A user has three options available.
- Using macOS's built-in malware removal tool MRT.
This will come into play when a user restarts the Mac.
Malware Removal Tool
Should malware make its way onto a Mac, macOS also includes technology to remediate infections.
The Malware Removal Tool (MRT) is an engine in macOS that remediates infections based on updates
automatically delivered from Apple (as part of automatic updates of system data files and security updates).
MRT removes malware upon receiving updated information, and it continues to check for infections on restart and login.
MRT doesn’t automatically reboot the Mac.
https://support.apple.com/guide/security/protecting-app-access-to-user-data-secc01781f46/1/web/1
2 Using Malwarebytes for Mac.
There are more than a dozen variants of this adware/malware.
Malwarebytes for Mac will remove adware, but it won't set the settings to default, changed by this infection.
A user has to do to it.
Check for adware.
Run the latest release of Malwarebytes for Mac to remove malware/adware, if installed on your Mac.
For instructions: Install Malwarebytes for Mac v4 Uninstall Malwarebytes for Mac
Click the “FREE DOWNLOAD” button.
Click the “Scan” button. Once done, quit Malwarebytes for Mac.
Restart the computer and relaunch Safari holding the shift key down.
Scan for Malware again.
Additional steps if necessary.
1. Remove unknown profiles if present.
System Preferences > Profiles
Open System Preferences, select “General and click the “Profiles” icon ( a checkmark on a gear) .
When Profiles pane opens, select the unknown profile and click the minus button at the bottom.
Section: Remove a configuration profile from your Mac
Profiles: https://support.apphttps://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac
2. Remove unknown extensions: Safari > Preferences > Extensions
httpshttps://support.apple.com/guide/safari/set-your-homepage-ibrw1020/mac
3. Reset search engine: https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac
4. Reset Homepage. https://support.apple.com/guide/safari/set-your-homepage-ibrw1020/mac
5. Check proxies. SOCKS?
System Preferences > Network > Advanced > Proxies
Deselect any proxies if selected.
6. Restart the Mac. Relaunch Safari holding the Shift key down.
3 Run Etrecheck, Click the Security button in the sidebar and if it reports presence of adware,
use the built-in removal tool.
Download EtreCheck: https://etrecheck.com/ and post the report here.
Click, “Free Download” button and then “Click to download” button,
open Downloads folder, click on it to open, and then select ”Open”.
“Choose a problem” from the popup menu box, and then “Start EtreCheck” in the dialog.
Click “Share Report” button in the toolbar and select “Copy report”.
Click the “Page” button in the toolbar at the bottom of this page and paste it when you reply.
Reset all user settings.
