How to remove VictorSurge Mac virus

VictorSurge is a Mac virus that poses a danger to your personal security

VictorSurge is a malicious application that targets Mac devices exclusively and is a variant of one of the most prominent malware families known as Adload. Since users install it by accident (it spreads via fake Flash Player installers and pirated software bundles), many might not even notice its infiltration, as signs and symptoms only emerge once the browser is opened.

One of the main symptoms of the VictorSurge virus infection is changed browser settings, although this may not always be the case. Safari's or another browser's homepage and new tab can be altered to something else, along with the search engine and provider. As such, users can often see altered search results that are filled with sponsored links and ads, which can be extremely intrusive.

In other cases, the only browser infection sign would be a suspicious extension installed on it, which is also impossible to remove in a regular way. Since it's installed with elevated permissions, it can also gather personal user data such as credit card details, account passwords, and similar sensitive information that shouldn't be disclosed to malware authors.

The ramifications of the VictorSurge Mac virus can be severe – from privacy violations to additional malicious payloads being installed on the system without one's knowledge. Use the guide below to learn how the threat works and how to get rid of it effectively.

Distribution and avoidance tips

The VictorSurge virus doesn't spread using sophisticated methods such as exploits or drive-by downloads.^[1] Instead, it relies on simple yet extremely effective methods that make users themselves install the malware-laced application, even though they are tricked into doing so.

Pirated software has long been warned about by numerous security researchers and security vendors, although many users still choose not to pay attention to these warnings. Piracy is highly illegal, and that's why websites distributing illegal software installers are perfect places for cybercriminals to spread their malware – they are simply unregulated by any legitimate bodies.

Another most common method of Adload version distribution is the fake Flash installers. The plugin is rather iconic by now, as it used to be used all over the internet to play multimedia on websites. However, it has been long replaced by newer technologies such as HTML 5,^[2] and its developer no longer supports it.

Choose automatic VictorSurge virus removal

Adload variants are not too complex in a technical sense, but their persistence mechanisms still manage to be ahead of Apple, and many new versions simply slip through Mac's XProtect.^[3] As a result, malware can run in the background for a very long time if its removal is not performed using alternative methods.

Using third-party security software, for example, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes, can greatly ease the process of elimination. Manual VictorSurge removal may require advanced computing knowledge, as there are plenty of items that the virus creates upon infiltration. If you skip some of them, the infection might simply reoccur.

Even if you choose to delete the malware yourself by following the steps below, please make sure that you take great care when dealing with browsers. Clearing browser caches from cookies and other leftover files is mandatory for better privacy. If you rather choose the automatic solution, you can employ FortectIntego.

Manual solution

1. Delete the app and the extension

Upon infiltration, the malware starts running background processes whenever it is active to fulfill its malicious deeds. In order to remove the main app of VictorSurge, you should first access Activity Monitor and stop its related processes as follows:

• Open Applications folder
• Select Utilities
• Double-click Activity Monitor
• Here, look for suspicious processes related to adware and use the Force Quit command to shut them down
• Go back to the Applications folder
• Locate the malicious app and move it to Trash.

Once the main app is taken care of, you should open Safari, Chrome, or another used browser and delete the extension, which uses the magnifying glass icon on a gray background.

Safari

1. Click Safari > Preferences…
2. In the new window, pick Extensions.
3. Select the unwanted extension and select Uninstall.

Google Chrome

1. Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
2. In the newly opened window, you will see all the installed extensions. Uninstall all the suspicious plugins that might be related to the unwanted program by clicking Remove.

In some cases, malware's extension might be impossible to remove in a normal way. Resetting the browser would be a way to override the app's persistence mechanisms and delete the extension without problems. If you need help with this process, proceed with the following instructions:

Safari

1. Click Safari > Preferences…
2. Go to the Advanced tab.
3. Tick the Show Develop menu in the menu bar.
4. From the menu bar, click Develop, and then select Empty Caches.

Google Chrome

1. Click on Menu and select Settings.
2. In the Settings, scroll down and click Advanced.
3. Scroll down and locate Reset and clean up section.
4. Now click Restore settings to their original defaults.
5. Confirm with Reset settings.

Login items and other components might reinstall the app if not removed

Even after you delete the browser extension and the main application, there could be plenty of files remaining on your system. For example, Login items are used by the virus to startup every time macOS is loaded, while virus-related profiles enable it to perform various actions behind users' backs. Thus, it is important to eliminate these leftover files.

• Go to Preferences and select Accounts
• Click Login items and delete everything suspicious
• Next, pick System Preferences > Users & Groups
• Find Profiles and remove unwanted profiles from the list
• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and delete all the related .plist files.

Finally, clean your browsers from cookies and other web data, as they are commonly used to track users in various ways. 

Safari

1. Click Safari > Clear History…
2. From the drop-down menu under Clear, pick all history.
3. Confirm with Clear History.

Google Chrome

1. Click on Menu and pick Settings.
2. Under Privacy and security, select Clear browsing data.
3. Select Browsing history, Cookies and other site data, as well as Cached images and files.
4. Click Clear data.