Step 1. Uninstall MacStealer-related potentially unwanted applications

1）Open Finder by clicking its icon in the Dock

2）Select Applications from the left sidebar.

3）Find any apps that you don’t recognize or seem suspicious and move them to the Trash.

4）Click Go in the Finder toolbar, then select Utilities from the expanded menu.

5）Find Activity Monitor and double-click its icon.

6）Search for any suspicious processes belonging or related to MacStealer. Once you have found them, select the Force Quit Take “Activity Monitor” as an example.

Step 2: Remove harmful files generated by the MacStealer

1）Click Go in the Finder toolbar, then choose Go to Folder

2）In the Go to Folder… bar, type /Library/LaunchAgents, then double-click Library > LaunchAgents.

3）After that, search for the following suspicious files associated with the MacStealer malware:

• ConnectionCache.service.plist
• digitalprotection.emcupdater.plist
• mulkey.plist
• nbp.plist
• sys.system.plist

 Once you have found these files, right-click and select Move to Trash to remove them.

4）Repeat this process for the following folders:

~/Library/LaunchAgents

/Library/Application Support

/Library/LaunchDaemons

5）Don’t forget to Empty the Trash:

• Right-click on the Trash icon in the Dock, and then select Empty Trash.
• A window will appear asking you to confirm your choice. Click Empty Trash.

Step 3: Remove malicious extensions from Safari / Chrome / Firefox

No matter which browser you use, MacStealer installs itself as a browser extension. Removing browser extensions is not difficult, but it does take some time as you’ll need to individually check each browser installed on your Mac.

Safari

• Click Safari > Settings.
• In the upper section of the menu, select the Extensions
• In the sidebar, find MacStealer extension and click its icon. Then hit the Uninstall The same goes for suspicious extensions.

Chrome

• Click Chrome menu > Settings.
• On the new page that appears, click Extensions in the left sidebar.
• Find the MacStealer extension or any recently-installed suspicious extensions and click Remove.

Firefox

• Click the Firefox menu (the button with three lines) > Adds-on and themes.
• In the left section, select Extensions.
• Click Remove next to the MacStealer extension and suspicious extensions.