How to remove Pirrit adware (Mac)

What is Pirrit

Pirrit is a sophisticated adware family that primarily targets macOS systems. It was first discovered in 2016 and has been actively distributed since then. Adware refers to unwanted applications that generate revenue for their creators by displaying intrusive and often deceptive advertisements. Pirrit is more malicious than its Windows counterpart as it takes total control of the machine, making it very hard for the user to remove it. Once installed, Pirrit adware displays intrusive ads such as coupons, banners, surveys, and pop-ups, often concealing the underlying content of visited websites. It also collects user data to display targeted ads and can redirect users to malicious websites, potentially leading to further malware infections. Pirrit adware significantly affects the performance of the infected Mac, making it slower and less responsive. It also poses a risk to user privacy and security as it can gather sensitive data and expose it to potential exfiltration. Moreover, Pirrit adware is extremely hard for the average user to remove. It does not have a configuration screen or an entry in the /Applications directory, making it difficult for users to even realize that their system is infected.

How Pirrit infects Mac computers

The infection process of Pirrit adware is complex and involves several steps. It typically begins with the download and installation of a fake Mac installer, often disguised as a software update or a popular free software. This installer executes a malicious shell script, which initiates a lengthy infection chain. The infection chain involves the implementation of persistence-ensuring techniques and the execution of another shell script, culminating in the installation of the main payload, the Pirrit adware itself. Pirrit adware has the ability to detect when it is launched on a virtual machine and has anti-debugging capabilities. It also uses obfuscated code to evade detection.

1. Download Pirrit Removal Tool
2. Remove Pirrit from Login Items
3. Remove/Uninstall Pirrit from Applications
4. Remove Pirrit from browsers
5. Reset browser settings
6. Remove Pirrit files and folders
7. Block Pirrit ads and pop-ups
8. How to protect from threats, like Pirrit

Remove Pirrit manually for free

Note: Pirrit sets up to start on macOS startup. Therefore, before starting the removal, perform these steps:

1. Open System Preferences, choose Users & Groups.
2. Choose your account (set up as Current User).
3. Click Login Items tab.
4. Find “Pirrit” entry. Select it, and click the “-“ (minus) button to remove it.

Note 2: Pirrit won’t quit just by closing it, therefor use Force Quit to end the process.

1. Press 3 buttons at the same time: Option, Command, and Esc (Escape). This is similar to Control-Alt-Delete on a Windows PC.
2. Choose Pirrit in the list.
3. Click Force Quit button.

Here is a manual step-by-step tutorial for full Pirrit removal from your computer. This works 99% and was checked with the latest versions of Pirrit installer on operating systems with the latest updates and browser versions.

Remove Pirrit from Applications

Remove Pirrit from Mac:

1. In the Finder sidebar, click Applications.
2. Pirrit might have an Uninstaller. If you see Uninstall Pirrit or Pirrit Uninstaller, double-click it and follow the onscreen instructions.
3. Otherwise, drag Pirrit from the Applications folder to the Trash (located at the end of the Dock).
4. Then choose Finder > Empty Trash.

Cannot uninstall Pirrit

If you can’t uninstall Pirrit using instructions above, or it keeps coming back, you can use free AppCleaner for Mac to remove all residual data and libraries of Pirrit. Follow instructions below:

1. Download free AppCleaner.
2. Drag Pirrit from Applications folder to AppCleaner window.
3. Choose files and folders you want to remove along with Pirrit.
4. Click Delete button.

Remove Pirrit add-on from your browsers

Removing Pirrit from Applications often does not bring the desired effect. It is a browser extension, and it may still be active in Google Chrome and Mozilla Firefox. Here are instructions on how to remove the Pirrit extension from your browsers manually.

Safari:

1. Start Safari on your Mac, click Safari to open drop-down menu and choose Preferences
2. Click Extensions tab.
3. Find Pirrit extension.
4. Click Uninstall button to remove it.

Google Chrome:

1. Start Google Chrome browser
2. In address box type (or copy-paste) chrome://extensions.
3. Find Pirrit extension.
4. Click the trash can icon to remove it.

Mozilla Firefox:

1. Start Mozilla Firefox browser.
2. In address box type (or copy-paste) about:addons.
3. Choose Pirrit extension.
4. Click Disable or Remove button.

Reset browser settings

To finish Pirrit removal, reset your browser settings to make sure, there are no leftover items in browser folders.

Reset Safari:

1. Start Safari on your Mac, click Safari to open drop-down menu and choose Preferences
2. Go to the Privacy section of Safari’s preferences.
3. Click Remove All Website Data button.
4. In the opened window, click Remove Now button to remove data stored by websites in Safari.
5. Go to the Advanced section of Safari’s preferences.
6. Click the Show Develop menu in menu bar option.
7. In the menu, click Develop and select Empty Caches from this menu.
8. Again, go to Safari menu and choose Clear History….
9. Choose to clear all history and click Clear History button.

Reset Google Chrome:

1. Start Google Chrome browser
2. In address box type (or copy-paste) chrome://settings.
3. Scroll down and find Show advanced settings link.
4. Click on it and scroll down to the bottom again.
5. Click Reset settings button and click Reset to confirm.

Reset Mozilla Firefox:

1. Start Mozilla Firefox browser.
2. In address box type (or copy-paste) about:support.
3. Click Refresh Firefox… button.
4. Click Refresh Firefox to confirm.

Remove following files and folders of Pirrit


~/Library/Application Support/.[random_string]/Services/com.Pirrit.service.app
~/Library/LaunchAgents/com.Pirrit.service.plist
/Library/Application Support/.[random_string]/System/com.Pirrit.system
/Library/LaunchDaemons/com.Pirrit.system.plist


Download AdGuard for Mac to block malicious pop-ups, that promote Pirrit

AdGuard is the best ad-blocker, internet filtering, and internet security application for macOS. It can cut out unwanted banners from site pages, block pop-ups, stop redirects, and prevent users from visiting potentially dangerous resources. Use it to stop ads promoting Pirrit in browsers.

How to protect Mac OSX from adware, like Pirrit

Mac OSX is known to be one of the safest operating systems, and for a long time, there was no need for antivirus products for Mac. But with the growing popularity of Mac computers and notebooks and evolving technology, viruses, trojans, adware, toolbars, hijackers, and other malware paved the way for Mac users. We recommend you to use one of the best anti-malware for Mac available — Malwarebytes for Mac.