How to remove IndexerClient Mac virus

IndexerClient is a malicious Mac application that attempts to steal your banking information and other details

IndexerClient is a Mac virus you may encounter running on your device one day. Unlike many other adware infections that plague macOS users, this one is a bit more serious. It stems from a well-established malware family known as Adload, which has hundreds of versions under its belt since its release by unknown cybercriminals back in 2017.

Variants of this malware strain and not only relatively widespread by also quite evasive. Upon entering the system via fake Flash Player updates or pirated software installers, IndexerClient runs on the system with higher permissions, which allows it to control the device how it pleases. This means that Mac's security systems lay dormant while users have to deal with the infection running on their computers as soon as they are turned on.

One of the first infection symptoms most people notice is the change to their Safari, Chrome, or another web browser. The installed extension, which uses a unique magnifying glass icon, would change the browser's homepage and alter the search provider, resulting in alternative search results filled with ads and sponsored links (those infected will also experience more redirects to malicious websites and more ads overall while browsing).

This IndexerClient virus component is also used to collect various personal user data, including credit card details or login credentials. Among other issues, users may find other potentially unwanted applications installed on their devices without permission, which can be a serious security threat. We recommend not delaying the removal of this threat.

How Adload malware is spread and how to avoid it

Adload is a relatively established strain, and it achieved this by using effective distribution methods. The first and the most commonly-used one consists of showing fake Flash Player update prompts to users on various websites. People usually encounter them after clicking a malicious link on an already high-risk site or because adware is already running on their systems.

The scheme is very simple – Users are told that they need to update or install Flash Player in order to access some type of multimedia content. Since the plugin has been used for multimedia for so long that it is regarded as something required for this day. The truth is, Flash was discontinued a few years ago by its developer^[1] and requests to install it are fake.

The other popular method for Adload distribution is malicious installers from peer-to-peer^[2] networks and similar pirated software distributors. We recommend never using these, as they are known to be one of the main reasons why users get infected with malware.

IndexerClient removal

Below you will find everything you need to remove malware from your system effectively. Adload is one of the more persistent threats for Macs, so we would highly recommend you avoid the manual method. Upon infiltration, it employs the built-in AppleScript to grant itself elevated permissions, exempting itself from detection of local Mac defenses such as XProtect^[3] and dropping dozens of items on the system.

This may severely complicate the elimination process, so we strongly recommend that regular users employ automatic removal tools such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. With the help of third-party security software, you can avoid malware's evasion mechanisms that affect Mac's security tools and ensure that no infections happen in the future. Nonetheless, you can pick the manual removal method too.

Delete the main application and the extension

Your first task is to find the malicious app and remove it – you should start by stopping its background processes via the Activity Monitor.

• Open Applications folder
• Select Utilities
• Double-click Activity Monitor
• Here, look for suspicious processes and use the Force Quit command to shut them down
• Go back to the Applications folder
• Find the malicious entry and place it in Trash.

Upon infiltration, the virus might establish new User profiles and Login items for persistence. This might be the reason why you can't get rid of the app or the extension.

• Go to Preferences and select Accounts
• Click Login items and delete everything suspicious
• Next, pick System Preferences > Users & Groups
• Find Profiles and remove unwanted profiles from the list.

Finally, you should get rid of the extension that is used by crooks to harvest various personal data. Proceed with the following steps (note: if you can't perform this step, skip it for now):

Safari

1. Click Safari > Preferences…
2. In the new window, pick Extensions.
3. Select the unwanted extension and select Uninstall.

Google Chrome

1. Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
2. In the newly opened window, you will see all the installed extensions. Uninstall all the suspicious plugins that might be related to the unwanted program by clicking Remove.

Remove leftover files or reset your browsers

Leftover files known as PLIST hold various important configuration settings and might hold a virtual role in malware's operation. Remove them as follows:

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and delete all the related .plist files.

You should also clean your web browsers to remove various trackers and other caches to ensure proper NetDivision removal. You can employ FortectIntego for this job, or you can follow the manual steps below:

Safari

1. Click Safari > Clear History…
2. From the drop-down menu under Clear, pick all history.
3. Confirm with Clear History.

Google Chrome

1. Click on Menu and pick Settings.
2. Under Privacy and security, select Clear browsing data.
3. Select Browsing history, Cookies and other site data, as well as Cached images and files.
4. Click Clear data.

If you were unable to remove malware components within your web browser, you could simply reset it as we explain below. Your bookmarks and other preferences will not get lost as long as you remember your account details. Proceed with the following to reset your browser:

Safari

1. Click Safari > Preferences…
2. Go to the Advanced tab.
3. Tick the Show Develop menu in the menu bar.
4. From the menu bar, click Develop, and then select Empty Caches.

Google Chrome

1. Click on Menu and select Settings.
2. In the Settings, scroll down and click Advanced.
3. Scroll down and locate Reset and clean up section.
4. Now click Restore settings to their original defaults.
5. Confirm with Reset settings.

You can find the instructions for MS Edge and Mozilla Firefox below.