ProgressBoost Mac virus (Free Guide)

What is ProgressBoost Mac virus?

ProgressBoost is a malicious Mac application that changes browsing preferences and shows intrusive ads

ProgressBoost is a dangerous Mac application that tends to avoid detection of XProtect

ProgressBoost is malware that attacks Mac systems. It stems from a rather large family of Adload, which has been known in the cybercrime landscape for at least half a decade now and incorporates hundreds of versions. While the main goal of the virus is to function as adware that exposes users to a variety of ads and earns revenue for malicious actors that way, there are plenty of other traits considered to be malicious.

ProgressBoost virus spreads via fake Flash Player installers^[1] and illegal software bundles downloaded from malicious websites – these are one of the most popular malware distribution methods on Mac operating systems. Once installed, the virus would often change browser settings (it may affect the homepage and search provider, altering them to alternatives such as Safe Finder) and expose users to various sponsored links and intrusive ads.

The browser extension is programmed in a way that it would gather various personal details, such as credit card information or login credentials, posing extreme risks to privacy and security. Besides, malware is also difficult to remain, as it uses plenty of persistence mechanisms to stay on the system as long as possible. Below we explain how to deal with the infection adequately and ensure it doesn't return.

Adload is one of the most common malware that affects Macs

Adload is one of the most prominent strains that targets macOS users. It was first developed in 2017 – hundreds of variants have been released since that day, including the latest ones we've recently described, including SilkTopic, CommandAccess, ChipSynergy, PremiumContinental, and many others.

While the differences between these versions are insignificant, cybercriminals make a lot of improvements and changes to malware in order to ensure it has low detection rates.^[2] All of the versions use a distinctive magnifying class, usually placed on a green, teal, or gray background. It always consists of two components – the browser extension and the app which is installed on the system level.

Connections to other malware have also been found by researchers. The “Player.app” (sometimes, “Install.app”) infectious file that is used to spread malware was also found to be distributing Bundlore and Shlayer infections.^[3] It is anyone's guess whether or not the developers of this malware are connected, though.

What can ProgressBoost do?

Because Adload uses rather basic distribution and operation methods that are very successful on Mac platforms, it causes a large number of Apple devices to be infected. To avoid being contaminated, never download programs from pirate software distribution sites, and be wary of bogus Flash Player upgrades.

ProgressBoost is commonly spread via fake Flash Player installers

While the virus's main goal is to show advertising and generate pay-per-click revenue, it also benefits from several supporting elements. The use of AppleScript, for example, allows the infection to completely avoid the detection of built-in Mac defenses like XProtext and Gatekeeper,^[3] which is why it is vital to make that your system is protected by additional security software.

With the help of elevated permissions that are granted upon installation by the user, the ProgressBoost virus installs the extension on Safari or another browser, which takes over users' browsing sessions immediately. If one tries to remove the app, one would likely see the extension grayed out within the settings menu, leaving users stuck with it. In the meantime, the app could collect various personal information, putting users' privacy at risk.

Remove ProgressBoost Mac virus

Regular applications installed on a Mac can be easily removed just by moving them to Trash – there are no remnants or other issues one needs to deal with afterward. However, when dealing with computer infections, it is a completely different story, as they are not designed to be easily removed on purpose – the longer they run on users' machines, the better for cybercriminals and their wallets.

Considering how detrimental the infection can be, it is without a doubt necessary to remove it as soon as possible. However, since Adload versions are known for their persistence, using simple methods may not suffice. Therefore, we recommend you employ security software SpyHunter 5Combo Cleaner or Malwarebytes for its removal. All you have to do is to bring the anti-malware to the latest version and then perform a full system scan with it.

If you still like to proceed with manual steps, we provide all the needed information below. Note that, regardless of which removal method you pick, it is advisable to clean your Safari or other affected browser.

• Open Applications folder.
• Select Utilities.
• Double-click Activity Monitor.
• Here, look for suspicious processes and use the Force Quit command to shut them down.
• Go back to the Applications folder.
• Find the malicious entry and place it in Trash.

Login items are responsible for booting the malicious app as soon as the computer starts up, while Profiles tackle different account settings. These malware-related components should be deleted as follows:

• Go to Preferences and pick Accounts.
• Click Login items and delete everything suspicious.
• Next, pick System Preferences > Users & Groups.
• Find Profiles and remove unwanted profiles from the list.

Finally, you should get rid of Launch Daemons and other configuration data left by malware. Proceed with the following:

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and delete all the related .plist files.

If you choose to eliminate the infection manually, the extension may still remain on your browser and continue gathering data and performing other malicious tasks. Thus, start by removing it:

• Click Safari > Preferences…
• In the new window, pick Extensions.
• Select the unwanted extension and select Uninstall.

If you successfully removed the extension traditionally, you should also clear your browser caches to stop any more data from being tracked. The simplest method to do this and get rid of all junk is to run a FortectIntego maintenance utility. As another option, you can follow these instructions:

• Click Safari > Clear History…
• From the drop-down menu under Clear, pick all history.
• Confirm with Clear History.

Note that if you were still unable to delete the browser extension, we recommend you reset Safari as follows:

• Click Safari > Preferences…
• Go to the Advanced tab.
• Tick the Show Develop menu in the menu bar.
• From the menu bar, click Develop, and then select Empty Caches.

If you are using Google Chrome or Mozilla Firefox, find the details of malware removal from them below.