How to remove CapacityMegabyte Mac virus

CapacityMegabyte is a malicious application that targets Mac users

CapacityMegabyte is a Mac virus that you could find on your system after noticing an app with a magnifying glass icon. Most users spot the intruder after they see a suspicious browser extension installed on Safari, Chrome, or another used web browser.

The most distinctive trait of the infection is that the homepage/new tab function is suddenly altered to something different (usually, something deceptive like Safe Finder), and all the searches lead to Yahoo or suspicious providers instead. Searches performed by hijacked web browsers would also produce a significant number of sponsored links at the top of the results – these are all browser hijacker traits.

However, the main goal of the CapacityMegabyte Mac virus is to bring users to as much sponsored content as possible, hence they might notice an overall increase in advertisements while browsing the web – they might show up as pop-ups, banners, auto-play videos, in-text links, etc.

CapacityMegabyte stems from a widespread malware family known as Adload, which has hundreds of versions released before, including NetConnection, WireNavigate, CommonLocator, and many more. The strain specializes in illegal monetization of ads and inadequate data gathering practices, and can also be associated with a myriad of other infections that target Mac systems.

Adload: a widespread threat for Macs

Adload was first spotted back in late 2017 and, since then, has evolved massively. With hundreds of versions released, crooks behind the strain do not seem to stop, and CapacityMegabyte is another addition that keeps infecting users.

The malware family is generally categorized as adware when attention is paid to its main activities – it shows ads when victims are browsing the web. Due to the sage of insecure advertising networks, users are more likely to be exposed to malicious ads, including phishing messages and spoofing websites, which can be extremely dangerous.

Once installed, Alodad variants install the proxy to redirect all users' traffic through an alternative server, which guarantees profits from the attackers. To make matters worse, the virus is not only difficult to detect as it bypasses Mac's built-in protection measures such as Gatekeeper or XProtect,^[1] but it is also more difficult to remove easily.

Watch out for fake Flash Player ads

If you ever wonder how you got infected, you should look no further than fake Flash Player updates and pirated software installers. Flash has been one of the main concerns for security researchers for years, as its familiarity with users made it easier to crooks to mislead them with a bit of social engineering – all they have to do is tell people that Flash is required to access the website (or needs to be updated).

Keep in mind that Flash is no longer supported and has been fully discontinued by its creator, Adobe, at the end of 2020, so all claims that it is required to show multimedia content are fake. In fact, the technology has been long replaced by other solutions, such as HTML 5 or WebGL.^[2]

In order to avoid unintentional installations of malware, you should also stay away from illegal software installers and free streaming websites that promote copyright material. Everything illegal is poorly regulated, which makes it a perfect opportunity for malicious actors to spread malware.

Removal explained

Before you proceed with trying to eliminate the CapacityMegabyte virus manually, we recommend you scan your system with SpyHunterCombo Cleaner, MalwarebytesMalwarebytes, or another powerful anti-malware software to ensure its integrity. While manual steps might work just as well, missing important malicious files and other components might be detrimental to the whole process.

Even if you pick automatic removal methods, we still recommend you pay close attention to the browser cleaning process which we explain below.

1. Get rid of core components

Your first task is to stop all the malicious processes that could be causing the malware to be persistent. To do so, you should access Activity Monitor and shut down malicious processes, and only then remove the main app.

• Open Applications folder
• Select Utilities
• Double-click Activity Monitor
• Here, look for suspicious processes related to adware and use the Force Quit command to shut them down
• Go back to the Applications folder
• Find UpgradedPlatform in the list and move it to Trash.

If the steps above were unsuccessful, you can proceed by eliminating Login items and malicious profiles – proceed with the steps below:

• Go to Preferences and select Accounts
• Click Login items and delete everything suspicious
• Next, pick System Preferences > Users & Groups
• Find Profiles and remove unwanted profiles from the list.
• Go to Preferences > Accounts > Login items and remove the malicious entries.

“Properly list” (PLIST) files are small files usually created by each of the installed applications. They are usually deleted upon applications deletion, although this might not be the case with malware. Thus, you should look for them in the following locations:

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.

2. Clean your browser

It is vital for you to get rid of the malicious extension (although this could be done with a security application automatically) and clean the browser from various leftover files, e.g., cookies^[3] and other trackers. If you would rather not waste your time and automatically clean your browsers and the device, you can employ FortectIntego. If you prefer performing these steps manually, proceed with the following steps:

• Click Safari > Clear History…
• From the drop-down menu under Clear, pick all history.
• Confirm with Clear History.

You can also reset the browser if nothing else works:

• Click Safari > Preferences…
• Go to the Advanced tab.
• Tick the Show Develop menu in the menu bar.
• From the menu bar, click Develop, and then select Empty Caches.

If you are using Google Chrome, Mozilla Firefox, or MS Edge, you will find the instructions for these browsers below.