actions result in abnormal operation or if something else stops working, the easiest way to recover would be to restore the Time Machine backup you created as a prerequisite, so the importance of that fundamental step cannot be overemphasized.

Oct 11, 2019 8:32 AM in response to Marfy33

Thanks. The files that do not have Adobe in their names will need to be removed, but don't do that just yet. Otherwise they might just reappear again and again. The processes that can cause that need to be terminated and other potential hiding places need to be eliminated to preclude that from happening.


---


In the same manner as the above, open the following folder:


/Library/LaunchDaemons


To open that folder, copy and paste it in the Finder's Go menu > Go to Folder... field. It should look like this:



Once again ensure all its files and their names are readable, take a screenshot, and post it.


Then, repeat that exercise with the following folder:


/Library/LaunchAgents


Notice its pathname is different than the other two.


In the end, you will have captured and posted the contents of the following three separate folders:


~/Library/LaunchAgents

/Library/LaunchDaemons

/Library/LaunchAgents


Please be sure to include or otherwise indicate the name of the folder that corresponds to each screenshot, so that you and I can keep track of which ones they are.

Oct 12, 2019 8:01 AM in response to John Galt

Sorry I was not able to do this yesterday but I finally got time this morning. Followed all of the steps and removed what I knew to be associated with the identified adware. I am attaching the screenshot of the Application Support folder. I already deleted the AuraSearch and ExpertPlatformSearch folders. I cannot thank you enough for your thorough explanation of the process. I have learned A LOT!! If you see anything problematic with this folder, please let me know and I'll take it out. Again, thank you so much!!

Oct 12, 2019 10:56 AM in response to Marfy33


Marfy33 wrote:
I already deleted the AuraSearch and ExpertPlatformSearch folders.


👍


The three with a lot a numbers in their names can probably be deleted, only because their names cannot be correlated with anything else. You can either leave them alone or drag them out of Application Support into some temporary location to determine if they are used for anything you require.


Everything else is ok.

An couple of apps keep installing on my mac. Green with white magnifying glass. One says "extrabrowser" and the other says "centralstructured". What are these?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.