Removing FlashMall, Cinema-Plus Pro, or Shoppy Mate from my Mac

These are different variants of the same adware program with widely varying names, and appear to be developed by the same group also referred as "Buca Apps". You need to manually remove suspicious browser extensions from the all Internet browsers, and the files associated with it from your Mac.

STEP 1

Removing suspicious browser Extensions

  • Select the browser that you use and remove the following and other suspicious browser extensions:

    • Shoppy Mate

    • FlashMall

    • Cinema-Plus Pro (and variants like Cinema + HD, Cinema + Plus + or Cinema Ploos)

STEP 2

Remove the extensions-related files

  1. On the Apple menu bar, click Go and then select Go to Folder.

    You need to be in the Finder view on your Mac to perform this action.

    In the next steps, you will be removing the files related to FlashMall, Cinema-Plus Pro, Shoppy Mate. Make sure that you delete only the files listed in the instructions. Removing inappropriate files can result in permanent data loss or corrupted files on your system.

  2. In the Go to Folder dialog box, type the following locations at a time and then click Go.

    Try to locate the files or folders denoted with # below:

    • /Applications

      cinemapro1-2.app#

    • /Applications

      WebTools.app#

    • ~/Applications

      cinemapro1-2.app#

    • /Library

      cinemapro1-2#

    • ~/Library

      cinemapro1-2#

    • ~/Library

      WebTools#

    • ~/Library/Application Support

      webHelperApp#

    • ~/Library/LaunchAgents

      WebServerSocketApp#

    • ~/Library/LaunchAgents

      UpdateDownloder#

    • ~/Library/LaunchAgents

      com.webhelper.plist#

    • ~/Library/LaunchAgents

      com.webtools.update.agent.plist#

    • ~/Library/LaunchAgents

      com.webtools.uninstaller.plist#

      Safari Security#

      shopy-mate_enabler.plist#

      shopy-mate_enabler.sh#

      shopy-mate_updater.plist#

      shopy-mate_updater.sh#

      shopy-mate.ver#

      com.crossrider.wssXXXX.agent.plist#

      com.extensions.updaterXXXXX.agent.plist#

      com.extensions.updaterXXXXX.ver#

    Some of the file names vary depending on the browser extension installed, such as "cinemas-+-plus-+_enabler.plist" or "flashmall_enabler.plist". Files like these should be removed. Items like "com.crossrider.wssXXXX.agent.plist" file will have random numbers in place of XXXX.

    If you find any of these files, move them to trash and then empty the Trash.

  3. In the Go to Folder dialog box, type the following location and click Go.

    /Library/LaunchDaemons

    In this folder, locate a file with name similar to "com.cinemapro1-2.daemon.plist", and move it to trash. The exact name may vary according to the name of whatever browser extensions you find installed.

  4. Restart your computer.

Thank you!

Thank you for using Norton Support.

< Back

Was this information helpful?

DOCID: v109772609_EndUserProfile_en_us
Operating System: Mac OS X
Last modified: 04/02/2015