Mac Viruses

MacPerformance is malicious application for MacOS, that belongs to OSX Pirrit adware family. It controls settings of Safari, Google Chrome, Mozilla Firefox to create redirects and display ads and pop-ups. It infiltrates Mac computers invisibly or by fraud and starts to generate advertisements, showing phishing pages, encouraging users to download potentially unwanted applications. Sometimes MacPerformance is offered to be installed in a bundle with good applications, and users, confused by the name of the program, think that this is optimisation software for MacOS, and allow installation.

Bing.com is legitimate search engine, that belongs to Microsoft Corporation, provides great search results and can be used as homepage and default search engine in Google Chrome, Mozilla Firefox, Safari, Opera, Edge and Internet Explorer. It is the third biggest search engine in USA. However, its domain name, design and search results are exploited by indecent search partners, that use it for their own selfish purposes. Such affiliates create multiple browser extensions and domains, like SearchModule, Search Protection, Bing.Vc, BingProtect to take control over browser search engine and homepage settings and redirect users to Bing.com. Malefactors earn on advertising comission from original Bing.com search, but use unethical methods to infiltrate computers. In this article we will mostly describe the cases of malware infection that causes redirects to Bing.com and methods to remove them.

Spyder-finder.com is unsafe search engine, that, with help of browser extension Spyder Finder, seizes control over browser settings in Safari and Google Chrome on MacOS. Hijacker originates from Israel. It replaces homepage and default search engine settings, redirects searches to https://www.webcrawler.com. This is well-known advertising third-party search engine associated with numerous hijackers. Homepage of Spyder-finder.com resembles famous search engines, has quick access shortcuts for famous shopping sites and link to a landing page of potentially unwanted CleanMyMac application.

Searchpage.com and SearchPage Tab is are, respectively, dubiuos search engine and browser add-on, that modifies search engine and homepage settings in Safari, Google Chrome, Mozilla Firefox and other browsers. It is also responsible for display of ads, pop-ups and notifications from Searchpage.com. This hijacker was developed by Iron Mountain Technology Limited, with headquaters situated in Hong Kong, as it is stated on their website. The site has a purely advertising purposes, having no value to the end user. Search requests typed in search box on the main page are redirected to search.yahoo.com.

Search.bravogol.com is third-party search engine, that installs in Safari, Google Chrome and Mozilla Firefox browsers on Mac OS. It comes along with extension called Bravogol, that modifies browser settings, such as homepage, default search engine and new tab. Add-on also doesn't allow users to revert the changes back. When users types queries in Search.bravogol.com, browser is redirected to search.yahoo.com. After removal of Bravogol from browser, settings remain unchanged. Authors of this hijacker offer removal tool for Search.bravogol.com called Uninstall.dmg on their website, that will, probably, reset the settings. However, we do not recommend downloading additional software from developers of adware and hijackers developers.

Your Template Finder Toolbar is misleading browser add-on for Google Chrome, Mozilla Firefox or Internet Explorer. It was developed by IAC Applications a.k.a. MindSpark Interactive Network, well-know developer of adware applications and hijacking toolbars. YourTemplateFinder, according to the developers, provides access to design templates for your business, such as PowerPoint templates, website, e-mail and logo templates, business planners and calendars. Along with that, you get toolbar with search box and quick access links to weather and social widgets. Search engine and homepage settings in your browsers are compromised and modified to hp.myway.com.

QuickPDFMerger Toolbar or Quick PDF Merger New Tab is annoying browser hijacker, that infects Safari, Google Chrome, Mozilla Firefox or Internet Explorer on Windows or MacOS. Extension was developed by IAC Applications a.k.a. MindSpark Interactive Network - notorious vendor of toolbars and adware platforms. QuickPDFMerger is add-on, that helps users perform various actions with PDF files, for example, combine several files into one, convert such files into other formats, create slideshows and share files on multiple platforms using different tools. Unfortunately, along with aforementioned features QuickPDFMerger Toolbar does certain modifications with browser settings. It replaces homepage to hp.myway.com and redirects user's search queries to int.search.myway.com, that, presumably, is enhanced and powered by Google, however, provides search results stuffed with sponsored links and excessive advertising.

MacOSDefender or MacOSDefender.app is malicious application for MacOS, that takes over search and homepage settings in Safari, Google Chrome or Mozilla Firefox. While searching for something, users can see multiple redirects, for example: goto-searchitnow.global.ssl.fastly.net -> my-search.com -> searchroute-1560352588.us-west-2.elb.amazonaws.com -> alphashoppers.co. Some of this web addresses figured in our previous articles, from what we can make a conclusion, that those hijackers have similar roots and, probably, one team of developers.