BufferKey Adware - How to remove

BufferKey is an adware app that infects macOS systems. It changes the search settings in the browser and interferes with various online settings. BufferKey arrives via adware bundlers, fake software updates, and malicious ads. It and the related malicious files need to be deleted. Once BufferKey is removed, browser settings can be restored to normal.

Details on BufferKey:

Classification	Adware, trojan.
Removing BufferKey	Use an anti-malware app (Combo Cleaner, Malwarebytes, others), delete related files and settings, restore browser settings.
Effects of the BufferKey adware	Browser search redirects, ads injected into the browser, malfunctioning apps, unfamiliar applications getting installed.
How to avoid infections	Don’t trust online alerts about needed software updates – malicious actors use fake warnings to spread malware, only install apps from reputable sites, scan your downloads with antivirus apps.

How to remove BufferKey

BufferKey uses malicious persistence tactics, hiding its settings in system folders to assure that it cannot be removed normally.

The best way to remove BufferKey is with an anti-malware application, such as Combo Cleaner, Malwarebytes, and others. You might be asked to start your computer in safe mode when removing BufferKey. BufferKey is part of a known adware group (Shlayer) and anti-malware apps should have no problems recognizing it (VirusTotal page).

If you’re curious about how BufferKey roots itself into your system (and how you might go about removing it manually):

• It installs configuration profiles (System Preferences -> Profiles) that modify browser settings.
• It places files in /Library/LaunchAgents, /Library/LaunchDaemons, and ~/Library/LaunchAgents that allow BufferKey to start up with every login.
• BufferKey also can be found in the Applications folder and browser extensions.
• Possibly, it changes network settings (System Preferences -> Network -> Advanced -> Proxies).

The BufferKey app and browser extensions also should be removed. Browser settings (your default search engine, the new tab page) might need to be fixed. The file that downloaded BufferKey (likely, a fake Flash Player update or some free application that carried BufferKey inside it) ought to be deleted so that you don’t accidentally reinfect your Mac. If you find other unfamiliar apps on your system that appeared around the time that BufferKey did, remove them, too.

Problems with BufferKey

BufferKey is an adware trojan. It gets downloaded and installed without your permission, then it changes a bunch of settings relating to your browser. BufferKey can inject ads into webpages, some of those ads being dangerous (phishing scams, malware, adware, subscription scams, etc.). It also changes the search settings, sending the search queries to Yahoo.

BufferKey might have some side effects besides the excessive ads: crashing apps, system pop-ups asking for permissions, dropping or slow internet connection, some websites being inaccessible, and unwanted Mac cleaners being installed (like Mac Master, MacShiny, and others).

I should also bring up some privacy issues. BufferKey’s browser extension can read your data on the sites that you visit, which, at worst, includes usernames, passwords, email addresses, and even credit card data. Make sure that you have 2-step verification turned on on the accounts that are important to you. 2-step verification means that you’ll be warned if someone else tries to log in to your accounts.

BufferKey is similar to UpdaterChannel, ProgressStart, RotatorAssist, and a lot of other apps. In fact, they are related and many can be installed on one Mac at once. When removing BufferKey, be on the lookout for these other apps, too. Watch out for app names that look like random nouns strung together.

How adware infections happen

Files like this one named “Player” (VirusTotal page) can be found online, on sites offering Adobe Flash Player updates, macOS updates, and security programs. Sites that were created by malicious actors to trick and scare people into downloading the files that those sites are pushing. Those files are not updates or security files – they’re adware bundles. They’re the kinds of files that install BufferKey.

Malicious websites that spread malware disguised as software updates are many, with old ones being retired and new ones being created all the time. Some of them have absurd names like Launchgreatlyadvancedsoftware.icu, others have mostly random-looking URLs, others try to incorporate words “apple” and “mac”, such as Apple.com-optimizing-mac.live.

These fake update sites are designed to impersonate reputable companies. They steal logos and screenshots and create pop-ups that look a lot like macOS system warnings. Distracted users download the malware thinking that it’s a mandatory system update. Then, BufferKey and other adware get installed in the background.

Some apps might bundle BufferKey without any fake update warnings. Only download apps from reputable and safe websites to avoid adware bundling.

Automatic Malware removal tools

Restore browser settings

How to remove BufferKey Adware from Safari:Top

Remove malicious extensions

• Click on Safari menu on the top left corner of the screen. Select Preferences.
  
• Select Extensions and uninstall BufferKey Adware and other suspicious extensions.
  
• If your homepage was changed, click on Safari menu on the top left corner of the screen. Select Preferences and choose General tab. Enter preferable URL to the homepage field.
  

(Optional) Reset your browser’s settings(older versions) If you are still experiencing any issues related to BufferKey Adware, reset the settings of your browser to its default settings.

• Click on Safari menu on the top left corner of the screen. Select Reset Safari…
  
• Select which options you want to reset (usually all of them come preselected) and click on the Reset button.
  

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program.

TopHow to remove BufferKey Adware from Google Chrome on Mac:

• Open Chrome browser.
• Enter in the url field “chrome://extensions” address and hit Enter.
• Find BufferKey Adware on the extensions list and click on the recycle bin icon next to it.
• Click on 'Chrome' button at the top left corner. Select 'Preferences' on a drop-down menu box.
• Find 'Search' options on Settings tab. If your search engine is changed, click 'Manage Search Engines' and set your preferred search engine.
• On the same page find 'Show home button' checkbox and change your homepage.

(Optional) Reset your browser’s settings If you are still experiencing any issues related to BufferKey Adware, reset the settings of your browser to its default settings.

• On the 'Preferences' menu window, scroll down to the bottom and find 'Reset settings' button. Click it.
• Confirm your selection and click 'Reset' on the following window.

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program. Top

How To remove BufferKey Adware from Firefox on Mac OS:

• Click on the menu button on the top right corner of a Mozilla window and select the “Add-ons” icon (Or press cmd+Shift+A on your keyboard).
• Go through Extensions list, remove everything BufferKey Adware related and items you do not recognise. If you do not know the extension and it is not made by Mozilla, Google, Microsoft, Oracle or Adobe then you probably do not need it.
• Enter “about:preferences” in URL bar and hit enter.
• Open Search settings tab.
• If your search engine is changed, click 'Default Search Engines' and set your preferred search engine.
• If your homepage was changed, click on the Firefox menu in the top right corner, select Preferences-> General. Enter a preferable URL to the home page field.

(Optional) Reset your browser’s settings If you are still experiencing any issues related to BufferKey Adware, reset the settings of your browser to its default settings.

• Click on the menu button on the top right corner of a Mozilla Firefox window. Click on the Help button.
• Choose Troubleshooting Information on the Help menu.
• Click on the Refresh Firefox button.
• Click on the Refresh Firefox button on the confirmation box. Mozilla Firefox will close and change the settings to default.

If the problem persists, scan your system with an anti-malware program to identify malicious entries.