CreativeSearch – Mac virus that might inject other malicious apps on your system
CreativeSearch is a potentiality unwanted application that changes web browser settings of Google Chrome, Mozilla Firefox, Safari, or another web browser and starts delivering unwanted advertisements. This app typically targets Mac users, although it does not mean that Windows PC cannot be affected as well, as the it is typically spread via software bundle packages and Fake Flash Player update prompts.
Once installed, the CreativeSearch virus changes the search engine to Safe Finder or another customized search tool and appends a new homepage as well. As a result, users have to search the web via a hijacked browser, which changes what type of websites they visit, as search results are always filled with sponsored links. While CreativeSearch hijacks web browsers, it also possesses some adware[1] qualities, as it delivers intrusive ads and tracks users' web browsing activities for marketing purposes.
| Name | CreativeSearch |
| Type | Browser hijacker, adware, Mac virus |
| Family | This potentially unwanted application belongs to Adload malware family |
| Infiltration | These type of potentially unwanted apps spread via deceptive methods, such as software bundle packages acquired from third-party websites or fake Flash Player update prompts |
| Danger level | Medium to high. Since this application uses a built-in script to install apps without permission in the background, it can install malware such as CrescentCore or Shlayer Trojan, resulting in further infections |
| Risks | Due to infection, users might be directed to spoofing, scam, or other malicious websites where they would be prompted to install other potentially unwanted or malicious applications, disclose their sensitive data such as credit card details, suffer from financial losses and even be affected by identity theft/fraud |
| Elimination | To get rid of CreativeSearch, as well as its secondary payloads, you should scan your Mac with powerful security software, such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes |
| Optimization | In case your machine is still running slow after malware termination, you should employ tools like FortectIntego to fix such issues for you |
CreativeSearch is a potentially malicious application that belongs to the Adload malware campaign and is a new addition to such threats like StudyGeneral, MainReady, DataQuest, and many others. This PUP family is relatively aggressive and can be considered as malware in some cases, as it makes use of AppleScript function in order to install apps without permission. Therefore, it is not uncommon for users infected with the CreativeSearch virus to see the activity of unknown software on their computers.
Just like malware, CreativeSearch is usually distributed via deceptive ways, and usually gets installed on macOS after users download freeware from insecure third-party websites or when they get tricked by fake Adobe Flash Player update prompt. These fake alerts can be encountered on a variety of websites, although those who are already infected with adware are more likely to land on a fake update or another scam message page.
However, this is not the only symptom of CreativeSearch infection exhibits – you can also encounter the following:
- Unknown extensions or add-ons installed on the web browser;
- Redirects deliver deceptive and malicious advertisements;
- All visited websites are filled with pop-ups, deals, offers, promotions, coupons, and other intrusive ads;
- Homepage and new tab address is set to Safe Finder or another rogue search engine;
- Hundreds of unknown files reside on various parts of the machine;
- Browser extension termination becomes impossible;
- Unknown profiles established on the computer, etc.
Besides showing typical symptoms of the browser, search, and computer hijacking, CreativeSearch removal can also be hindered due to its persistence mechanisms. For example, the virus might establish new profiles or add entries to LaunchAgents, Application Support, and other folders.
Besides, a browser extension is typically installed with elevated privileges, which could result in “Managed by your organization” prompt. Here's the description of the CreativeSearch or another malicious add-on installed on the web browser:
CreativeSearch 1.0
Permissions for “CreativeSearch”:
Webpage contents
Can read sensitive information from webpages, including passwords, phone numbers, and credit cards on all webpagesBrowsing history
Can see when you visit all webpages
As you can see, the presence of potentially unwanted apps like CreativeSearch can result in the sensitive data leak, which is highly likely to be delivered to cybercriminals. If sold on the dark web, such information might cause monetary losses or even identity theft/fraud.
Unfortunately, dragging the suspicious app to Trash can hardly help you remove CreativeSearch and other malicious apps from your system. For this purpose, we advise using reputable anti-malware software and performing a full system scan. This way, all the malicious and hidden components will be deleted automatically.
Besides, due to the hijacker's ability to download and install applications without permissions, users might also be infected with other Mac viruses that could cause significant damages, such as monetary losses, identity theft, sensitive data leak to cybercriminals, and much more.
Many users also noticed that their web browsers, as well as the computer, started to operate slowly after the CreativeSearch virus infection. This issue can also be fixed by uninstalling all the malicious apps. However, if issues continue, we recommend scanning your Mac device with FortectIntego. Additionally, if you are unable to terminate browser extensions, you should reset web browsers as explained below.
Potentially unwanted programs use deception to access your Mac
Macs are generally considered much safer machines than Windows PCs, as the former have built-in defenses such as Xprotect. However, according to security researchers, Mac malware outpaced Windows malware in 2019 by volume,[2] so users should not believe that Macs are immune to infections – especially adware.
