Binarymove virus: what it is and how to remove it
Binarymove virus is a a browser infection on macOS systems, and affects Safari, Google Chrome, Mozilla Firefox, and other web browsers. The threat is usually established as soon as a potentially unwanted program is installed on the system - it can be either an app downloaded from a random website or come as an optional component within a software bundle package.
Facts checked October 6, 2026. Removal steps checked against Apple's current documentation and the security vendors' reports. We have not run the malware on a Mac. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your Mac is infected.
Fortect for Mac scans for malware and unwanted programs, and its free scan shows what it finds before you decide anything.
If Binarymove virus keeps coming back after uninstalling, a scan can find what reinstalls it.
Do it yourself · free Remove Binarymove virus yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Binarymove virus: summary
| Name | Binarymove virus |
|---|---|
| Type | Mac virus, potentially unwanted program |
| Infiltration | users infect their macOS when downloading unapproved apps from third-party sites (software bundling) or after being tricked by a fake Flash update prompt |
| Symptoms | Pop-ups, in-text links, deals, banners, offers, coupons, and other ads populate all websites that you visit Homepage and new tab address, along with a search engine, altered Redirects lead to unknown and suspicious websites Search results are filled with sponsored links and ads Web browser is slow to respond and some pages do not load entireyl |
| Dangers | Installation of other potentially unwanted applications or malware, sensitive data disclosure due to scams, monetary loss, etc. |
| Detection names | No Microsoft detection name is known |
| Removal | Scan the Mac with security software to find the malware and anything installed with it. Fortect for Mac scans for malware and unwanted programs. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 6 more facts
| Distribution | Not recorded in the old report |
|---|---|
| Damage | Not recorded in the old report |
| Evidence | 5 write-ups by security sites; details still limited |
| Program | Binarymove virus |
| First seen | 20 February 2020 |
| Facts checked | 6 October 2026 |
Is Binarymove virus safe? Why it is flagged
From our report of Feb 2020 · not reviewed since
Binarymove virus - a potentially unwanted program that inserts intrusive ads into Macs
Binarymove virus is a a browser infection on macOS systems, and affects Safari, Google Chrome, Mozilla Firefox, and other web browsers.
The threat is usually established as soon as a potentially unwanted program is installed on the system - it can be either an app downloaded from a random website or come as an optional component within a software bundle package.
Third party software distribution sites often compile several apps into a single installer, disguising adware, browser hijackers, and other PUPs from users' eyes deliberately. As a result, users may find Binarymove Mac virus seemingly out of nowhere.
Once inside the system, Binarymove may alter the web browser settings in order to set a new homepage, new tab URL, and also apply a customized search engine.
The hijacked engine then will display results that are filled with sponsored links which generate advertisement revenue for the Binarymove developers. Additionally, redirects to scam, phishing, or even malware-ridden websites may result in unexpected money loss, private data disclosure to unknown parties, computer infections, etc.
Because Binarymove is a browser infection, it can also come as an extension/add-on.
These programs can usually be eliminated relatively easily, although some might engage in borderline malicious behavior (such as establishing Profiles without permission, populating ".plist" files on the system, etc.) Therefore, Binarymove virus removal might sometimes not be that as easy as it may seem, as the unwanted app may disable extension removal function on Safari or another web browser altogether.
A particularly annoying feature of the Binarymove virus is the advertisements that are constantly displayed to Mac users - pop-ups, auto-play ads, in-text links, push notification prompts, and other intrusive content. These ads can sometimes hinder the content of the site, making regular web browsing activities difficult.
Binarymove PUP developers provide this intrusive content in order to monetize users' clicks on ads, sometimes compromising their safety. However, shady apps authors do not care about users' safety; that is why they often choose unsafe advertising platforms that serve scam messages and malicious popups.
For example, users infected with Binarymove may encounter the following:
While ads and redirects to suspicious sites may seem like a nuisance, it is important to note that interacting with the presented content might lead to malware infections, sensitive information (such as banking details) disclosure to cybercriminals, or monetary loss due to useless subscriptions or tech support scams.
Therefore, remove Binarymove virus before you suffer from its prescience. The easiest way to do it is by employing anti-malware software, although sometimes simply resetting browsers will suffice. In any case, if you want to optimize your Mac, use .
