How to eliminate UpdateAgent malware?
Written by Tomas Meskauskas on (updated)
What is type of malware UpdateAgent?
UpdateAgent (also known as WizardUpdate) is a piece of malware targeting Mac computers. Research shows that the latest UpdateAgent variant poses as legitimate software. It can collect certain information and install adware (and host additional payloads).
UpdateAgent malware in detail
UpdateAgent malware examines the infected computer and then sends system information, product name, version to a C2 (Command-and-control) controlled by threat actors. Also, UpdateAgent installs AdLoad adware and hosts additional payloads by abusing public cloud infrastructure.
Furthermore, UpdateAgent tries to bypass Gatekeeper (a security feature of the macOS system that prevents untrusted applications from running) by deleting the quarantine attribute of the downloaded file. It attempts to make the infected system to recognize it as a trusted application.
| Name | WizardUpdate malware |
| Threat Type | Mac virus, Trojan |
| Detection Names | Avast (MacOS:AdAgent-AY [Adw]), Combo Cleaner (Trojan.Generic.30887513), ESET-NOD32 (OSX/Adware.WizardUpdate.H), Kaspersky (HEUR:Trojan.OSX.Agent.gen), Full List (VirusTotal) |
| Payload | AdLoad and possibly additional payloads |
| Symptoms | Trojans are designed to stealthily infiltrate the victim's computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine. |
| Distribution methods | Drive-by downloads (most likely) |
| Damage | Installation of adware, possible other computer infections |
| Malware Removal (Mac) | To eliminate possible malware infections, scan your Mac with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
More details about UpdateAgent
Additionally, UpdateAgent takes advantage of existing user permissions to create both LaunchAgent and LaunchDeamon folders on the infected device to avoid being removed. In order to conceal its activities (hide itself), UpdateAgent deletes the created folders, files, and other by-products. More Mac malware examples are iTerm2, XcodeSpy, and Silver Sparrow.
How did UpdateAgent install on my computer?
It is likely that the UpdateAgent malware is distributed through drive-by downloads, deceptive pop-up ads. Drive-by download attacks are successful when users unknowingly download malicious code or software bundled with malware. As mentioned in the first paragraph, UpdateAgent is distributed by disguising it as a legitimate program.
Cybercriminals can distribute malware through software cracking tools (or installers for pirated software), fake updaters, emails containing malicious attachments or links, unreliable sources for downloading files/programs, certain types of Trojans.
How to avoid installation malicious applications?
Download software from legitimate sources such as official pages and platforms. Avoid opening files (attachments) and links in irrelevant emails received from unknown or suspicious addresses. Update and activate the software using tools provided by its official developer.
Have reliable antivirus software installed on the operating system and run scans regularly. Always keep that security suite up to date. If your computer is already infected with PUAs, we recommend running a scan with Combo Cleaner Antivirus for macOS to automatically eliminate them.
Instant automatic Mac malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of Mac malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner for Mac
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
- What is UpdateAgent malware?
- STEP 1. Remove PUA related files and folders from OSX.
- STEP 2. Remove rogue extensions from Safari.
- STEP 3. Remove rogue add-ons from Google Chrome.
- STEP 4. Remove potentially unwanted plug-ins from Mozilla Firefox.
Video showing how to remove adware and browser hijackers from a Mac computer:
Potentially unwanted applications removal:
Remove potentially unwanted applications from your "Applications" folder:
Click the Finder icon. In the Finder window, select "Applications". In the applications folder, look for "MPlayerX", "NicePlayer", or other suspicious applications and drag them to the Trash. After removing the potentially unwanted application(s) that cause online ads, scan your Mac for any remaining unwanted components.
Remove adware-related files and folders
Click the Finder icon, from the menu bar. Choose Go, and click Go to Folder...
Check for adware generated files in the /Library/LaunchAgents/ folder:
In the Go to Folder... bar, type: /Library/LaunchAgents/
In the "LaunchAgents" folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - "installmac.AppRemoval.plist", "myppes.download.plist", "mykotlerino.ltvbit.plist", "kuklorest.update.plist", etc. Adware commonly installs several files with the exact same string.
