How to remove UniversalSearchConsole Mac virus

UniversalSearchConsole is a malicious Mac application mainly distributed via fake Flash Player installers

UniversalSearchConsole is a malicious application that belongs to one of the broader malware families known as Adload, which targets Mac users exclusively. Malware is always installed by users themselves, even though they are tricked into doing so: they either install it along with pirated applications from insecure websites or get tricked by a fake Flash Player update prompt.

Once installed, the UniversalSearchConsole virus changes the way the system operates in various ways, initially invisible to the affected users. However, the signs of infection are almost immediately noticeable whenever Safari, Chrome, or another browser is opened – there's a new extension of the same name attached to it, which also comes with a myriad of other issues. For example, the homepage and search provider might be altered, and users may be more likely to encounter intrusive ads or phishing^[1] material while browsing the internet.

The underlying issues of the UniversalSearchConsole infection might include the inability to remove the browser extension, virus components returning after removal, and persistent personal information tracking. We recommend you take your time to get rid of this dangerous threat as soon as possible, as it may compromise your personal safety and be a great danger to your computer.

Adload shouldn't be taken lightly

First appearing in 2017, the Adload malware strain managed to accumulate hundreds of versions over the years. Just recently alone, we have covered VictorSurge, LivingAware, PlatformFormat, and AssistSample, all of which were released in the spawn of days between each other. Indeed, malware authors are very active and continue to infect more users worldwide.

UniversalSearchConsole does not differ much from its predecessors: it uses an identical icon (includes the magnifying glass in a teal background this time, although this may vary from version to version) and operates in a very similar manner.

As mentioned, the distribution methods are always the same – Flash Player updates and pirated software installers, which proved to be extremely effective over the years. Once installed, malware would make use of the built-in AppleScript to change numerous features of the computer of how it operates.

While it can be easily categorized as adware when it comes to its main monetization scheme, it is far from that. There is a browser hijacking^[2] component that may change users' homepage and show tons of composed links and ads, all while showing alternative search results.

Because the app is capable of avoiding detection, spying on users' personal details, and installing other viruses without the user's knowledge, many security vendors simply categorize it as malware, something that it definitely deserves to be called. The consequences of letting it run on the system can be devastating, so you should waste no time and remove it.

How to get rid of UniversalSearchConsole effectively

Apple products are considered relatively safe, although this does not mean that they are completely secure from any type of infection. In fact, adware is one of the biggest Mac problems when it comes to security, as all the security measures might be bypassed if the user is convinced they aren't installing something malicious.

Before UniversalSearchConsole can be installed, users need to enter their Apple ID credentials, which immediately allows the virus to perform actions as programmed by the hackers. With this simple trick, malware can create new Login items, bypass the removal of XProtext and Gatekeeper, and continue operating even if some of the components are removed.

Therefore, we highly suggest you rely on automatic virus elimination with the help of SpyHunterCombo Cleaner or MalwarebytesMalwarebytes security software. If you would rather get rid of malware yourself, you can follow the steps below, although keep in mind that this method might not always result in full removal of the virus, and symptoms may come back. Regardless of whether you choose manual or automatic removal, you should always clean your web browsers for the best results.

Remove the main app components

In order to operate continuously, the malware launches its processes as soon as the system is launched. This may hinder an easy removal of malware components, so make sure you should the malicious processes down via the Activity Monitor:

• Open Applications folder
• Select Utilities
• Double-click Activity Monitor
• Here, look for suspicious processes related to adware and use the Force Quit command to shut them down
• Go back to the Applications folder
• Find the malicious app from the list and move it to Trash.

The PLIST files are small config files, also known as “Properly list.” They hold various user settings and hold information about certain applications. To remove the virus, you have to find the related PLIST files and remove them.

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.

Login items and Profiles can also be used to increase persistence. Hence, if you see any of the unknown ones, remove them as follows:

• Go to Preferences and pick Accounts
• Click Login items and delete everything suspicious
• Next, pick System Preferences > Users & Groups
• Find Profiles and remove unwanted profiles from the list.

Take care of your browsers

Upon installation, the UniversalSearchConsole extension would be granted permission to gather various sensitive information, including credit card details or passwords of your accounts. Therefore, it is extremely important to remove this component from your browser as soon as possible.

It is important to note that it might not be possible for you to uninstall the extension, as the option might be grayed out. In this case, we recommend you simply reset your browser – this will get rid of all the unwanted extensions for you.

Finally, make sure you clean your browsers from cookies^[3] and other trackers. You can either choose the automatic option with FortectIntego (which can also help you clean the system from other junk and improve its performance) or follow the manual instructions below appropriate for your browser.