MetroToken Mac virus (Free Guide)

What is MetroToken Mac virus?

MetroToken is a malicious Mac application made by cybercriminals to benefit from ads and stolen data

About Adload and its versions

With the increasing popularity of Mac computers, the myth of Macs being immune to malware has been shattered. Hackers have turned their attention to Macs, resulting in a rise in malware attacks on this operating system.

Although Macs are less susceptible to harmful malware like rootkits and ransomware, they suffer from a significant adware problem, and the adware targeting Macs is often more aggressive than that targeting Windows.

One prominent example is the Adload malware, which has been active for over five years and is just one of many aggressive adware strains constantly infecting Mac users.

Adload is recognizable by its unique magnifying glass icon on a background that can be blue, teal, green, or gray. If you spot an extension or app using this icon, chances are you are infected with Adload malware.

Despite minor differences in its various versions, Adload continually evolves its evasion techniques. Once users grant access, it immediately employs AppleScript to prevent Gatekeeper and XProtect – two built-in Mac security systems – from removing it.

This integration allows Adload to install extensions and other components with elevated privileges, enabling it to collect personal data or download additional payloads without users' knowledge. As a result, it's not uncommon for multiple Adload variants to coexist on a user's Mac simultaneously. Due to its persistence, it might be difficult to remove – follow the steps below to do so successfully.

MetroToken removal explained

MetroToken removal is a complex process that goes beyond simply dragging the application to the Trash, as the malware is designed to run with administrator privileges and drops multiple files into critical system locations, creates new profiles, and login items, among other actions.

Due to the sophisticated nature of MetroToken, relying on robust security solutions is recommended for effective removal. Examples of such solutions are SpyHunter 5Combo Cleaner or Malwarebytes, which are not impacted by the virus as the built-in Mac anti-malware may be. These security solutions can automatically detect and eliminate all malicious components in one go.

However, for those who prefer to proceed with manual steps, caution is warranted. It's important to note that using the manual method does not guarantee success in removing the malware, as there may be hidden payloads running in the background, performing malicious tasks without displaying any symptoms.

To begin the manual removal process, it's crucial to stop all related background processes initiated by the MetroToken virus via the Activity Monitor. This step is essential to ensure that the elimination process is not hindered.

• Open Applications folder.
• Select Utilities.
• Double-click Activity Monitor.
• Here, look for suspicious processes and use the Force Quit command to shut them down.
• Go back to the Applications folder.
• Find the malicious entry and place it in Trash.

Your next task is to remove all the virus-related Login items and new Profiles that it could use.

• Go to Preferences and pick Accounts
• Click Login items and delete everything suspicious
• Next, pick System Preferences > Users & Groups
• Find Profiles and remove unwanted profiles from the list.

PLIST files, which are small configuration files commonly referred to as “Properly list,” store user settings and information about specific applications. To completely remove the virus, it's crucial to identify and delete the related PLIST files.

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.

If the malicious extension is grayed out, it may not be possible to delete it using regular methods. In such cases, you may need to reset your browser, which would remove all your add-ons, including the malicious ones. However, you can reinstall the trusted add-ons later to restore their functionality.

• Click Safari > Preferences…
• Go to the Advanced tab.
• Tick the Show Develop menu in the menu bar.
• From the menu bar, click Develop, and then select Empty Caches.

• Click Safari > Clear History…
• From the drop-down menu under Clear, pick all history.
• Confirm with Clear History.

Prevention measures

Adload, like many other malware variants, often spreads through deceptive techniques such as fake Flash Player updates and pirated software installers. Cybercriminals take advantage of users who may be tempted to download software or updates from unauthorized sources or websites offering pirated software. These fake Flash Player updates or pirated software installers are typically designed to trick users into installing malicious software onto their Macs.

Fake Flash Player updates are a common tactic used by malware distributors to trick users into downloading and installing malware. These fake updates often appear as legitimate prompts that claim to require an update to the Flash Player software on the Mac.

However, these prompts are cleverly disguised and may redirect users to malicious websites or trigger the download of malicious software disguised as a Flash Player update. It's important to note that legitimate updates for Flash Player or any other software should always be downloaded directly from the software provider's official website.

Pirated software installers are another common method used by malware distributors to spread malware like Adload. These installers are often found on unofficial or torrent websites offering free cracked or pirated software.

Users who download and install software from these sources are at a higher risk of infecting their Macs with malware. They may contain hidden malware payloads that can infiltrate the system and cause harm. Thus, refrain from using suspicious sources for your software downloads.