How to remove BasicTransaction Mac virus

BasicTransaction virus slips through the built-in Mac defenses

BasicTransaction is one of many Adload malware variants that target Mac systems exclusively. The strain is not classified as malware by some security vendors as its main goal is to deliver intrusive advertisements, although there are plenty of detections that allocate it to a trojan category. Indeed, the virus is much more than just your typical adware, and there are plenty of malicious traits it possesses.

BasicTransaction spreads via malicious installers downloaded from pirated software sites, although fake Flash Player updates^[1] and similar misleading prompts can also cause the infection. As soon as malware proliferates the system, it installs itself with elevated permissions, granting it more power over the various device operations.

The main operational surface of the virus is the browser, where users would immediately spot a BasicTransaction extension installed. It would change the homepage and new tab settings, replacing them with something different – this is the browser hijacker element that guarantees user exposure to various advertisements monetized by crooks.

It is important to note that those affected by the virus are at much greater privacy and security risks, as it can gather personal user data in the background and could be related to the installation of other malicious software on a Mac.

Adload brief

The rise of Mac malware is hardly surprising, as more and more users opt to buy Apple products. Despite this, many users still choose not to believe that Mac malware even exists, despite the evidence against that statement. Security researchers have long proven that there are plenty of threats that target macOS users, and they should be aware of that.

Adload is one of many strains that rose up in 2017,^[2] and since then, several hundred of its versions have been released by unknown cybercriminals behind it. According to some security research findings, malware strain is distributed very similarly to other prominent Mac malware – Shlayer Trojan on Bundlore.

The versions of the virus spread using pirated software installers, although fake Flash Player prompts are just as popular. In order to reduce the probability of the infection, we recommend staying away from illegal software distribution websites. Also, Adobe has already discontinued Flash, so all the requests to install it are fake and are likely to result in malware infection.

It goes without saying that malware is very damaging and shouldn't run on the device. Follow the detailed guidelines below in order to eliminate the infection thoroughly.

Removal of the main app

Because Adload variants can effectively bypass Gatekeeper and Xprotect security measures, it is important to keep an alternative security application running in the background, for example, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. These apps can also automatically remove all malicious software from the system.

If you would rather look for manual removal steps, you should proceed with the instructions below. Keep in mind that it might not be as effective as the automatic option, and malware might return.

First off, you should shut down the related malware processes and remove the main application from the system. If that does not work, proceed with the next solution.

• Open the Applications folder and go to Utilities
• Double-click the Activity Monitor and shut down all the suspicious processes.
• From the menu bar, select Go > Applications.
• In the Applications folder, look for all related entries.
• Click on the app and drag it to Trash (or right-click and pick Move to Trash)

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• Find the following entries and delete them:
  /Library/Application Support/.[random_string]/Services/com.BasicTransaction.service.app
  /Library/LaunchAgents/com.BasicTransaction.service.plist
  /Library/LaunchDaemons/com.BasicTransaction.system.plist
  /Library/Application Support/.[random_string]/System/com.BasicTransaction.system
• Go to System Preferences > Accounts > Login items – delete all the malicious entries.
• Finally, go to System Preferences > Users & Groups > Profiles – delete all the malicious entries.

Fix your browsers

As we already mentioned, Adload versions are a huge risk to one's privacy. Since the virus manipulates the permission options on the system, it allows the malicious extension to gather all sorts of personal information via the browser extension and show intrusive ads and redirects. If you'd check the permissions for the extension, you will find the following message on your Safari browser:

Permissions for “BasicTransaction”:

Webpage Contents
Can read sensitive information from webpages, including passwords, phone numbers, and credit cars on all webpages

Browsing History
Can see when you visit all webpages

The problem is that malware usually prevents users from removing the malicious add-on, and the “Uninstall” button is simply grayed out. Luckily, by performing the steps described in the previous section, you are likely to succeed:

1. Click Safari > Preferences…
2. In the new window, pick Extensions.
3. Select the unwanted extension and select Uninstall.

Passive data tracking can also be performed with the help of cookies^[3] and other trackers, which are stored locally. Therefore, we recommend cleaning web browsers promptly after malware is terminated. You can either use the manual steps or employ the FortectIntego cleaning tool for this purpose.

1. Click Safari > Clear History…
2. From the drop-down menu under Clear, pick all history.
3. Confirm with Clear History.

In some cases, resetting the browser is the best choice once all adware is deleted from the device:

• Click Safari > Preferences…
• Go to the Advanced tab.
• Tick the Show Develop menu in the menu bar.
• From the menu bar, click Develop, and then select Empty Caches.

If you are using Google Chrome or Mozilla Firefox, you will find the step-by-step instructions below.