How to remove DailyGuide Mac virus

DailyGuide is a malicious Mac application designed to steal user data and show intrusive ads

DailyGuide is suspicious software you might find running on your Mac accidentally. It uses a unique icon that portrays a magnifying glass and manifests as a browser extension and the application. The application is installed with elevated permissions, which allows it to drop malicious files for persistence^[1] and other malicious purposes. The browser extension, for example, can't be easily removed and is simply grayed out within the removal section.

The main goal of the DailyGuide virus is to ensure that users are fed ads on a regular basis so that revenue can be acquired. For that, it hijacks the homepage and the new tab address, administering an alternative provider. For example, users might find that their homepage always uses Safe Finder whenever a search function is used. Results are usually directed through Yahoo or another provider.

Adload: a broad Mac malware family

DailyGuide Mac virus belongs to a broad adware family of Adload. It was first spotted back in 2017 and has had hundreds of versions released since then. Just recently, we have covered InfoMajorSearch, NetDivision, and AuraLookup.

Adload uses a distinctive naming pattern, which usually consists of randomly-generated, predetermined words hackers use. As already mentioned, all of the versions use a distinctive magnifying glass icon, usually placed on a teal, green, blue, or, most recently, gray background.

All malware versions are categorized as adware with browser-hijacking^[2] capabilities, although their operation is rather malicious. For example, the strain uses distribution techniques that are common among malware creators (fake Flash Player updates, software cracks), and utilizes the built-in AppleScript to execute commands, which increases its persistence.

Remove the main application

Before DailyGuide can be installed, users always have to enter their Apple ID, as Macs use this verification process for all unverified software installations. This permission then allows the virus to use AppleScript and put itself into the exception list of Mac's defenses, such as Gatekeeper and XProtect.^[3] This means that the built-in security is no longer effective, and Adload can remain operating on the system without any interruptions.

Therefore, in order to remove the infection easily and effectively, we recommend using powerful third-party security solutions such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. These apps can also serve as an extra layer of protection when dealing with Mac malware.

Below you can also find manual instructions for the virus removal. Using both manual and automatic removal can work the best in some cases, although if you are less IT-savvy, we recommend leaving the job for security software instead.

1. Remove the main application

Make sure you shut down the malicious processes before you attempt to remove the main application:

• Open Applications folder
• Select Utilities
• Double-click Activity Monitor
• Here, look for suspicious processes related to adware and use the Force Quit command to shut them down
• Go back to the Applications folder
• Find UpgradedPlatform in the list and move it to Trash.

2. Remove Login items and User groups

Login items ensure that the app starts as soon as the computer boots, and Profiles are used to manage various account settings. Get rid of malware-related components:

• Go to Preferences and pick Accounts
• Click Login items and delete everything suspicious
• Next, pick System Preferences > Users & Groups
• Find Profiles and remove unwanted profiles from the list.

3. Get rid of leftover files

The PLIST files are small config files, also known as “Properly list.” They hold various user settings and hold information about certain applications. In order to remove the virus, you have to find the related PLIST files and remove them.

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any suspicious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.

Remove the extension and clean your browser

Regardless of whether you eliminated the main app manually or automatically, you should still pay attention to your browser. Security software should be able to tackle the browser extension for you, but if you choose to remove it manually, proceed with the following steps:

Safari

1. Click Safari > Preferences…
2. In the new window, pick Extensions.
3. Select the unwanted extension and select Uninstall.

Google Chrome

1. Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
2. In the newly opened window, you will see all the installed extensions. Uninstall all the suspicious plugins that might be related to the unwanted program by clicking Remove.

If you were unable to delete the extension in a regular way and it is still grayed out for you, you should simply reset your browser.

Safari

1. Click Safari > Preferences…
2. Go to Advanced tab.
3. Tick the Show Develop menu in menu bar.
4. From the menu bar, click Develop, and then select Empty Caches.

Google Chrome

1. Click on Menu and select Settings.
2. In the Settings, scroll down and click Advanced.
3. Scroll down and locate Reset and clean up section.
4. Now click Restore settings to their original defaults.
5. Confirm with Reset settings.

Finally, make sure that your browser caches are deleted. Adware often inserts various trackers that are stored locally – they might remain operational even if the infection is removed. For example, cookies might stay on the computer for years, tracking various user activities in the background and sending that information to third parties. If you want to perform the cleaning process automatically, employ FortectIntego or proceed with the following steps:

Safari

1. Click Safari > Preferences…
2. Go to the Advanced tab.
3. Tick the Show Develop menu in the menu bar.
4. From the menu bar, click Develop, and then select Empty Caches.

Google Chrome

1. Click on Menu and select Settings.
2. In the Settings, scroll down and click Advanced.
3. Scroll down and locate Reset and clean up section.
4. Now click Restore settings to their original defaults.
5. Confirm with Reset settings.

If you are using MS Edge or Mozilla Firefox, check out the instructions below.