My father has a Mid 2012 13" MacBook Air which he alternatively enjoys and is frustrated by. He's reasonably technically savvy so it seemed like something was likely wrong.

There were two obvious problems

1) Software update wouldn't run
2) The App Store only showed a blank window.

I took a look at the Activity Monitor and noticed a process called 'RoyalSearch' - there's surprisingly little info about it online. I set that aside.

I created a new user account. Software update would find updates but would fail to download them. I ended up copying over a Catalina installer. It ran successfully and the new user account seemed to be working well. Back to my father's main account.

The App Store still wasn't working from my father's account. I do a google search for adware removal and I find a very helpful link to where to look for suspicious files. I find items related to RoyalSearch. I kill the files and then the process. BAM! App Store loads without further action.

My father also installed CleanMyMac (free version) which highlights some adware which I remove manually.

---

The machine seems to be working well but I don't know what I removed and therefore don't know if the machine is trustworthy. Should we still wipe the machine clean?

---

I would.

1. Check the Network settings and ensure that there are no "proxy" settings.

2. Download and install Malwarebytes for Mac. (In free/personal mode.) Run a scan and clean up anything as prompted.

3. Get rid of that "CleanMyMac" garbage. It's cr@pware at best.

4. Relax.

---

Quote
mattkime

I do a google search for adware removal and I find a very helpful link to where to look for suspicious files.

Where, man? Don't leave us hangin'...