How to remove DigitGuild Mac virus

DigitGuild is a virus that successfully avoids detection and removal by Mac's built-in defenses

DigitGuild is a malicious software example that has been spreading around in the recent week. It only affects Mac operating systems and belongs to a relatively expansive malware family known as Adload. While it does not spread automatically, users are typically tricked into installing it due to various phishing techniques used by its developers.

Once on the system, it appends a browser extension on Safari, Chrome, Firefox, or another web browser, which helps the DigitGuild virus to perform its malicious duties: it changes the homepage, new tab, search provider, and similar settings (although this may vary from version to version). This helps the virus to push sponsored links and ads, which profits its authors. The extension is also used to harvest various personal details, including credit card and account information.

Since malware performs several changes on the system and implements its own components, its impact can be pretty significant; for example, it may install additional payloads without asking user permission first. We strongly recommend you get rid of DigitGuild as soon as possible, as it will be a threat to your personal safety and computer security for as long as it is running on your Mac.

Adload: the persistent threat to Macs

Adload is one of the most active Mac threats there, successfully distributed via fake Flash Player installers^[1] or pirated software installers. It has been active since at least 2017 and has hundreds of variants released so far, including AnalyzerState, SagaDynasty, ManagerTemplate, and many others.

Malware uses a unique naming pattern – its titles usually consist of two or three predetermined words that are picked randomly. All versions also use the exact same magnifying glass icon, although the background might vary (we have seen it using blue, teal, green, red, and, most recently, gray colors).

In essence, when it comes to Adload functions, versions do not differ much from another, although its authors are constantly changing some modules and improving persistence mechanisms to avoid Mac's built-in security measures. 

Initially classified as adware, DigitGuild and other Adload versions have a lot going on for them. The main goal of the cybercriminals behind it is to earn passive revenue from various ads that can show up as pop-ups, deals, offers, banners, and other forms. Since rogue advertising networks are used, the quality of these ads might be appalling, and the chances of encountering phishing and other malicious content are much higher.

How to effectively remove DigitGuild

Versions of Adload are known for their relatively simple but effective method of infiltration and persistence. Since people are tricked into installing them, they enter their AppleID prior to installation, which allows it to run with elevated privileges. At this point, the virus excludes its elf from built-in Apple defenses such as XProteect or Gatekeeper^[2] and continues its operation without interruption.

It installs several components on the system that help it function well. For example, new Login items ensure that malware would run automatically as soon as the system is booted. PLIST files and other components ensure configuration for the app does not get altered, and settings remain unchanged from those set by the virus.

Due to this, we strongly recommend you remove DigitGuild using SpyHunterCombo Cleaner, MalwarebytesMalwarebytes, or other powerful security software. If you choose this method, we still recommend you check the 

Step 1. Remove the main program

The virus consists of several components scattered across the system, which are all intertwined. Due to this, some of the steps below might simply not be possible without eliminating certain elements first. Let's start with the main application.

• Open Applications folder
• Select Utilities
• Double-click Activity Monitor
• Here, look for suspicious processes and use the Force Quit command to shut them down
• Go back to the Applications folder
• Find the malicious entry and place it in Trash.

Step 2. Get rid of persistence components

Deleting unwanted profiles and Login Items is necessary when trying to eliminate malware from a Mac.

• Go to Preferences and pick Accounts
• Click Login items and delete everything suspicious
• Next, pick System Preferences > Users & Groups
• Find Profiles and remove unwanted profiles from the list.

Step 3. Delete leftover files

The PLIST files are small config files, also known as “Properly list.” They hold various user settings and hold information about certain applications. To remove the virus, you have to find the related PLIST files and delete them.

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and delete all the related .plist files.

Step 4. Don't forget to clean your browser

Regardless of whether you pick a manual or automatic DigitGuild Mac virus removal method, you should always check your web browser to ensure that it's clean. Cookies,^[3] for example, might remain on your browser for years if not removed and continue tracking activities by unwanted parties. Besides, since the extension might start gathering sensitive information such as passwords or credit card details, you should make sure all its elements are eliminated.

Safari

1. Click Safari > Preferences…
2. In the new window, pick Extensions.
3. Select the unwanted extension and select Uninstall.

Google Chrome

1. Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
2. In the newly opened window, you will see all the installed extensions. Uninstall all the suspicious plugins that might be related to the unwanted program by clicking Remove.

You might not be able to remove the extension due to persistence mechanisms used by malware. If that is true for you, you should simply opt for browser reset:

Safari

• Click Safari > Preferences…
• Go to the Advanced tab.
• Tick the Show Develop menu in the menu bar.
• From the menu bar, click Develop, and then select Empty Caches.

Google Chrome

1. Click on Menu and select Settings.
2. In the Settings, scroll down and click Advanced.
3. Scroll down and locate Reset and clean up section.
4. Now click Restore settings to their original defaults.
5. Confirm with Reset settings.

If the extension was removed successfully, make sure you clean the web browser's caches to prevent tracking cookies from doing their job. You can also opt for automatic system cleaning with FortectIntego or refer to these instructions if you prefer the manual method:

Safari

1. Click Safari > Clear History…
2. From the drop-down menu under Clear, pick all history.
3. Confirm with Clear History.

Google Chrome

1. Click on Menu and pick Settings.
2. Under Privacy and security, select Clear browsing data.
3. Select Browsing history, Cookies and other site data, as well as Cached images and files.
4. Click Clear data.