PUA:Win32/Presenoker removal guide




Changes to browser settings, redirects to malicious websites

Infection methodSoftware bundling

System damage

Slows down your browser, shows malicious pop-ups, and notifications


Manual removal

In a lot of ways, a Potentially Unwanted Application – or PUA – can be just as much of a headache as more aggressive malware. And that’s especially true for PUA like Win32 Presenoker. Once a PUA is installed, it infects other apps on your Mac, and getting rid of them can feel next to impossible without the help of an expensive antivirus.

But don’t lose hope yet. This article will show you how to remove the Presenoker virus. As well as explain how it got there in the first place and what you can do to help prevent it or any other malware for getting on your computer.

What is PUA:Win32/Presenoker?

As you read earlier, Win32 Presenoker is a PUA or potentially unwanted application. While other PUAs typically infect your browsers and serve you pop-up ads, Presenoker does a little more than that. It also installs itself on other apps that have a browser like Discord or TeamSpeak, to name just a few.

Once Presenoker is installed on your Mac, it takes over your entire browser and changes all of your settings, which sounds like a minor annoyance at first. But, when it’s used by bad actors, they can reroute your browser to websites of their own and collect data that you enter. So not only does Presenoker slow your computer down, it’s much more malicious when you factor in that it can steal personal data as well.

How can Mac get infected by PUA:Win32/Presenoker?

At this point, you’re probably wondering how your Mac got infected. Aren’t Macs supposed to be impenetrable? Well, no. But by a lot of factors, macOS is a much more secure platform than its counterparts. That doesn’t mean it’s perfect. Far from it, actually. And that’s why there are constantly new updates and security patches for you to install.

PUAs like Win32 Presenoker can be installed in numerous ways. The two most common are by users themselves.

Software bundling

The most common method Macs are infected by is called software bundling. That’s when the Presenoker installer is actually hidden in the installation of another app. So, you try to download a free app from the internet, but bundled in that installation is also Presenoker like a really bad 2-for-1 deal. You should only install apps from trusted and reliable sources on the internet. And even when you do, always click the Additional Install or Customize Installation button.

Fake apps

Another unfortunately common way PUAs are installed on Macs is by labeling themselves as something they’re not. In short, you think you’re installing one app, but it’s something else altogether. And that’s when you find yourself in a whole mess of trouble.

How to remove PUA:Win32/Presonker manually

Removing the PUA:Win32/Presonker from your Mac manually is not impossible, but it is time-consuming. The first thing you’ll want to do is delete any malicious extensions from all browsers you have installed — not just your default browser. That will vary from browser to browser, so follow the steps below.


  1. Open Safari.
  2. Click Safari > Preferences > Extensions.
  3. In the sidebar, click on the extension.
  4. Finally, click Uninstall and restart Safari.

Google Chrome

  1. Open Chrome.
  2. Click Chrome > Preferences > Extensions.
  3. Find the extension and click Remove.
  4. Now, restart Chrome.


  1. Open Firefox.
  2. Click Firefox > Preferences > Extensions & Themes.
  3. Look for any suspicious extensions and click …
  4. Then, click Remove.
  5. Quit and reopen Firefox.

If you remember from earlier, though, PUA:Win32/Presonker doesn’t just impact your browsers. It also attaches itself to apps like Discord, TeamSpeak, and more. So, it’s a good idea to remove and reinstall any infected apps. To manually uninstall an app, just follow these steps:

  1. Open a new Finder window.
  2. Click Go > Applications.
  3. Find the infected app. If you can’t identify it, find the app you’ve installed before you’ve seen malicious browser behavior.
  4. Drag it to the Trash.
  5. Then, right-click or hold down Control and click on the Trash icon.
  6. Click Empty Trash.

After you finish doing all of this, you should go ahead and restart your computer too. That way, all of your software can start fresh and not try to access any infected files.

Even though you are uninstalling the key components of Presenoker, anytime you remove something manually, you run the risk of leaving behind support or cache files. It’s always recommended that even after you delete an app of any kind to still scan your computer with an uninstaller or malware app. Just to make sure there’s nothing nefarious left on your Mac.

Automatically remove PUA and other malware

Fortunately, the CleanMyMac X app was designed to help safeguard your computer against these malicious programs. It quickly scans your Mac and alerts you to anything suspicious that should be removed. And you can download CleanMyMac X for free to see just how easy it is to use.

Once you have installed on your computer, all you have to do is follow these steps:

  1. Open CleanMyMac X.
  2. On the side, click Malware removal.
  3. Then, click Scan.
Malware removal module of CleanMyMacX

Once it’s finished, you’ll be prompted to remove whatever the scan finds. It’s so easy and painless; it’s actually a good idea to set a reminder to run regular malware scans every week or two. Just because we’re all so busy, we don’t necessarily have time to address issues as they pop up.

CleanMyMac X also has real-time file monitoring. So, if you do download something nefarious, it will check it much faster — instead of waiting for you to start a scan manually. To make sure that feature is enabled:

  1. Click CleanMyMac X > Preferences.
  2. Open the Protection tab.
  3. Check “Enable Malware monitor” and “Look for threats in the background.”

Potentially Unwanted Apps are downright annoying and can be a massive headache. Slowing down your computer and even redirecting all your internet searches. But Win32 Presenoker is no joke. If you have it or think you have it installed on your computer, take the steps mentioned in this article to remove it as soon as you can. Get your Mac running back in peak performance and follow these tips to safeguard against future malware infections.

Laptop with CleanMyMac
CleanMyMac X

Your Mac. As good as new.