How to remove BasicLocator Mac virus

BasicLocator – a Mac virus that can hijack your device and steal your data

BasicLocator is a type of adware similar to others that have been present online for several years. It often reaches users’ devices through misleading prompts, such as fake updates for essential software or installers obtained from unreliable websites. 

After being installed, BasicLocator secures elevated permissions on the affected system, allowing it to stay operational over a long period. It creates persistence mechanisms by modifying system settings, including adding Login Items and other entries. A key sign of its presence is the installation of a browser extension, which may affect popular browsers like Safari, Chrome, or Firefox.

This adware disrupts browsing experiences by altering search results to include intrusive advertisements and possibly dangerous links. Users might face an increase in phishing attempts, exposing them to further risks like malware infections or financial scams. 

A particularly concerning feature of BasicLocator is its potential to monitor users’ browsing activities and collect sensitive data. This can include personal details such as login credentials or banking information. Removing this adware promptly is essential to safeguard both your data and your device.

Techniques used by cybercriminals to spread BasicLocator

BasicLocator is a type of malicious software designed to specifically target macOS users. Cybercriminals use various tactics to distribute this malware, with some of the most common methods involving fake software updates and downloads from unofficial platforms.

One of the primary techniques involves counterfeit Flash Player updates. Cybercriminals set up deceptive websites that closely imitate official pages, often using logos and designs to mimic trusted brands. These sites prompt users to download a supposed Flash Player update, but the file they install is actually malware. In some cases, these pages employ scare tactics, such as warnings about system vulnerabilities or restricted access to content, to pressure users into downloading the update.

Another method of spreading the virus involves pirated software distributed on untrustworthy websites. These packages often claim to offer free versions of premium programs, such as VPNs, Adobe products, or antivirus software. However, these downloads are bundled with malicious software.

Users who download from unofficial sources may be attempting to avoid paying for licensed software, but this choice comes with significant risks. Besides BasicLocator, they could unknowingly install additional threats, such as spyware or trojans, further compromising their system's security.

BasicLocator: a threat to Mac users

The rising popularity of Macs has shattered the misconception that they are immune to malware. Over the past few years, there has been a sharp increase in malware targeting macOS, drawing the focus of cybercriminals globally.

Although Macs are generally less susceptible to severe threats like ransomware or rootkits, they have become a prime target for adware. Mac-specific adware is often more aggressive and disruptive compared to similar programs designed for Windows systems.

BasicLocator, a persistent and invasive adware variant, exemplifies this trend. Known for its distinct icon – featuring a magnifying glass against backgrounds in colors like teal, green, blue, or gray – this malware has plagued Mac users for years. The presence of this icon in an app or browser extension is a common sign of the infection.

One of its defining traits is its ability to evolve and bypass macOS security measures. Using advanced techniques, BasicLocator employs tools like AppleScript to circumvent Gatekeeper and XProtect, which are critical defense mechanisms for Macs.

Once it infiltrates the system, it installs extensions and other components with elevated permissions, enabling it to harvest personal information and download additional malicious software. This often results in a cascade of infections, with multiple malware variants complicating the cleanup process. Removing BasicLocator can be a difficult task, but proper measures can restore the device's security.

How to remove malicious software from your Mac

The easiest and most practical way to remove malicious software from your Mac is by running a scan with an anti-malware app like SpyHunterCombo Cleaner, MalwarebytesMalwarebytes, and related ones. These programs will automatically locate and delete the harmful components of the malware, which the user running the scan cannot do, and reduces any chances of leaving any stray files behind that might reignite the malware. It's a lot faster than doing this manually.

If you want to remove the malware manually, you need to do it very carefully because incomplete removal may lead to reinfection. Start with the following steps:

• Open Applications folder.
• Select Utilities.
• Double-click Activity Monitor.
• Here, look for suspicious processes and use the Force Quit command to shut them down.
• Go back to the Applications folder.
• Find the malicious entry and place it in Trash.

To effectively remove the malware from your Mac, you need to address two critical components that it manipulates: Login Items and Profiles. Both play a significant role in the persistence and functionality of the malware. 

• Go to Preferences and pick Accounts.
• Click Login items and delete everything suspicious.
• Next, pick System Preferences > Users & Groups.
• Find Profiles and remove unwanted profiles from the list.

Finally, you should get rid of Launch Daemons and other configuration data left by malware. Proceed with the following:

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and delete all the related .plist files.

Taking care of the web browser components

The BasicLocator adware uses its accompanying browser extension to modify browser settings and flood Safari, Chrome, or other browsers with intrusive advertisements. These ads appear every time the browser is opened, ensuring a steady stream of revenue for the attackers from clicks and impressions.

What makes this extension particularly concerning is its elevated permissions, which enable it to collect sensitive information such as login credentials and credit card details. This poses a significant risk to user privacy and financial security. Removing the browser extension is essential and should be done using the following steps:

Safari

1. Click Safari > Preferences…
2. In the new window, pick Extensions.
3. Select the unwanted extension and select Uninstall.

Google Chrome

1. Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
2. In the newly opened window, you will see all the installed extensions. Uninstall all the suspicious plugins that might be related to the unwanted program by clicking Remove.

It is crucial to delete all leftover components from your browser after removing the BasicLocator extension. If any remnants are left behind, the adware may continue tracking your data or reintroduce intrusive advertisements.

For a quicker and more efficient cleanup, consider using FortectIntego. This tool can help identify and remove residual files that might otherwise go unnoticed, ensuring your browser is free from malicious components. Taking this step will enhance your privacy and prevent the reappearance of unwanted ads.

Safari

1. Click Safari > Clear History…
2. From the drop-down menu under Clear, pick all history.
3. Confirm with Clear History.

Google Chrome

1. Click on Menu and pick Settings.
2. Under Privacy and security, select Clear browsing data.
3. Select Browsing history, Cookies and other site data, as well as Cached images and files.
4. Click Clear data.

At times, the persistence mechanisms employed by the virus can make it impossible to remove the extension. In such cases, it is advisable to reset the web browser entirely, following the instructions provided below:  

Safari

1. Click Safari > Preferences…
2. Go to Advanced tab.
3. Tick the Show Develop menu in menu bar.
4. From the menu bar, click Develop, and then select Empty Caches.

Google Chrome

1. Click on Menu and select Settings.
2. In the Settings, scroll down and click Advanced.
3. Scroll down and locate Reset and clean up section.
4. Now click Restore settings to their original defaults.
5. Confirm with Reset settings.