- Fake virus alerts. These typically claim that Mac is infected with malware, and needs to be fixed with some fake anti-virus software, which is actually malware itself.
- Bogus Flash update prompts. Fake updates are commonly used to distribute adware and malware like Shlayer Trojan or Advanced Mac Cleaner.
- Survey scams are designed to lure users into providing their personal information, such as email, name, phone number, or even credit card information.
- Get-rich-quick scams usually focus on promising users easy (but quick) earnings online - they ask to pay the initial "investment." This money will never be recovered and is transferred directly into scammers' pockets.
From our report of Feb 2020 · not reviewed since
Avoid apps from third-party sites and watch out for fake Flash player prompts
Apple, along with other huge IT companies like Google and Microsoft, is aware of the increasing number of online scams and malware distribution attempts around the web.
Therefore, corporations use multiple protection and precautionary measures to protect users from online threats. Despite that, there are still many dangers that simply cannot be contained, and the matter becomes worse when users start ignoring security advice from security experts and malware researchers.
While Mac machines are considered to be safer than Windows, those who visit high-risk websites and download applications from third-party sites are at an elevated risk of malware infections. Thus, avoid such sources when possible - note that App Store alone holds approximately 1.8 million apps for your disposal, so there is plenty to choose from.
Nevertheless, if you insist on downloading apps from third-parties, beware of deception - pre-ticked boxes, fine print text, misplaced buttons, and other tricks are common within the installers. Besides, always opt for Advanced/Custom mode if such a setting exists, as it will allow you to get rid of optional programs before finalizing the installation.
Additionally, watch out for fake Flash (otherwise known as Shockwave Flash) update prompts - you should never "update" this plugin. The software is flawed, outdated, and is not needed by a regular computer user, as HTML 5 technology replaces it completely. Multiple software vulnerabilities and its usage in scams prompted Adobe to cancel its support - it will be terminated at the end of 2020.
From our report of Feb 2020 · not reviewed since
Terminate Binarymove virus from your Mac
There are several methods to remove Binarymove virus from your computer - and it all depends on multiple factors, such as whether your machine is heavily infected (with malware), and which PUP is connected to the unwanted activity within your browser. In other words, each case is different and needs to be handled accordingly.
Because of this, we would first advise you to check your web browsers for unwanted extensions and get rid of everything you don't recognize. If some of the add-ons are grayed out and cannot be deleted, you should reset all the installed web browsers, as explained below.
In case that did not help, you will have to terminate a potentially unwanted application that is installed on your computer. First, try to enter Applications folder and then move the unknown apps to Trash and then look for the suspicious entries in the following folders:
Get rid of the unwanted Profiles:
And, finally, you should complete Binarymove virus removal by scanning your machine with reputable anti-malware software - it should be able to find all malicious files automatically (if you were not successful in finding them).
- /Library/LaunchAgents
- /Library/Application Support
- /Library/LaunchDaemons
- Go to System Preferences…
- Select Profiles
- Get rid of the unwanted profile by clicking on "-" at the bottom-left
From our report of Feb 2020 · not reviewed since
More from our earlier report on Binarymove virus
- Various scams may offer you software to "speed up your Mac," - these apps show false positives in order to boost sales but do not fix computer issues as promised.
- If you need a tool that can get rid of unneeded files for you quickly, enhancing its performance, resort to powerful tools like
How to uninstall Binarymove virus
Remove the app and what starts it, then check the browsers.
Step 1: Delete apps and downloads you did not intend to install
Open the Applications folder and your Downloads folder. Drag any app you did not install, and any disk image (
.dmg), installer (.pkg) or archive (.zip) that came from Binarymove virus or a site you do not trust, to the Bin, then empty the Bin.Also check
~/Library/Application Supportfor a folder with the same name as the app you removed.Step 2: Remove unknown login items and background items
Open System Settings > General > Login Items & Extensions. Under Open at Login and Allow in the Background, switch off or remove anything you do not recognize, especially items whose developer is shown as an unknown name or that appeared on the day you ran the command.
