How to remove UpdateAgent Trojan (Mac)

What is UpdateAgent Trojan

UpdateAgent Trojan is a malicious software specifically targeting macOS systems, masquerading as legitimate applications to infiltrate unsuspecting users’ computers. Once installed, it stealthily collects system information and communicates it back to a command-and-control server operated by cybercriminals. This Trojan is notorious for its ability to install additional malicious payloads, such as adware, which can lead to an inundation of unwanted advertisements, severely disrupting the user experience. By exploiting vulnerabilities within macOS, UpdateAgent attempts to bypass security measures like Gatekeeper, allowing potentially harmful applications to run without user consent. This breach can result in degraded system performance, increased security risks, and potential exposure to further malware infections. To mitigate these threats, users should exercise caution when downloading software, ensuring it’s sourced from reputable providers, and maintain up-to-date antivirus solutions to detect and eliminate such threats effectively. Regular scans and monitoring are essential in safeguarding against the insidious activities of UpdateAgent and similar malware.

How UpdateAgent Trojan infected your system

The UpdateAgent Trojan, also known as WizardUpdate, is a sophisticated piece of malware that primarily targets Mac computers, often masquerading as legitimate software to deceive users. It typically infiltrates systems through drive-by downloads, where users inadvertently download malicious software by visiting compromised websites, or through deceptive pop-up ads that prompt unwitting installations. Additionally, UpdateAgent may also spread via software cracking tools, fake updates, or malicious email attachments and links, leveraging common social engineering tactics to gain entry. Once installed, it stealthily examines the system, sending critical information back to its command-and-control servers, and further exploits user permissions to embed itself deeply into the system’s architecture. This includes creating and utilizing LaunchAgent and LaunchDaemon folders to maintain persistence and evade detection, thus facilitating the installation of adware like AdLoad and potentially other malicious payloads. To effectively protect against such threats, it is crucial to download software only from official sources, remain vigilant against suspicious emails, and maintain robust antivirus defenses to regularly scan for potential threats.

Remove UpdateAgent Trojan from macOS manually

Removing UpdateAgent Trojan from macOS requires a systematic approach that involves a combination of built-in tools, safe computing practices, and sometimes third-party software. Here’s a comprehensive guide to identifying and removing viruses from your Mac, ensuring your system’s integrity and security.

Files and folders of UpdateEngine trojan:

/Library/Application Support/Helper/HelperModule
/Library/Application Support/WebVideoPlayer/WebVideoPlayerAgent
/Library/Application Support/McSnip/McSnipAgent
~/Library/Application Support/Quest/QuestBarStatusAgent
~/Library/Application Support/SubVideoTube/SubVideoTubeStatusAgent

Step 1: Disconnect from the Internet

1. Disconnect your Mac from the Internet. This prevents the virus from sending data to its creator or downloading more malicious software. Turn off Wi-Fi and unplug any Ethernet cables.

Step 2: Enter Safe Mode

2. Restart your Mac in Safe Mode. Safe Mode performs a check of your startup disk and restricts certain software from automatically loading or opening.
   • For Intel-based Macs: Restart your Mac and immediately press and hold the Shift key until you see the login window.
   • For Apple Silicon Macs: Turn off your Mac, press and hold the power button until you see the startup options window, select your startup disk, press and hold the Shift key, then click Continue in Safe Mode.

Step 3: Use Built-in Tools for Malware Removal

3. Use Finder to identify and remove suspicious applications.
   • Open Finder, go to the Applications folder, and look for any applications you don’t recognize or didn’t intentionally download.
   • Right-click the suspicious application and select Move to Trash, then empty the Trash.
4. Use macOS built-in malware removal tool (MRT). macOS automatically runs MRT in the background, but you can manually run a malware scan by updating your software.
   • Go to System Preferences > Software Update.
   • Install any available updates, as these often include the latest security improvements and malware definitions.

Step 4: Check and remove UpdateAgent Trojan from Login Items

Note: UpdateAgent Trojan may set up to start on macOS startup. Therefore, before starting the removal, perform these steps:

1. Open System Preferences, choose Users & Groups.
2. Choose your account (set up as Current User).
3. Click Login Items tab.
4. Find suspicious entries. Select it, and click the “-“ (minus) button to remove them.

Step 5: Check and remove UpdateAgent Trojan Malicious Device Profile

Important update: UpdateAgent Trojan can install malicious Device Profile called AdminPrefs or similarly on MacOS, that won’t allow users to make changes to browser search engine and homepage settings. Follow instructions below to remove this profile.

Remove UpdateAgent Trojan profile

1. Go to System Preferences and click on Profiles.
2. In the list of profiles on the left side, choose AdminPrefs or other profile and click on “-” button to remove it.
3. In your case it can be named differently, in this case remove all visible profiles. Check the picture below to see how it looks like.

Step 6: Reset Your Web Browsers

Reset Safari:

1. Start Safari on your Mac, click Safari to open drop-down menu and choose Preferences
2. Go to the Privacy section of Safari’s preferences.
3. Click Remove All Website Data button.
4. In the opened window, click Remove Now button to remove data stored by websites in Safari.
5. Go to the Advanced section of Safari’s preferences.
6. Click the Show Develop menu in menu bar option.
7. In the menu, click Develop and select Empty Caches from this menu.
8. Again, go to Safari menu and choose Clear History….
9. Choose to clear all history and click Clear History button.

Reset Google Chrome:

1. Start Google Chrome browser
2. In address box type (or copy-paste) chrome://settings.
3. Scroll down and find Show advanced settings link.
4. Click on it and scroll down to the bottom again.
5. Click Reset settings button and click Reset to confirm.

Reset Mozilla Firefox:

1. Start Mozilla Firefox browser.
2. In address box type (or copy-paste) about:support.
3. Click Refresh Firefox… button.
4. Click Refresh Firefox to confirm.

Step 7: Restore from a Backup

8. If the issue persists, consider restoring your Mac from a backup.
   • Use Time Machine or another backup system to restore your Mac to a state before it was infected.
   • Ensure the backup you choose predates the malware infection.

Prevention Tips

• Keep your macOS updated. Regularly check for and install macOS updates to ensure you have the latest security patches.
• Be cautious with downloads and attachments. Only download software from trusted sources like the Mac App Store or official websites.
• Use strong passwords and enable two-factor authentication (2FA) where possible.
• Consider enabling the macOS firewall in System Preferences > Security & Privacy.
• Regularly back up your Mac using Time Machine or another backup solution to ensure you can recover your system if needed.

Following these steps should help you remove most viruses from your Mac. If you continue to experience issues, consider seeking help from Apple Support or a professional cybersecurity service.