IntegerLocator Mac virus (Free Guide)

What is IntegerLocator Mac virus?

IntegerLocator is a type of Mac malware that inserts malicious files and tracks your personal information

IntegerLocator is a Mac virus that can compromise your computer security

IntegerLocator is dangerous software that targets Mac devices exclusively and belongs to a widespread adware family known as Adload, with hundreds of versions under its belt. While its main goal can be described to be the same as that of adware (to deliver ads), its underlying processes and activities on the system warrant its catheterization of a Trojan.

Users infect their computers accidentally after they are tricked by fake Flash Player updates or whenever they risk their safety by installing pirated applications from risky sources. Once installed, the IntegerLocator drops various malicious components on the system, which include an extension on the browser and an app that runs on the system level.

This allows the virus to fulfill its mean goal – to stay on the device for as long as possible without users removing it easily, all while hijacking their browsers and showing intrusive ads on every step they take. Some of these ads can be malicious and result in further malware infections. Phishing and scam messages are also not uncommon, so data disclosure or direct financial losses are also possible. Removing the infection as soon as possible is highly advisable.

IntegerLocator distribution

Adload versions are installed by users themselves, which means that there is no stealthy infiltration. Most commonly, people are tricked by fake Flash Player update prompts they might encounter anywhere on the internet (although this is more likely when visiting dubious websites).

Flash Player is an old plugin by Adobe that was discontinued at the end of 2020,^[1] meaning that all the requests to install or seemingly update it are fake. You don't need this software on your system to play multimedia content anymore, as it has long been replaced by more modern technologies such as HTML5.^[2]

Other distribution methods include pirated software installers, which we recommend not interacting with in the first place. IntegerLocator or other variants may slip into the system during the installation of pirated apps, which automatically provides a higher level of permissions on the system.

IntegerLocator spreads via fake Flash Player updates

IntegerLocator virus removal

Adload malware family was first spotted back in late 2017, and since then, hundreds of variants have been released by its anonymous creators. Its simple yet effective distribution, operation, and evasion methods ensure that the strain lives on, and crooks behind it continue to hard regular computer users.

When it comes to virus removal, it won't be that easy if only manual removal is attempted. Upon installation, the built-in AppleScript is used to allow elevated permissions on the system. The malware adds itself as an exception list of Gatekeeper and XProtect,^[3] which allows it to stay on the device without being automatically removed.

Therefore, we recommend going for automatic removal with SpyHunter 5Combo Cleaner or Malwarebytes. Security software can locate and delete all the malicious components at once, ensuring that the IntegerLocator virus doesn't return. Nonetheless, if you would like to try removing it manually, proceed with the instructions below.

Manual removal

Background processes could hinder the elimination of the malicious application. Therefore, before you do anything, force-close all the suspicious processes running in the background:

• Open Applications folder
• Select Utilities
• Double-click Activity Monitor
• Here, look for suspicious processes related to adware and use the Force Quit command to shut them down
• Go back to the Applications folder
• Find ExtendedService in the list and move it to Trash.

Small configuration files known as PLIST can hold various settings information. They might prevent the virus from being removed properly.

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and delete all the related .plist files.

Malware might create Login items and Profiles to dominate the computer. These can be removed in the following way (look for icons or names that resemble the name of the app):

• Go to Preferences and pick Accounts
• Click Login items and delete everything suspicious
• Next, pick System Preferences > Users & Groups
• Find Profiles and remove unwanted profiles from the list.

IntegerLocator removal

Potentially unwanted programs usually operate within the web browser environment, so they are not uncommon to insert various components there. If you have removed the PUP manually or automatically, as we explained in the previous section, you should now care for your web browsers.

If you chose the automatic IntegerLocator removal method, the extension should have been eliminated from the browser for you. If not, you should proceed with the following steps:

Safari

1. Click Safari > Preferences…
2. In the new window, pick Extensions.
3. Select the unwanted extension and select Uninstall.

Google Chrome

1. Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
2. In the newly opened window, you will see all the installed extensions. Uninstall all the suspicious plugins that might be related to the unwanted program by clicking Remove.

After you get rid of the extension, you should ensure that all the caches are eliminated from your local folders, or tracking activities might continue. You can do this quickly and effortlessly with the help of FortectIntego maintenance utility, which can also be used of getting rid of various junk from the system, improving its performance. If you rather do this manually, follow this:

Safari

1. Click Safari > Clear History…
2. From the drop-down menu under Clear, pick all history.
3. Confirm with Clear History.

Google Chrome

1. Click on Menu and pick Settings.
2. Under Privacy and security, select Clear browsing data.
3. Select Browsing history, Cookies and other site data, as well as Cached images and files.
4. Click Clear data.

If you were unable to remove malware components within your web browser, you could simply reset it as we explain below. Your bookmarks and other preferences will not get lost as long as you remember your account details. Proceed with the following to reset your browser:

Safari

1. Click Safari > Preferences…
2. Go to the Advanced tab.
3. Tick the Show Develop menu in the menu bar.
4. From the menu bar, click Develop, and then select Empty Caches.

Google Chrome

1. Click on Menu and select Settings.
2. In the Settings, scroll down and click Advanced.
3. Scroll down and locate Reset and clean up section.
4. Now click Restore settings to their original defaults.
5. Confirm with Reset settings.