Then open Finder, choose Go > Go to Folder and check
~/Library/LaunchAgents,/Library/LaunchAgentsand /Library/LaunchDaemons for property list (.plist) files you did not add. Drag suspicious ones to the Bin, then restart the Mac.Step 3: Check the browsers for extensions and changed settings
In Safari open Settings > Extensions and General (homepage). In Chrome open
chrome://extensions, in Firefoxabout:addons.Remove any extension you did not add, and reset the homepage and search engine if they changed. Browsers hold saved passwords and cookies, which is why the password step comes first.
Step 4: Quit what is running that you do not recognize
Open Activity Monitor (in Applications > Utilities, or search for it with Command + Space).
In the CPU or Network tab, look for a process you did not install or whose name is random, select it, click the stop button (the octagon with an X) and choose Quit or Force Quit.
Note the name first: you will look for the same name in the next steps. Malware that comes back after a restart is handled in the next two steps.
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Remove from Google Chrome
Delete malicious extensions from Google Chrome:
- Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
- In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.
Clear cache and web data from Chrome:
- Click on Menu and pick Settings.
- Under Privacy and security, select Clear browsing data.
- Select Browsing history, Cookies and other site data, as well as Cached images and files.
- Click Clear data.
Change your homepage:
- Click menu and choose Settings.
- Look for a suspicious site in the On startup section.
- Click on Open a specific or set of pages and click on three dots to find the Remove option.
Reset Google Chrome:
If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:
- Click on Menu and select Settings.
- In the Settings, scroll down and click Advanced.
- Scroll down and locate Reset and clean up section.
- Now click Restore settings to their original defaults.
- Confirm with Reset settings.
Remove from Mozilla Firefox (FF)
Perform the following actions to reset Mozilla Firefox if you are having difficulties in terminating some browser extensions:
Remove dangerous extensions:
- Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
- Select Add-ons.
- In here, select the unwanted extension and click Remove.
Reset the homepage:
- Click three horizontal lines at the top right corner to open the menu.
- Choose Settings.
- Under Home, set your preferred homepage and new tab settings.
Clear cookies and site data:
- Click Menu and pick Settings.
- Go to Privacy & Security section.
- Scroll down to locate Cookies and Site Data.
- Click on Clear Data...
- Select Cookies and Site Data and Temporary cached files and pages, then click Clear.
Reset Mozilla Firefox
If clearing the browser as explained above did not help, reset Mozilla Firefox:
- Open Mozilla Firefox browser and click the Menu.
- Go to Help and then choose Troubleshooting Information.
- Under Give Firefox a tune up section, click on Refresh Firefox...
- Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.
Delete from Safari
Reset Safari if you want to ensure that Binarymove ads do not return:
Remove dangerous extensions:
- Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
- Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.
Clear history and website data:
- Click Safari in the menu and pick Clear History.
- Set Clear to all history and confirm with Clear History.
Reset Safari:
- Click Safari in the menu and select Preferences > Advanced.
- Enable Show Develop menu in menu bar.
- From the menu bar, click Develop and select Empty Caches.
Delete from macOS
To get rid of unwanted apps via the Applications folder on macOS, follow these steps:
Remove the unwanted application:
- From the menu bar, select Go > Applications.
- In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).
Delete leftover files and folders:
- Select Go > Go to Folder.
- Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
- Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.
- Finally, empty the Trash to permanently remove the leftovers.
Stream videos without limitations, no matter where you are
There are multiple parties that could find out almost anything about you by checking your online activity.
While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.
Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.
Data backups are important - recover your lost files
Ransomware is one of the biggest threats to personal data.
Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.
While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as can also be effective and restore at least some of your lost data.
Questions about Binarymove virus
Is Binarymove virus a virus?
Most programs that appear the way Binarymove virus did are not viruses in the strict sense. They are potentially unwanted programs:
- real software that arrives bundled with other downloads and then shows offers
- changes browser settings
- starts with Windows
Some are harmless, some are annoying and a few carry adware. What makes it worth removing is that you did not choose it.
Uninstall it from Installed apps and check the startup list and the browsers for anything added the same day. If it refuses to uninstall or returns after a restart, treat it as more serious and run a Microsoft Defender offline scan.
Binarymove virus will not uninstall. What can I do?
First restart the PC and try again, because the program may have been running and locked its own files. If the uninstaller is missing or fails, start Windows in Safe Mode, where most third-party programs do not start, and remove Binarymove virus from Installed apps there.
