How to remove EasyHandler Mac virus

EasyHandler is Mac malware that steals personal user information

EasyHandler is a malicious application that you might install by accident – either after being tricked by a fake Flash Player update or after installing pirated software on your system. It belongs to a broad family of Adload, which is one of the most prominent strains targeting Mac machines and is commonly associated with other prevalent infections such as Shlayer.

Once installed, the EasyHandler virus uses elevated permissions to drop various malicious files on the system, which increase its persistence. As a result, users have a much harder time when trying to eliminate the app, as moving it to trash only results in it returning after a computer restart.

Users might not notice the infection symptoms until they open their browsers, as there is where the extension would reside – it would have a distinctive magnifying glass icon on a gray or green/teal background. Thanks to this component, EasyHandler can change the browser's homepage and new tab settings, ensuring that users would be forced to use an alternative search provider such as Safe Finder and insert ads into the search results.

More about malware family

EasyHandler stems from one of the most prominent malware families out there – Adload. It was first spotted in the wild in 2017, and since then has released hundreds of versions, including FrequencyPlatform, UniversalKey, DirectNetwork, ProcesserGrid, and many others we previously covered.

Even though there are some minor changes between versions, the strain's operation and distribution remain relatively unchanged. It always uses the magnifying glass icon for both the main application and the browser extension – this is one of the easiest ways to recognize the infection.

While EasyHandler is categorized as adware,^[1] its impact on the system is much more significant beyond just showing ads – its traits are considered malicious in many ways.

EasyHandler Mac capabilities

Adload uses rather simple distribution and operation techniques that are extremely effective for Mac devices – this is precisely the reason why so many Apple devices get infected by it. To avoid being infected, you should never download software from pirated application distribution websites and be aware of fake Flash Player updates.

While the main goal of the virus is to show advertisements and earn pay-per-click^[2] revenue, plenty of other components support its main activities. For example, the usage of AppleScript allows the virus to completely avoid the detection of built-in Mac defenses like XProtext and Gatekeeper.

The browser extension component of the infection also helps it to fulfill its operations – not only can it insert advertisements when users browse the web but it can also read personal information from users, including passwords or credit card details. Of course, this functionality is particularly dangerous and might result in identity theft and other serious issues.

EasyHandler removal steps

You are likely won't be able to remove the browser extension or the application just like you do with regular apps. Thanks to the elevated permissions on the system, the app drops several malicious files, creates new profiles and login items. Therefore, we recommend getting rid of the infection automatically with MalwarebytesMalwarebytes or SpyHunterCombo Cleaner security software, so you won't have to bother with the steps below. Regardless of which method of elimination you pick, we still recommend cleaning web browser caches^[3] thoroughly to prevent issues in the future.

Once installed, the malware runs background processes to fulfill its duties. To remove the main application, you should first shit down these processes via the Activity Monitor:

• Open Applications folder.
• Select Utilities.
• Double-click Activity Monitor.
• Here, look for suspicious processes and use the Force Quit command to shut them down.
• Go back to the Applications folder.
• Find the malicious entry and place it in Trash.

Login items ensure that the app starts as soon as the computer boots, and Profiles are used to manage various account settings. Get rid of malware-related components:

• Go to Preferences and pick Accounts.
• Click Login items and delete everything suspicious.
• Next, pick System Preferences > Users & Groups.
• Find Profiles and remove unwanted profiles from the list.

Your next task is finding Plist files that hold various configuration data of the virus. You can do that as follows:

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and delete all the related .plist files.

Clean your browsers thoroughly

If you performed manual elimination, the browser might still be vulnerable for as long as the extension remains installed. Even if you choose the automatic removal method, we strongly recommend using the effective cleaning process, as tracking cookies^[3] may remain. If you haven't yet, make sure you delete the extension from the browser:

• Click Safari > Preferences…
• In the new window, pick Extensions.
• Select the unwanted extension and select Uninstall.

If you managed to get rid of the extension in a regular way, you should also clean your browser caches to prevent further data tracking. The easiest way to do this and remove all junk from the system is to employ FortectIntego maintenance utility. Alternatively, you can proceed with the following instructions:

• Click Safari > Clear History…
• From the drop-down menu under Clear, pick all history.
• Confirm with Clear History.

If you are unable to delete the extension, a browser reset would work.

• Click Safari > Preferences…
• Go to the Advanced tab.
• Tick the Show Develop menu in the menu bar.
• From the menu bar, click Develop, and then select Empty Caches.