How to remove Mac viruses

Mac virus is a real danger, not just a myth

Mac virus is a term used to describe the cyber threat capable of affecting Mac operating system. Even though computer viruses are much more likely to infiltrate PCs using the Windows operating system, security researchers report that attempts made against MacOS users increased by 270 percent in 2017.^[1] There is no doubt that these numbers will increase in 2018 as there are more and more different threats trying to overcome Apple's protection measures.

The most popular way to get infected with Mac malware is by downloading famous third-party plugins like Adobe Reader, Flash, and Java. These plugins are needed for using programs or browsing properly, so there is no surprise that people fall for letting them in.

However, once the victim enables any of these plugins, he or she puts Mac's security into danger. Additionally, you can get infected just by clicking on the spammy link or downloading the malicious email attachment dubbed “invoice” or “shipping details.” 

Unfortunately, some users are still convinced that Macs don't need anti-virus software as they are immune to Mac viruses.^[2] However, this is not true as there are numerous cyber infections capable of infiltrating MacOS without asking the users to enter their password or using social engineering techniques to make them do so.

If you have been wondering whether Mac operating system is vulnerable or not, the answer has already been given by Bogdan Botezatu, Bitdefender’s^[3] Senior E-Threat Analyst, and many other experts:^[4]

The answer is definitely, yes. There have been incidents, and there will be more.

Mac malware includes different categories of viruses

There are numerous types of Mac viruses spreading throughout the Internet since 2006.^[5]. They are categorized almost identically to Windows ones, which include:

• Browser hijackers
• Adware
• Fake Mac optimization tools
• Ransomware
• Cryptominers

The least harmful programs are browser hijackers, adware, and fake optimization tools. If infected with this type of viruses, you shouldn't run into issues while trying to remove Mac virus. However, these potentially unwanted programs can get extremely annoying if kept on the computer for a long time. Also known as browser-hijacking applications, they are very likely to enter the system via bundling and from infected web browsers.

Once installed, the PUP changes browser settings such as:

• the main search engine;
• new tab URL;
• homepage.

As a result, every time Mac user tries to perform a search via the infected browser, he/she is forced to use the new search engine or is interrupted by misleading ads promoting sponsored goods or services. Beware that some of these ads might take you to a dangerous website or result in spending your money on useless software. Beware that the fake system optimization tools, also known as “scareware,” prompt users into purchasing their licensed version which just mimics Mac virus removal and system's protection activities.

Talking about serious malware, our cybersecurity experts point out ransomware viruses that can encrypt victim's files to make them unusable. This type of Mac malware enters the computer system via phishing messages and their rogue attachments. When the virus-related content is launched, the ransomware encrypts data by using unique algorithms such as AES or RSA.^[6] The malicious program adds a specific extension to each locked filed and then displays a ransom message. This type of note has a purpose of threatening users that their files will be permanently lost if they do not pay a particular price for the decryption tool.

Interesting: Mac crypto miner virus is the least dangerous, but the most problematic

Cryptominers – malware that has just started getting more popular among cybercriminals. This virus is used to illegally use victim's computer resources to mine Bitcoin, Litecoin, Ethereum, Monero,^[7], and other popular cryptocurrencies. When infected by this type of threat, users might not experience any symptoms on their Macs, apart from increased CPU usage and general sluggishness of the machine:

Modern Mac OS X and Windows malware does not slow down your PC, unless they are Bitcoin miners.^[4]

There are two types of miners: the crypto-malware and the malicious script that is directly embedded within a website. In the case of the latter, users who visit a compromised site let their machine power to be abused to mine crypto. However, as soon as they leave the website, the activity stops, and there is no malware involved Users should use internet security tools that can warn them about the malicious site.

Crypto malware, on the other hand, embeds the script into the computer and the crypto mining process starts immediately after it is launched. Therefore, to stop the process of Mac virus, users need to get rid of its cause. The only way to do that is to employ a comprehensive anti-malware tool.

Some viruses do not belong to any of these categories, as they combine more than one feature and function. Such threats, sometimes even called hybrid viruses, can be used for showing misleading warnings, encrypting users' files, distribution of other viruses, and additional activity, which is considered malicious. It is very hard to find and remove these parasites from the system, as they usually consist of components that automatically reinstall each other after removal.

Also, many viruses have extra features, which allow them to hide from antivirus software. Such threats can monitor the activity of the antivirus software and intercept its requests. When the antivirus program tries to check an infected file, the virus immediately passes the original, clean variant of that file and prevents its detection in this way. 

