WideCluster Mac virus (Free Instructions)

What is WideCluster Mac virus?

WideCluster – dangerous adware that targets Mac users

WideCluster is a malicious application that targets Mac users

WideCluster is an application you may find running on your system and browser one day. The unexpected appearance is always something that users were wondering about, but it is easily explained. In most cases, people install it along with other software they download from illegitimate sources (typically, torrent and software crack sites) or are tricked by fake Flash Player or other software updates.

WideCluster is a rather simple but effective malware that stems from a massive family of Adload. Even though its main goal can be described to be the same as that of adware, its underlying processes and activities on the device warrant its catheterization of a Trojan or, simply, malware.

Just as in its previous versions, the app uses a distinctive magnifying glass icon, which is used for the browser extension and the app itself. The effects of the extension can be found as soon as Safari, Google Chrome, Mozilla Firefox, or another web browser is opened, like the homepage and the search provider no longer would be the same. Even those who prefer Google.com would be forced to browse the web via an alternative tool, such as Safe Finder or SearchLee.

This simple change would warrant that users are exposed to sponsored links; they would also encounter pop-ups, banners, redirects, and other disruptive browser activity more frequently. Some of the ads might be of scam content (further fake virus or update alerts), while others might lead to malware-laden pages.

However, this is just the tip of the iceberg, as WideCluster drops dozens of malicious files that prevent its easy elimination, spies on users' activities, and might even be capable of installing other malware in the background without consent.

While was is initially believed that Macs are singlehandedly immune to malware infections thanks to their ability to contain certain apps in segregated space and built-in defenses, it is inherently not true. These machines, while more resistant to high-risk threats such as ransomware are still vulnerable to infections. As the study in 2019 showed,^[1] the volume of Mac malware was actually higher than that of Windows, which is a rather alarming conclusion.

In this article, we are talking about WideCluster – one of the newer Adload versions that has been spreading around the web. While initially, these apps might seem like your typical adware ones, it is not the case at all, as they have plenty of malicious traits that can put users' safety and computer security in danger.

What is Adload and what can it do?

Adload is one of the most prominent malware families out there – new versions are released every week, and we described many of them already, with the most recent ones being CompactFilter, LinkSet, ProductionElements, and many others. There are plenty of elements that makes this software much more malicious than your regular adware, although it includes its capabilities as well.

First of all, the main goal of malware is to make sure that the advertisements reach their victims. The more people get infected with it, the more profits can be generated through ad clicks and views. Unfortunately, a lot of content that is promoted is rather unsafe, and users might end up installing other malicious software. For example, many users were also infected with dangerous Shlayer Trojan as well.

Adload versions mainly spread via fake Flash Player updates

Another aspect of Adload is browser hijacking.^[2] By taking over Safari or another web browser, the promoted search provider can guarantee more profits from ads. However, this function is more damaging than one might initially think – the extension is installed with advanced privileges, which allows it to gather passwords, credit card details, and other information. The risk of privacy issues due to this is very high.

Finally, the WideCluster virus uses various persistence mechanisms that bypass Gatekeeper and Xprotect defenses.^[3] Many versions of the malware family are notorious for this trait – they use the built-in Applescript to implement this functionality. Below we explain how to get rid of the infection.

How to remove WideCluster effectively?

Once you notice the infection, you should remove it from your system as soon as possible. The problem is that malware drops its own files into various locations of the system, hence eliminating it manually might be difficult. Instead of proceeding with the tedious steps below, we recommend you instead employ SpyHunter 5Combo Cleaner, Malwarebytes, or another reputable anti-malware and eliminate the virus automatically.

If you want to try to look at these files manually, you are free to do so, but keep in mind that deletion of some files might result in problems. Likewise, there is no guarantee that all the remnants would be eliminated in this way.

1. Get rid of the main app

Before you proceed, try to force quick malware's background process.

• Open Applications folder
• Select Utilities
• Double-click Activity Monitor
• Here, look for suspicious processes and use the Force Quit command to shut them down
• Go back to the Applications folder
• Find the malicious entry and place it in Trash.

2. Delete related files

Small configuration files known as PLIST can hold various settings information. They might prevent the virus from being removed properly.

• Select Go > Go to Folder.
• Enter /Library/Application Support and click Go or press Enter.
• In the Application Support folder, look for any dubious entries and then delete them.
• Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and delete all the related .plist files.

3. Remove Login items and Profiles

Malware might create Login items and Profiles to dominate the computer. These can be removed in the following way (look for icons or names that resemble the name of the app):

• Go to Preferences and pick Accounts
• Click Login items and delete everything suspicious
• Next, pick System Preferences > Users & Groups
• Find Profiles and remove unwanted profiles from the list.

4. Get rid of the extension and other browser files

Finally, make sure you remove the browser extension and clean the browser from cookies and other leftovers. If you are using another browser, refer to the instructions at the bottom of this post. Likewise, if you want an effective software that would automatically do this step for you, employ FortectIntego.

• Click Safari > Preferences…
• In the new window, pick Extensions.
• Select the unwanted extension and select Uninstall.

Next, you should focus on cleaning cookies and other web data by following these steps:

• Click Safari > Clear History…
• From the drop-down menu under Clear, pick all history.
• Confirm with Clear History.

You can also reset the browser if nothing else works:

• Click Safari > Preferences…
• Go to the Advanced tab.
• Tick the Show Develop menu in the menu bar.
• From the menu bar, click Develop, and then select Empty Caches.

How to avoid Mac malware?

Malicious applications live and die by their distribution methods. While developers of legitimate apps use marketing or other distribution methods, WideCluster authors are cybercriminals, hence they don't really care about how the app is installed on the system.

However, there is no way that the virus suddenly appeared on the device in question, so users always install Adload versions and other Mac malware themselves, even though it might be hard to believe for them. It all comes down to a lack of knowledge within the IT field or even pure negligence. Here are two ways that you could have been infected:

• Fake Flash Player updates
• Torrent and similar sites.

When it comes to Flash Player, you should be aware that this software has been long discontinued and is no longer required to play multimedia on websites. In fact, Adobe shut it down because of its vulnerabilities that were constantly exploited by cybercriminals, as well as its name's usage in various scams.

Likewise, you might also get infected after being tricked by another ad that asks you to install something: it might claim that your device is infected and needs fixing, or that your browser can't show you the page correctly – here are many tricks that are used by malicious actors. To avoid this, make sure you employ ad-blocking software and only install software updates from its official sources.

Finally, please stay away from torrent, software crack, warez, and similar websites that offer cracked versions of otherwise paid apps. Not only is this activity illegal, but it can easily end up in malware infection, as is the case with Adload versions.

You may remove virus damage with a help of FortectIntego. SpyHunter 5Combo Cleaner and Malwarebytes are recommended to detect potentially unwanted programs and viruses with all their files and registry entries that are related to them.