Mac Viruses

Goto-searchitnow.global.ssl.fastly.net is intermediary domain, used by search hijackers to redirect user's queries from well-known search engines to Searchitnow.info and vice versa. Goto-searchitnow.global.ssl.fastly.net can be seen in Safari, Google Chrome and Mozilla Firefox on Mac. Probably, it is used to drive traffic through faster cloud servers. If your searches are compromised like this, it means there is an adware module installed on your Mac. It can be presented by application, add-on, malicious device profile or just virus file and process.

Easy Speed Test Access or Search.easyspeedtestaccess.com is nasty browser hijacker and adware, that modifies search engine, homepage and new tab settings in Safari, Google Chrome and Mozilla Firefox. It can infect both Windows and Mac computers. Virus gets access to browsers data by installing extension, users themselves download it from phishing or advertising pages. Add-ons can be called: Easy Speed Test Access, Speed Test, Super Speed Tester, etc. After infiltration, hijacker sets search.easyspeedtestaccess.com as default search and opens it as homepage or new tab at every start. Page looks like typical third-party search engine, with toolbar, quick links to shopping sites and social networks and, in this case, to websites, that provide internet speed testing functionality. Search queries are redirected to search.yahoo.com.

Search Encrypt or Searchencrypt.com is internet search engine, that, according to its developers, prioritises users's privacy while web search. Company, that developed this site is based in Limassol, Cyprus. Search Encrypt uses AES-256 encryption to encode search terms, and creates short-living key to encrypt user's queries. Searchencrypt.com can be used independently, or along with Google Chrome or Mozilla Firefox add-ons called Search Encrypt and Privacy Toolkit. Although, website seems to be legitimate, many users complain, that extensions are installed without their consent. Search Encrypt gets its revenue from ads, and advertising policy, as well as encryption technology are not transparent. These facts give a birth to concerns about its safety and privacy. In this tutorial we show how to completely remove Search Encrypt and restore preferred homepage and search engine settings.

MacSecurityPlus is advertising virus, that hits Mac systems. It aims Safari, Google Chrome or Mozilla Firefox browsers and wants to control these apps to display ads, pop-ups and get access to private user's data. MacSecurityPlus does not have any interface, but its activity can be spotted in Activity Monitor. It also generates fake system alerts and causes legal system messages to force users to grant access to browsers for MacSecurityPlus. As a result of virus activity, users may experience unstable browsers operation, modification of browser settings, such as default search engine and homepage, and annoying, unusual advertising. In addition to that, MacSecurityPlus access to browsing data (history, cookies, caches, bookmarks), opens gate to affected computer for advertisers of all kinds.

Search.yourmapsnow.com or Your Maps Now is misleading browser hijacker, that replaces default search engine and homepage in Safari, Google Chrome or Mozilla Firefox on Windows or Mac. Often, it is accompanied with browser extension or application called "Your Maps Now". This add-on sneaks in browsers and takes control over main browser settings. Of course, it installs without user permission using the deceptive tactic. After installation, user search queries are redirected to query.yourmapsnow.com and then to search.yahoo.com. This allows the hijacker to collect private browser data and share it with advertising companies. The homepage also changes to Search.yourmapsnow.com and, besides search, provides quick links to main map resources such as Google Maps and Bing Maps. Page looks similar to normal search engine page, and some users don't even see the difference until they start searching for something.

PDF Converter Hub (a.k.a. PDF Converter Hub New Tab, Search.hpdfconverterhub.com) is potentially unwanted browser extension for Google Chrome, Mozilla Firefox and Safari. Malware originates from Cyprus and was developed by Eightpoint Technologies Ltd. (some sources indicate SpringTech Ltd.) It modifies search and homepage settings in these browsers and controls them not allowing users to make changes. Hijacker sets search.hpdfconverterhub.com as default search engine, new tab and home page. However, search queries typed in the search box are redirected to search.yahoo.com, so there can be some kind of affiliation or partnership between large search provider and developer of the add-on. PDF Converter Hub also constantly offers users to subscribe to its notifications, which will lead to getting unwanted advertising as desktop notifications. Main page itself consists of toolbar, search box, informational links and shortcuts to popular shopping sites and social networks. PDF Converter Hub is promoted as convenient tool for converting various file formats to PDF and vice versa.

MacAppExtensions (Adware.MAC.Linkury.C) is malware related to Search.tapufind.com hijacker, that we described in some of our earlier articles. It works in MacOS and targets Safari, Google Chrome and Mozilla Firefox browsers. The main symptom is, that your browsers search and homepage settings change to search.tapufind.com, and this setting cannot be modified until MacAppExtensions is removed. However, this virus not only hijacks the browser, but also gathers private information about its user (collects data related to browsing activity: geolocations, entered search queries, URLs of visited websites, IP addresses etc.).

Robotcaptcha.info is adverse domain, that may show unwanted pop-ups and ads in Google Chrome, Mozilla Firefox, Internet Explorer Safari or Edge browsers on Windows, Mac or Android operating systems. Landing pages from Robotcaptcha.info appear from nowhere and offer users to subscribe to notifications. This is feature in modern browsers, that help users get actual news in faster and convenient way. However, on the other side of this, when website is of advertising nature, users start receiving ads, pop-ups, tech support scam messages on their desktops. This is an element of social engineering, and clicking "Allow" button, actually, subscribes users to notifications. At the same time, Robotcaptcha.info initiates standard dialog box window with option to allow or block notifications from site you are visiting. If person clicks on the "Allow" button, users will start receiving unwanted pop-up ads from Robotcaptcha.info directly on the desktop even when browser is closed.