Apple uses numerous protection layers to fight Mac viruses

Since the presentation of Mac OS X 10.8 Mountain Lion, viruses were too weak to attack Mac computers because Apple added numerous security measures to the system. The main wall defending Macs against viruses is Gatekeeper which is used to decline apps that haven't been approved by Apple.^[8] The Gatekeeper is essentially a built-in scanner that stops the installation of non-approved software. Thus, to be able to add third-party software, users need elevated permissions.

Another technology used by Apple is the Application Firewall, which allows users to trust certain apps and ports and decline the others. Its operation is based on the simple principle: it blocks input and output connections that do not meet the requirements of a pre-set policy of the Firewall.

Additionally, XProtect (officially known as File Quarantine), Apple's built-in anti-malware software, defends the system from spyware, viruses, and other malicious software. While traditional anti-malware systems are performing scans on the computer continually, XProtect is mainly used to scan downloads. It pre-checks the file against its database to make sure it is not malicious before executing it.

Finally, users need to enter their passwords each time a new app is being installed, making rogue installation of malicious software much more difficult. Additionally, all apps that Macs run are sandboxed,^[9] meaning that they are executed in a unique environment, preventing malicious code from spreading.

Techniques used by virus creators to overcome Apple's protection

For many years, millions of Mac users thought that these protection measures are more than enough to keep them away from harm's way. However, the hackers are sophisticated individuals, and they are always seeking to find solutions and overcome the protection.

Mac viruses infect a computer without user knowledge and consent, for example:

• Fake Flash Player updates are well-known sources of Mac malware – threats like OSX/Shlayer, which exploits the vulnerabilities of a pre-installed adware program like Advanced Mac Cleaner.
• Mac viruses infect particular documents, executables, and other files from trusted sources. Once a victim opens such a document or executes it, a virus quietly installs itself to the system.
• There are lots of Mac viruses that are distributed as e-mail attachments. They can also arrive in instant messages or can come embedded into letters. These viruses have unsuspicious names and, therefore, can trick a user into opening or executing them. Once the user opens such a message or file, the virus silently infects a computer.
• Some parts of viruses are distributed via removable drives that get automatically executed right after the user inserts the disk.
• Pirated software and counterfeit computer games are often filled with various viruses. Once the user starts the installation of such a game or a program, the parasite silently infects the system.
• Mac viruses can also get into the computer with the help of other pests, such as trojans, worms, or backdoors. They get into the system without the user's approval and consent.

Main dangers related to Mac viruses

When a Mac virus infiltrates the system, it initiates such activities:

• Infects, overwrites, or deletes files. It can harm your personal documents, essential system components, and useful applications. Also, some Mac virus can destroy the entire system by erasing all critical files and folders from it.
• Inserts a malicious code into the hard disk to run a destructive payload before the operating system gets loaded.
• Adds harmful components to reputable programs or modifies their settings to infect documents opened or created with these programs.
• Hijacks all SSL-TLS encrypted traffic that enters and leaves Mac.
• Severely damages a computer by changing essential hardware settings, such as corrupting the Open Firmware. This may lead you to critical data loss and the malfunction of a computer system. 
• Creates thousands of random files and folders that can consume lots of system resources.
• Displays numerous fake messages, changes various system settings, causes redirects, and performs other annoying actions to complicate the regular tasks of the user.
• Mac virus infects the system with trojans, backdoors, keyloggers, and other dangerous parasites.
• Uses a compromised system to spread other malware.
• Steals or encrypts sensitive personal information, valuable documents, passwords, login names, identity details, or user contacts.
• Mac virus removal can be quite complicated because such malware tends to modify itself, encrypting infected files, intercepting requests from antivirus software and altering normal system behavior.
• Causes slowdowns, decreases the system's security and causes software instability. 

Recommended methods to remove Mac virus from the system

Mac virus can be found and removed from the system with the help of various methods. Some of them are considered not aggressive, so you can try to uninstall them with the help of the manual removal method.

However, if you want to be sure that each of the components that belong to your cyber threat is gone, you need to run a full system scan with anti-virus. Beware that sometimes even the most reputable anti-spyware may fail to help you in the Mac virus removal because hackers keep updating their malware. 

If the program fails to detect a Mac virus, it's not a problem. In this case, you should add your question to Ask us page and we will help you to remove your virus for free.