UtilityData Adware - How to remove

UtilityData is Mac adware. It fills browsers with ads, opens new tabs, pop-ups, causes redirects, and changes internet search settings. UtilityData may also cause issues like random reboots and crashes. On top of all that, a few other malicious items may get installed together with UtilityData. To find and remove them, malicious files need to be found and deleted, UtilityData and other apps need to be thrown into Trash, and system settings need to be fixed.

Details on UtilityData:

Type of threat	Adware, browser hijacker.
Issues caused by UtilityData	Pop-up ads everywhere, severely slowed and unstable Mac, more unknown apps getting installed.
How to remove UtilityData	Find and delete malicious files, use the help of anti-malware apps (Combo Cleaner, Malwarebytes, others), restore macOS and browser settings.
Adware installation	Malicious and fake websites, infected installers and wrappers, trojans.

About UtilityData

UtilityData is an adware infection that attacks macOS devices. It could be part of AdLoad, Shlayer, etc. Most of the complaints online about UtilityData note issues with the speed on the Mac and strange browser behavior. Some problems caused by UtilityData include:

• Unstable internet connection and certain websites not loading.
• Apps crashing and possibly even your Mac rebooting on its own.
• Browser behaving strangely, changing what site delivers your internet search results, opening new tabs with promoted websites.
• System pop-ups with UtilityData asking for access.
• UtilityData returning after you delete it.

Some people noticed UtilityData after it severely slowed down their Mac. They check their Activity Monitor (it can usually be found in the Dock) and find UtilityData using most of their processor resources (Reddit.com, Discussions.apple.com). CPU usage is displayed in the tab named “CPU”. Rank by highest usage by clicking the “% CPU” button. Sometimes, the process is named “UtilityData”, other times, it’s a random assortment of letters and numbers. Not all the victims of UtilityData suffer from this, though.

Mainly, UtilityData changes how your web browsers work. It promotes Trovi search, Qxsearch, Conduit, Webcoapps hijackers, and other search viruses (such as Chill tab). These are websites that provide you with the absolute minimum of internet search functionality while filling the results with ads. They collect search queries for use in advertising. At worst, malicious browser extensions can also inject ads into the sites that you open and read your login credentials. After you remove UtilityData, you might need to set new passwords.

UtilityData is hiding in Library folders that are hidden from users by default. There might also be malicious browser extensions installed on your web browsers. Shady cleaners and optimizers might also have invited themselves over to your Mac only to show you annoying pop-ups.

How to remove UtilityData adware

If you have a way to restore the state of your Mac to a previous point, that might be the best solution. If you don’t, read on.

Delete malicious files

Delete these files:

• ~/Library/LaunchAgents/com.utilityData.plist
• ~/Library/utilityData/utilityData.app/Contents/MacOS/utilityData

You can find them by opening Finder, opening its Go menu, clicking on the Go to Folder dialog, and then pasting or typing the folder names. This way, you can reach hidden folders.

Very likely, UtilityData is not the only malware on your system. Other malicious files may use names like MacPerformance and MacCheck to appear trustworthy. Others yet have names made of random nouns, such as UtilityParse, CoreAudit, UpgradeAnalog, AdditionalChannelSearch, etc. They also hide files in system folders: ~/Library/LaunchAgents, /Library/LaunchAgents, /Library/LaunchDaemons, and ~/Library/Application Support.

It’s best to use a reputable anti-malware app, such as Combo Cleaner, Malwarebytes, or others. They can detect malicious items. They are not always perfect, though, which is why combining anti-malware with your manual efforts would lead t the best outcome.

Fix system settings

You can restart your Mac in safe mode by holding “Shift” from when you start rebooting till when you see “Safe Boot” in the corner of your screen. Safe mode stops unnecessary launch items from running. It shows your Mac working without malware – and without other third-party apps. If you had issues deleting UtilityData, safe mode might be able to help.

UtilityData must have created configuration profiles to lock down your browser settings and force all those search engine and new tab changes. Go to System Preferences -> Profiles and remove UtilityData’s profiles – select an entry and click the minus ‘-‘ button at the bottom.

You may want to check in System Preferences -> Network -> Advanced -> Proxies, too. Some malicious apps set a proxy server on the infected app so that the victim’s traffic is redirected to a certain server.

Check your applications (Finder -> Applications) for UtilityData, other strange apps, and drag them to Trash. Open your web browsers, go to Settings -> Extensions or Preferences -> Extensions and look at what’s installed. Remove all the suspicious items, all the extensions that you didn’t install yourself.

Reboot when you want to exit safe mode.

How adware infects Macs

Macs are an attractive target for malicious actors. Malware comes to Macs in the form of dishonest, scammy Mac cleaners and optimizers, as well as adware infections. And, despite Apple’s efforts to protect their users, malware still finds ways:

• Fake updates and fake software on spoofed websites.
• Bundling malware with legitimate apps.
• Deceptive ads that trick people to download apps.
• Trojans and preinstalled malware downloading more malware.

You might think you’re installing a Flash Player update or a macOS update (like the one in the illustration for this article) but end up installing UtilityData. It is very easy for scammers to copy exactly the look of a reputable app and trick people this way.

Once UtilityData is downloaded, it needs you to give it some privileges. It might ask for them outright, hoping that the user is distracted enough that they’ll just agree without reading closely. Or UtilityData may overlay the system dialog with a fake window saying something like “Installation complete” in such a way that if you click the OK button, you’ll accidentally give UtilityData the permissions that it needs.

Automatic Malware removal tools