How to remove NavigateSystem Mac virus

NavigateSystem is a malicious Mac application that compromises the device and steals personal data

NavigateSystem is a dangerous software that one might find on their device all of a sudden. It belongs to the notorious Mac malware group known as Adload – it has been spreading around for several years now and several hundred of various were released over that period. This or any other version of the malware can easily be identified by the icon it uses – magnifying glass on a teal, green or blue background.

The deception of the NavigateSystem virus starts with its distribution, as most people usually download it via fake updates for Flash Player or similar software – phishing^[1] messages are used to convince them to download it. Alternatively, some people might install it on websites that distribute illegal, pirated applications and video game installers.

Note that regardless of which method is used to install the app, users always have to enter their AppleID in order for the installation to be successful. Thus, if you do not enter your credentials, the infection would not be initiated in the first place.

NavigateSystem capabilities and traits

Adload is generally considered a malicious software strain responsible for the release of ProcessRate, SmartTask, OriginInput, and many other versions over the past few years. While many security vendors mark it as malware due to its operation traits, it can also be easily classified as adware, as all the actions are made for the sake of receiving revenue from ads – be it clicks or a simple display of it on various websites.

Therefore, as soon as the virus is installed, users can quickly notice changes made to their Safari, Chrome, or any other browser – a browser extension would change the homepage immediately and redirect all searches to an alternative provider (Yahoo or Safe Finder are commonly used, although a variety of other providers can be used).

With the help of browser hijacking, users are then forced to see promotional links and ads that are shown at the top of search results every time they are trying to use the search function. Additionally, people might also encounter unexpected browser redirects to other malicious places and an additional layer of ads everywhere they go.

To make matters worse, the NavigateSystem extension is usually installed with elevated permission, which allows it to harvest personal user information – basically, everything that is typed when using the browser. In such a way, user passwords, account logins, credit card details, and other information might be stolen by cybercriminals. Therefore, we recommend not entering any personal data while having the virus installed on the system.

Malware also installs several components that make it quite difficult to remove. With the help of the built-in AppleScript, it inserts its own processes, PLIST files, new profiles, and other elements. Below we provide a comprehensive guide on how to successfully eliminate the infection and make sure that all its components are terminated permanently.

Removal of NavigateSystem

Increased persistence is reached by malware with the help of many components that are populated upon installation. With the help of AppleScript use, the virus is capable of bypassing the protection of built-in security elements such as XProtect or Gatekeeper. Therefore, employing third-party software, such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes, grants an extra layer of protection and ensures that no malicious changes are made.

Nonetheless, since the infection has already spread, it needs to be removed for better security and personal safety. If not removed, malware can result in the installation of additional malicious programs or potentially unwanted applications (it is known to promote malicious apps like Advanced Mac Cleaner), disclosure of sensitive details/identity theft, and many other negative results.

As we already mentioned, security software is great for stopping infection in the first place – it can also be used to remove malware as well. Therefore, we strongly suggest you start by performing a full system scan with anti-malware tools and then proceed with the steps below (which might not be needed).

Eliminate the main application

You should disable malware's background processes and then get rid of the main app:

• Open Applications folder
• Select Utilities
• Double-click Activity Monitor
• Here, look for suspicious processes related to adware and use the Force Quit command to shut them down
• Go back to the Applications folder
• Find ExtendedService in the list and move it to Trash.

Remove Profiles and Login items

Login items and Profiles can also be used to increase persistence. Hence, if you see any of the unknown ones, remove them as follows:

• Go to Preferences and pick Accounts
• Click Login items and delete all unwanted items
• Next, pick System Preferences > Users & Groups
• Find Profiles and remove unwanted profiles from the list.

Plist files elimination

The PLIST files are small config files, also known as “Properly list.” They hold various user settings and hold information about certain applications. In order to remove the virus, you have to find the related PLIST files and remove them.

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.

Take care of your browser

The browser plays a vital role in the virus' operation, as it is installed along with the main app on the system with elevated permissions. Therefore, in order to eliminate the browser hijacking component from the device, you should find and remove the unwanted extension from Safari.

1. Click Safari > Preferences…
2. In the new window, pick Extensions.
3. Select the unwanted extension and select Uninstall.

Next, you should make sure that your browser caches are properly removed. Once installed, adware and other malicious applications insert various items into browsers, which are stored locally. For example, cookies^[2] might be used for further data collection, even though the main app has already been removed. Thus, it is recommended to clean web browsers thoroughly from time to time, and doing so after malware removal is a must. You can either employ FortectIntego for a quick solution or follow the manual steps below:

1. Click Safari > Clear History…
2. From the drop-down menu under Clear, pick all history.
3. Confirm with Clear History.

If you were unable to remove the NavigateSystem extension in a normal way, reset Safari as follows:

• Click Safari > Preferences…
• Go to Advanced tab.
• Tick the Show Develop menu in menu bar.
• From the menu bar, click Develop, and then select Empty Caches.

Note: if you are using Google Chrome, Mozilla Firefox, or MS Edge, check the instructions at the bottom of this article.

Distribution and avoidance

While most potentially unwanted applications – a category NavigateSystem might be assigned to – are usually spread in deceptive methods, this malware strain uses more aggressive methods.

First of all, Mac users are commonly misled by fake Flash Player updates – this plugin was used many years prior, so users associate its logo with something legitimate by default. Most people don't realize that the plugin has been long replaced by more modern technologies (such as HTML 5) and is no longer required to play multimedia. In fact, its developer Adobe has discontinued the support of Flash in early 2021,^[3] so all requests to install it are fake.

Another very popular tactic used by NavigateSystem for distribution is software bundles downloaded from insecure third-party sources. To be more precise, we are talking about torrents, cracks, and similar websites that are commonly used to download software that is otherwise licensed.

Pirated software distribution websites are overall very dangerous, as they could spread malware in various ways as soon as users visit these sites. For example, it is easier for cybercriminals to by ad space there to boobytrap them with malicious scripts, which would install malware automatically on machines where vulnerable software is present (making sure that all applications and the operating system are up-to-date would remove this risk).

In other cases, users might download and install malicious software from torrents themselves, all while believing that they are installing a cracked app. Instead, they can be tricked into installing Adload versions or other malicious software. Therefore, we strongly recommend you stay away from these places and instead only install legitimate software. Employing powerful security software such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes greatly reduces the chances of being infected in the future.