If it still refuses, delete its startup entry and its scheduled task, restart, and try once more. A program that actively prevents removal is behaving like malware, so finish with a Microsoft Defender offline scan. Avoid third-party uninstallers offered on search ads; several of them are unwanted programs themselves.
Will removing Binarymove virus speed up Windows?
It often helps a little and sometimes a lot, depending on how many programs came in the same bundle. Every unwanted program that starts with Windows adds to boot time and uses memory. The one behind binarymove virus in the list of installed apps is no exception.
Remove it, check the Startup list for others, restart and compare. If the PC is still slow, look at disk space, Windows updates and the processes at the top of Task Manager. A clean PC should sit almost idle when no programs are open.
Is it safe to remove Binarymove virus?
Yes. Removing an unwanted program does not damage Windows, because programs like this are not part of the system. Before uninstalling, make sure it is not something you rely on: if the publisher is a company you know and you use the program, keep it.
If not, uninstall it from Installed apps, restart and check that binarymove virus in the list of installed apps is gone. If something you need stops working afterwards, reinstall that program from its official website, choosing the custom installation so that the unwanted extra is not added again.
Can I use Binarymove virus safely?
Yes, if you installed it on purpose and control its settings. Download it only from the publisher's own site, never through a bundle or a portal. After installing, disable automatic start, offers and telemetry, and check that it did not change your search engine or add extensions.
Watch for renewals if you bought a licence, and turn on PUA blocking in Windows Security so that anything it tries to add during updates is stopped. If Binarymove virus keeps pushing payments or offers, it is not worth the trouble.
Why does my antivirus call Binarymove virus a PUA or PUP?
These labels mean potentially unwanted application or program. They are used for software that is legal but uses deceptive distribution, aggressive ads, misleading claims or a hard removal. Microsoft's PUA categories include advertising software, bundlers, download managers, torrent clients, marketing software and miners.
A PUA detection is a warning, not proof of infection, and you decide whether to keep Binarymove virus. Other vendors use their own labels for the same idea, such as PUP.Optional or not-a-virus. Read more in our guide to potentially unwanted programs.
The uninstaller for Binarymove virus keeps asking me to stay. Is that normal?
It is a common tactic, not a technical requirement. Uninstallers of unwanted programs often show discounts, warnings that the PC will be at risk, or a choice between "repair" and "remove" designed to confuse. Choose the option that removes the program completely and decline everything else.
If the uninstaller closes without removing anything, end its processes in Task Manager and try again, or use Safe Mode. Check Installed apps afterwards; if Binarymove virus is still listed, the uninstall did not finish.
Is Binarymove virus a virus?
Not in the strict sense. Nothing reported so far shows Binarymove virus copying itself, encrypting files or stealing passwords, which is what security companies mean by a virus.
What people see is binarymove virus in the list of installed apps, which fits an unwanted program: software that arrives bundled with something else and keeps running without being asked for. Many antivirus programs label such software PUP or PUA rather than malware.
That label does not make it harmless. It still uses your PC and connection, may collect data and is often bundled with other programs, so removing it is the right call. Uninstall it from Installed apps, then check startup items and browser settings for its companions.
Can Windows block unwanted programs automatically?
Yes, with one setting. Windows Security has Potentially unwanted app blocking under App & browser control > Reputation-based protection settings. Block apps stops flagged programs from installing, and Block downloads works in Microsoft Edge.
On some PCs this was not switched on, which is how programs like Binarymove virus got through. It does not catch everything, so read installer screens, choose Custom setup and decline offers. Removing free tools you no longer use also helps, because their updates are a common route for new bundles.
Will Fortect remove Binarymove virus?
Fortect for Mac scans for malware and unwanted programs, and its free scan shows what it finds on your Mac before you decide anything.
For Binarymove virus, follow the plan on this page as well: removing a launch item or an app is done in macOS itself, and a scanner cannot undo what was typed or entered on the infected Mac, such as saved passwords that were copied.
Change your passwords from another device first, and if the page tells you to erase the Mac, a scan is not a substitute. The free scan costs nothing and the full-featured product needs a license.
Sources
- Wikipedia: Get-rich-quick scheme (read October 6, 2026)
- Microsoft: Adobe Flash end of support on December 31, 2020 (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 6, 2026)
- Microsoft Learn: How Microsoft names malware (read October 6, 2026)