InfoMajorSearch Mac virus (Free Instructions)

What is InfoMajorSearch Mac virus?

InfoMajorSearch is a Mac virus that steals sensitive data and shows intrusive ads

InfoMajorSearch is a Mac virus that shows intrusive ads and steals data

InfoMajorSearch is a malicious application you might fund on your Mac one day. If you are wondering where it is coming from, you have likely installed it along with other software from the internet (usually illegal/pirated applications) or after being tricked by a fake Flash Player update prompt.

The primary goal of InfoMajorSearch is to benefit from ad revenue, which it reaches using various malicious ways: it changes browser settings, inserts ads when users browse the web, spies on their online activities, steals passwords, etc.

While Adload family members, to which the app belongs, are commonly categorized as adware, browser changes also warrant the branding of a browser hijacker.^[1] Generally, the application possesses a lot of malicious traits related to its distribution, operation, and persistence, hence most security vendors categorize it as malware.

Adload malware in detail

Adload has been around since at least 2017 and is one of the most common strains that target Macs. Hundreds of variants have been released by unknown individuals behind the strain, with the most recent examples being NetDivision, AuraLookup, and LatestFeed. All versions use a distinctive magnifying glass icon on a teal, blue, green, or, most recently, gray background.

Distribution

InfoMajorSearch is distributed in very typical ways of Mac malware – fake Flash Player updates or illegal software installers. Flash has been already terminated by Adobe almost two years ago, so all prompts to install or update it are fake – all modern browsers have the built-in technology for multimedia content, such as HTML5.^[2]

When it comes to illegal software downloads, we recommend staying away from them in the first place. Since torrents and similar sites are poorly protected, they serve as a perfect place for crooks to spread malware and populate scams.

Fake Adobe Flash Player installers are among the most popular malware distribution methods

Operation

Once installed, Adload variants would immediately change the system in various ways. It establishes persistence and then ensures that users are exposed to as much commercial content as possible, which can guarantee steady income from ad revenue. There are several ways how the virus achieves this:

• Installs a browser extension that changes the homepage and new tab function (sets it to Safe Finder or other);
• Redirects all results to an alternative provider, such as Yahoo;
• Inserts ads and sponsored links at the top of users' searches;
• Inserts ads into websites they don't originate from;
• Shows phishing messages and exposes users to scams, etc.

Besides, the installed extension is capable of harvesting various personal user data, including passwords and credit card details. Thus, we recommend not integrating with ads or entering any personal info before the infection is terminated.

Persistence

While most people install the InfoMajorSearch virus inadvertently, they are the ones who give permission for it to do so by entering their Apple ID credentials when asked. Thanks to this authorization, malware manages to root deep into the system – it uses the built-in AppleScript for that.

With the help of the said script, the virus makes various system changes by implementing new profiles, login items, PLIST files, and more. Because of these persistence mechanisms, Apple's built-in defenses, such as Xproptect or Gatekeeper,^[3] fail to automatically identify and remove the infection.

Removal explained

As already explained, the persistence of the virus might make the removal rather difficult. For example, the installed extension might be grayed out, which would make it impossible to uninstall in a regular way. Luckily, tools such as SpyHunter 5Combo Cleaner or Malwarebytes can help you bypass these issues and get rid of the virus quickly and easily.

Simply install the security application and perform a full system scan immediately. If you would rather eliminate the infection yourself, you can do it by following the guide below. Note that, regardless of which removal method you choose, you should still clean your browsers from various trackers.

Remove the main app and its files

To begin the removal process, you should first make sure that malware's background processes could not interfere. For that, you need to shut them down via the Activity Monitor:

• Open Applications folder
• Select Utilities
• Double-click Activity Monitor
• Here, look for suspicious processes related to adware and use the Force Quit command to shut them down
• Go back to the Applications folder
• Find UpgradedPlatform in the list and move it to Trash.

Persistence mechanisms, such as Login items or new Profiles, might prevent the app's elimination. Thus, if the above step was impossible, try removing these elements first:

• Go to Preferences and pick Accounts
• Click Login items and delete everything suspicious
• Next, pick System Preferences > Users & Groups
• Find Profiles and remove unwanted profiles from the list.

Finally, get rid of the leftover files:

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and delete all the related .plist files.

Clean your browser

Typically, Adload versions install a browser extension with elevated permissions by dropping malicious files on the system. If you managed to delete them successfully, as explained in the previous section, you should be able to remove the extension without too much trouble.

Safari

1. Click Safari > Preferences…
2. In the new window, pick Extensions.
3. Select the unwanted extension and select Uninstall.

Google Chrome

1. Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
2. In the newly opened window, you will see all the installed extensions. Uninstall all the suspicious plugins that might be related to the unwanted program by clicking Remove.

The next step is to ensure that all trackers are deleted from the device. Adware and malware insert cookies and other tracking elements on your machine locally. If not removed, they might remain on the system for years, so it is vital to clean browser caches from time to time. The easiest way to clean your browsers and the system from leftover files is by employing the RestoroIntego maintenance utility. Alternatively, you can do it manually too:

Safari

1. Click Safari > Clear History…
2. From the drop-down menu under Clear, pick all history.
3. Confirm with Clear History.

Google Chrome

1. Click on Menu and pick Settings.
2. Under Privacy and security, select Clear browsing data.
3. Select Browsing history, Cookies and other site data, as well as Cached images and files.
4. Click Clear data.

If you were unable to remove malicious components within your web browser, you could simply reset it as we explain below. Your bookmarks and other preferences will not be lost as long as you remember your login name and password. Proceed with the following steps to reset your browser:

Safari

1. Click Safari > Preferences…
2. Go to the Advanced tab.
3. Tick the Show Develop menu in the menu bar.
4. From the menu bar, click Develop, and then select Empty Caches.

Google Chrome

1. Click on Menu and select Settings.
2. In the Settings, scroll down and click Advanced.
3. Scroll down and locate Reset and clean up section.
4. Now click Restore settings to their original defaults.
5. Confirm with Reset settings.