Check for adware generated files in the ~/Library/Application Support/ folder:
In the Go to Folder... bar, type: ~/Library/Application Support/
In the "Application Support" folder, look for any recently-added suspicious folders. For example, "MplayerX" or "NicePlayer", and move these folders to the Trash.
Check for adware generated files in the ~/Library/LaunchAgents/ folder:
In the Go to Folder... bar, type: ~/Library/LaunchAgents/
In the "LaunchAgents" folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - "installmac.AppRemoval.plist", "myppes.download.plist", "mykotlerino.ltvbit.plist", "kuklorest.update.plist", etc. Adware commonly installs several files with the exact same string.
Check for adware generated files in the /Library/LaunchDaemons/ folder:
In the "Go to Folder..." bar, type: /Library/LaunchDaemons/
In the "LaunchDaemons" folder, look for recently-added suspicious files. For example "com.aoudad.net-preferences.plist", "com.myppes.net-preferences.plist", "com.kuklorest.net-preferences.plist", "com.avickUpd.plist", etc., and move them to the Trash.
Scan your Mac with Combo Cleaner:
If you have followed all the steps correctly, your Mac should be clean of infections. To ensure your system is not infected, run a scan with Combo Cleaner Antivirus. Download it HERE. After downloading the file, double click combocleaner.dmg installer. In the opened window, drag and drop the Combo Cleaner icon on top of the Applications icon. Now open your launchpad and click on the Combo Cleaner icon. Wait until Combo Cleaner updates its virus definition database and click the "Start Combo Scan" button.
Combo Cleaner will scan your Mac for malware infections. If the antivirus scan displays "no threats found" - this means that you can continue with the removal guide; otherwise, it's recommended to remove any found infections before continuing.
After removing files and folders generated by the adware, continue to remove rogue extensions from your Internet browsers.
Remove malicious extensions from Internet browsers
Remove malicious Safari extensions:
Open the Safari browser, from the menu bar, select "Safari" and click "Preferences...".
In the preferences window, select "Extensions" and look for any recently-installed suspicious extensions. When located, click the "Uninstall" button next to it/them. Note that you can safely uninstall all extensions from your Safari browser - none are crucial for regular browser operation.
- If you continue to have problems with browser redirects and unwanted advertisements - Reset Safari.
Remove malicious extensions from Google Chrome:
Click the Chrome menu icon 
(at the top right corner of Google Chrome), select "More Tools" and click "Extensions". Locate all recently-installed suspicious extensions, select these entries and click "Remove".
- If you continue to have problems with browser redirects and unwanted advertisements - Reset Google Chrome.
Remove malicious extensions from Mozilla Firefox:
Click the Firefox menu 
(at the top right corner of the main window) and select "Add-ons and themes". Click "Extensions", in the opened window locate all recently-installed suspicious extensions, click on the three dots and then click "Remove".
- If you continue to have problems with browser redirects and unwanted advertisements - Reset Mozilla Firefox.
Frequently Asked Questions (FAQ)
My computer is infected with UpdateAgent malware, should I format my storage device to get rid of it?
Not all computer infections cannot be eliminated without formatting storage devices. The UpdateAgent malware can be removed without doing so.
What are the biggest issues that malware can cause?
It depends on the type of malware. It could be identity theft, monetary losses, additional computer infections, decreased computer performance, loss of access to online accounts, data encryption.
What is the purpose of the UpdateAgent malware?
It is known that UpdateAgent can install AdLoad adware. Also, it can host additional payloads (computer infections).
How did UpdateAgent malware infiltrate my computer?
It is likely that UpdateAgent is distributed via drive-by downloads. Although, it is possible that cybercriminals could use phishing and other social engineering techniques (for example, malicious emails, fake system warning messages), Peer-to-Peer, unofficial software download websites to distribute their malware. It is important to know that certain malware is capable of self-spreading through the local network and removable storage devices like external hard drives, USB flash drives.
Will Combo Cleaner protect me from malware?
Yes, Combo Cleaner is capable of detecting and eliminating almost all known malware infections. The operating system should be scanned using a full scan because quick scan may not detect high-end malware designed to hide deep in the operating system.
Outstanding!
▼ Show Discussion