ColossusAspect Mac virus (Free Instructions)

What is ColossusAspect Mac virus?

ColossusAspect is a Mac virus that forces the usage of alternative providers and harvests user data

ColossusAspect is a malicious Mac application that inserts intrusive ads and tracks personal data

ColossusAspect is a malicious application that stems from a well-established malware family known as Adload. Since its release in 2018, hundreds of versions of it have been released already, with the newest ones including better obfuscation and persistence traits. If you have found this malicious extension or the app installed on your system, you should get rid of it as soon as possible, as it poses serious security and privacy risks.

If you do not remember installing the ColossusAspect virus purposely is because of its deceptive distribution methods. Pirated application bundles and fake Flash Player updates are commonly used to trick users into installing Adload versions, so they often don't notice the point of entry.

Once on the system, malware would install a browser extension that would be visible on Safari, Chrome, Firefox, or another used browser. This extension might start gathering sensitive user data, such as credit card details or passwords, which could undoubtedly result in various consequences, including account hijacking or even identity fraud.

Users are likely to notice more advertisements when browsing the web – they can manifest as pop-ups, banners, coupons, auto-play videos, and other components. These ads might not always be safe, so it is not advisable to interact with them. Browser homepage and new tab address might also be altered, and redirects through unknown URLs might also occur.

Other ColossusAspect components, such as Login Items or new User Profiles would be established in order to keep the app installed on the device for as long as possible. Just putting the unwanted app into the Trash box might simply result in it returning rather quickly. Therefore, we provide detailed removal instructions below that should help you to uninstall all the malicious components of the virus properly.

ColossusAspect elimination

Adload is one of the most expansive adware families out there. In fact, most of the security vendors brand it as “malware” or a “trojan,”^[1] and it's for a reason. Not only does it enter users' machines using malicious methods but it also performs a variety of malicious actions once installed. In fact, it is rather difficult to get rid of in many cases.

ColossusAspect consists of two main components – an extension attached to the browser and the main application installed on the system level. In order for the elimination of the virus to be successful, both of these elements and leftover files need to be removed.

Nonetheless, the easiest way to get rid of malware on your Mac is by scanning it with SpyHunter 5Combo Cleaner, Malwarebytes, or another powerful security software. Adload employs the system's AppleScript in order to add itself to exceptions in the built-in protection apps – Xprotect and Gatekeeper,^[2] hence these might not be effective.

ColossusAspect is classified as malware by many security vendors

While the below manual steps are not necessary as long as you scanned your system with anti-malware, we recommend not skipping steps regarding your browser.

Get rid of the main app and its components

Before you remove the ColossusAspect application, you should shut down the malicious processes that might hinder this process.

• Open Applications folder
• Select Utilities
• Double-click Activity Monitor
• Here, look for suspicious processes and use the Force Quit command to shut them down
• Go back to the Applications folder
• Find the malicious entry and place it in Trash.

If you were unable to shut down these processes or uninstall the app, you should try getting rid of the unwanted profiles login items:

• Go to Preferences and pick Accounts
• Click Login items and delete everything suspicious
• Next, pick System Preferences > Users & Groups
• Find Profiles and remove unwanted profiles from the list.

The PLIST files are small config files, also known as “Properly list.” They hold various user settings and hold information about certain applications. In order to remove the virus, you have to find the related PLIST files and remove them.

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.

Take care of the unwanted browser components

Check whether the extension is still installed:

Safari

1. Click Safari > Preferences…
2. In the new window, pick Extensions.
3. Select the unwanted extension and select Uninstall.

Google Chrome

1. Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
2. In the newly opened window, you will see all the installed extensions. Uninstall all the suspicious plugins that might be related to the unwanted program by clicking Remove.

Make sure leftover browser components are deleted as well. Otherwise, the data tracking might continue or ads return. You can also use FortectIntego to do this step quicker and more efficiently.

Safari

1. Click Safari > Clear History…
2. From the drop-down menu under Clear, pick all history.
3. Confirm with Clear History.

Google Chrome

1. Click on Menu and pick Settings.
2. Under Privacy and security, select Clear browsing data.
3. Select Browsing history, Cookies and other site data, as well as Cached images and files.
4. Click Clear data.

If you were unable to remove malware components within your web browser, you could simply reset it as we explain below. Your bookmarks and other preferences will not get lost as long as you remember your account details. Proceed with the following to reset your browser:

Safari

1. Click Safari > Preferences…
2. Go to Advanced tab.
3. Tick the Show Develop menu in menu bar.
4. From the menu bar, click Develop, and then select Empty Caches.

Google Chrome

1. Click on Menu and select Settings.
2. In the Settings, scroll down and click Advanced.
3. Scroll down and locate Reset and clean up section.
4. Now click Restore settings to their original defaults.
5. Confirm with Reset settings.

If you are using Mozilla Firefox or MS Edge, check the instructions at the bottom of this article.

Avoidance tips

As we already mentioned, Adload versions are usually spread using fake FlashPlayer updates. Flash is a piece of software that was used for a very long time to play multimedia content on various websites. However, it was by far not perfect, and vulnerabilities^[3] were often patched to prevent cybercriminals from attacking users who have the software installed on their systems. Likewise, its name was commonly used in campaigns to spread various malware, such as Zeus.

Flash has been discontinued by Adobe, and all requests to install it or update it are fake. In general, you should never download software updates from random websites that tell you that some app on your system is outdated. Instead, go to the official website of the particular application and download the updates from there.

Another common distribution technique of the virus relates to downloading pirated applications in a bundle. We recommend refraining from doing so in the first place, as torrents and similar websites often host all sorts of malware.