LegionSuites mac virus (Free Guide)

What is LegionSuites mac virus?

LegionSuites mac virus can install PUPs and malware without the users' knowledge

Mac viruses can cause a variety of symptoms

LegionSuites is the name of a mac virus that belongs to the Adload malware family. It has both hijacking and adware^[1] capabilities. It can cause an increased amount of commercial content, like pop-ups, banners, and redirects. It may also change the main browser settings, like the homepage, new tab address, and search engine.

However, adware designed to infiltrate mac machines is much more dangerous than adware created for Windows systems. It can run scripts in the background and install PUPs (potentially unwanted programs)^[2] or malware without the users' knowledge. Many people do not notice the intruder until it has already started making changes. It can bypass Apple's security system XProtect.^[3]

Adload overview

We previously wrote about many other Adload variants, like CreedNetwork, AbsoluteValue, RankBet, etc. If you look closely, all of them look very similar – a magnifier inside a green, teal, or grey background. The main file can be found in the “Applications” folder. However, it does not mean that it is easy to remove.

Adload can use various evasion techniques to make it more difficult to eliminate for the average user. It generates multiple other files disguised as normal system files and scatters them across the system in different folders. We suggest you follow our guide to learn how to deal with the threat.

Distribution methods

Mac viruses are often spread through Torrent websites and peer-to-peer file-sharing platforms. Many people look for “cracked” software^[4] to install for free. However, this activity is illegal so these platforms are unregulated. It is impossible to know if the packages you are downloading do not contain any malicious files.

Another popular method used to spread Adload is fake Flash Player updates. Even though Flash Player was discontinued in 2020 and replaced by HTML5, many people still do not know this. Crooks create bogus sites that try to convince people they need Flash Player to access content.

Hackers can also use software vulnerabilities to deliver their malicious programs. That is why it is important to keep your operating system and software updated. Software developers regularly release security patches. They should be installed as soon as they come out.

Use only official sources for software installations

Removal of LegionSuites mac virus

Manual removal of Adload can be quite difficult. With launch agents, daemons, cronjobs, it can sometimes take several attempts to beat all of these before one of them manages to re-write deleted components back. You should not do this yourself unless you know what you are doing and what kind of files you need to delete.

Some of the files can have a .plist extension, a standard settings file, also known as a “properties file,” used by macOS applications. It contains properties and configuration settings for various programs. The app also uses different persistence techniques and drops many files across the system, complicating browser extension and application removal.

To keep your mind at peace, we recommend using professional anti-malware tools SpyHunter 5Combo Cleaner or Malwarebytes, which can detect unwanted programs and eradicate them. You also do not know if the virus installed any additional malicious programs, so this is the safest way to ensure the system is clean.

If you still want to try and delete it manually, proceed with these steps:

• Open Applications folder
• Select Utilities
• Double-click Activity Monitor
• Here, look for suspicious processes related to adware and use Force Quit command to shut them down
• Go back to the Applications folder
• Find LegionSuites in the list and move it to Trash.

If you are unable to shut down the related processes or can't move the app to Trash, you should look for malicious profiles and login items:

• Go to Preferences and select Accounts
• Click Login items and delete everything suspicious
• Next, pick System Preferences > Users & Groups
• Find Profiles and remove unwanted profiles from the list.

There are likely to be more .plist files hiding in the following locations – delete them all:

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.

The manual elimination process might not always result in full virus removal. Therefore, we still strongly suggest you perform a scan with security software.

Remove the browser extension

It is possible that LegionSuites also collects browsing-related and sensitive information. Various scripts might be sending data to tracking servers. Some of the data that could be exposed is your IP address, user name, macOS and browsers' versions, an ID of the computer, items in the Applications folder, a list of installed agents, daemons, and system configuration profiles.

LegionSuites mac adware also employs an unwelcome add-on that messes with the settings. After the dangerous files are eliminated from your system, you should take care of your browsers. You can get rid of cookies and cache automatically with the help of FortectIntego. It will also fix any damaged files and system errors so you should notice an improvement in the machine's performance.

If you prefer doing this yourself without additional help, here are the instructions. Steps for other browsers you will find at the bottom of this article.

1. Click Safari > Preferences…
2. In the new window, pick Extensions.
3. Select the unwanted extension and select Uninstall.

Cookies and website data:

1. Click Safari > Clear History…
2. From the drop-down menu under Clear, pick all history.
3. Confirm with Clear History.

The simplest and quickest solution to this is completely resetting Safari:

• Click Safari > Preferences…
• Go to Advanced tab.
• Tick the Show Develop menu in menu bar.
• From the menu bar, click Develop, and then select Empty Caches.