Possibly the biggest problem to Macs is fake Flash Player updates. While the plugin is outdated, full of security vulnerabilities[3], and has been almost fully replaced by HTML 5 and similar technologies, it is so embedded in users' minds as the only way to play multimedia online, that they still believe that it is much-needed software. Of course, cybercriminals are here to abuse this fact, and they often use social engineering for that.
Phishing messages are often placed on various malicious websites, and well-known attributes like the Flash logo are often used. Once users access this site, they can see a prompt asking them to download and install the latest version of Flash, allegedly to view the content of the website. However, what they usually download is adware or even malware, and, by accepting its installation, users allow the malicious app to take over the computer. Thus, never download the alleged updates via the pop-up messages on suspicious websites.
Additionally, you should not download apps from third-party sources in the first place. By default, Mac will ask you to enter your username and password – this a security measure to prevent unauthorized installation. However, if credentials are provided, malware can populate its files and settings without interruptions. Therefore, download apps from App Store or similar legitimate sources only.
Ways to eliminate CreativeSearch from your machine
While we do not recommend manual CreativeSearch removal, you can still try performing it if you wish so. However, dragging the app to Trash will not suffice, as it has multiple malicious entries within the system. First of all, you should check for malicious profiles by clicking on Preferences and then selecting Users&Groups > Profiles. Once there, delete all the profiles that you do not recognize.
After that, you should locate and delete the following files on your system to get rid of CreativeSearch virus:
~/Library/Application Support/com.CreativeSearch/CreativeSearch
~/Library/Application Support/com.CreativeSearchDaemon/CreativeSearch
~/Library/LaunchAgents/com.CreativeSearch.plist
~/Library/LaunchDaemons/com.CreativeSearchDaemon.plist
However, we highly suggest you instead remove CreativeSearch with the help of reputable anti-malware software, as it can automatically eliminate all the malicious files for you. Besides, due to PUP functionality, it is advisable to check for other malicious programs that may have been installed on your system. Finally, if you still see unwanted extensions on your web browser, reset it as per instructions below.
Uninstall from Windows
Uninstall from Windows 10/8:
- Type Control Panel into the Windows search box and open the result.
- Under Programs, select Uninstall a program.
Uninstall from Windows 7/XP:
- Click on Windows Start > Control Panel (Windows XP users should click on Add/Remove Programs).
- In Control Panel, select Programs > Uninstall a program.
Remove the unwanted program:
- In the Programs and Features window, look for any recently installed suspicious entries, select them, and click Uninstall.
- If User Account Control appears, click Yes to confirm, then complete the removal.
Delete from macOS
Remove the unwanted application:
- From the menu bar, select Go > Applications.
- In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).
Delete leftover files and folders:
- Select Go > Go to Folder.
- Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
- Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.
- Finally, empty the Trash to permanently remove the leftovers.
Remove from Mozilla Firefox (FF)
Remove dangerous extensions:
- Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
- Select Add-ons.
- In here, select the unwanted extension and click Remove.
Reset the homepage:
- Click three horizontal lines at the top right corner to open the menu.
- Choose Settings.
- Under Home, set your preferred homepage and new tab settings.
Clear cookies and site data:
- Click Menu and pick Settings.
- Go to Privacy & Security section.
- Scroll down to locate Cookies and Site Data.
- Click on Clear Data...
- Select Cookies and Site Data and Temporary cached files and pages, then click Clear.
Reset Mozilla Firefox
If clearing the browser as explained above did not help, reset Mozilla Firefox:
- Open Mozilla Firefox browser and click the Menu.
- Go to Help and then choose Troubleshooting Information.
- Under Give Firefox a tune up section, click on Refresh Firefox...
- Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.
Remove from Google Chrome
Delete malicious extensions from Google Chrome:
- Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
- In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.
Clear cache and web data from Chrome:
- Click on Menu and pick Settings.
- Under Privacy and security, select Clear browsing data.
- Select Browsing history, Cookies and other site data, as well as Cached images and files.
- Click Clear data.
Change your homepage:
- Click menu and choose Settings.
- Look for a suspicious site in the On startup section.
- Click on Open a specific or set of pages and click on three dots to find the Remove option.
Reset Google Chrome:
If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:
- Click on Menu and select Settings.
- In the Settings, scroll down and click Advanced.
- Scroll down and locate Reset and clean up section.
- Now click Restore settings to their original defaults.
- Confirm with Reset settings.
Delete from Safari
Remove dangerous extensions:
- Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
- Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.
Clear history and website data:
- Click Safari in the menu and pick Clear History.
- Set Clear to all history and confirm with Clear History.
Reset Safari:
- Click Safari in the menu and select Preferences > Advanced.
- Enable Show Develop menu in menu bar.
- From the menu bar, click Develop and select Empty Caches.
Did this guide help?
Be the first to comment