Learn how to remove fake Adobe Flash Player update virus from Mac and thereby prevent the browser from being redirected to rogue software installation websites.
Update: January 2020
|Name||Fake Adobe Flash Player update virus|
|Category||Mac browser hijacker, redirect/popup virus, Mac adware|
|Detection||Avast: MacOS:AMC-DK [PUP], Avira: PUA/OSX.GT32SupportGeeks.hflsn, BitDefender: Adware.MAC.Generic.12496, ESET: A Variant Of OSX/GT32SupportGeeks.B, Kaspersky: Trojan-Downloader.OSX.Shlayer.a, Microsoft: PUA:MacOS/AMCleaner.B!MTB, Sophos: AdvancedMacCleaner (PUA), Symantec: OSX.Trojan.Gen.2|
|Symptoms||Interrupts web sessions with fake Flash Player update popups, redirects to deceptive sites, causes browser slowdown|
|Distribution Techniques||Freeware bundles, torrents, booby-trapped software updates, misleading popup ads|
|Damage||Interference with browsing settings, harmful downloads, privacy issues due to Internet activity tracking, search redirects, malicious ads|
|Removal||Scan your Mac with Combo Cleaner to detect all files related to the browser hijacker. Use the tool to remove the infection if found.|
The Adobe Flash Player update virus is one of the common ways cybercriminals try to deposit additional harmful code onto a Mac. It usually operates in tandem with such threats as bogus system utilities that report non-existent problems and thus attempt to manipulate users into activating the licensed copy of the scareware. This type of a ruse can be used to promote such unwanted apps as Mac Auto Fixer or Mac Cleanup Pro. Both will run phony scans of the host system and claim to detect hundreds of issues – ones that aren’t there for real. The targeted Mac users therefore deal with a double contamination scenario, where they first encounter recurrent and really annoying instances of browser rerouting and then suffer the consequences of counterfeit software activity. It’s the early stage of the brainwashing that is backed by the Adobe Flash Player update virus popups.
The reason why the architects of this trickery have added the Flash Player to the mix of their shenanigans is probably because it’s a commonly used program trusted by most users. The caveat is that a completely different piece of code is camouflaged as the explicitly stated software. This part of the incursion is usually isolated to the web browser, although there are rare cases where the misguiding popups appear when the browser is closed. The virus manifests itself through random redirects to a site that instantly displays a popup alert saying, “Adobe Flash Player is out of date”. Meanwhile, a prompt at the top of the page layout may wrongfully emphasize that “Latest version of Adobe Flash Player is required to encode and/or decode (Play) audio files in high quality”. Everybody likes quality multimedia content, so a lot of users end up falling for this trick.
In all of these adverse situations, those who pay attention to detail will notice that there is something wrong with such a recommendation. First off, the URL of the website that generates these Adobe Flash Player update popups is a giveaway. Obviously, it has nothing to do with the genuine vendor, being clearly designed to mimic the legit update workflow. Furthermore, despite the fact that the alerts may provide a button to opt out, such as “Later” or “Cancel”, clicking it isn’t likely to close the dialogs for more than a few milliseconds. The pre-configured website script will relaunch the ads, so the victims may have to force quit Safari, Chrome, Firefox – or whatever browser is infected – to get the bogus notifications out of the way.
A whole new attack mechanism with the fake Adobe Flash Player update popups at its core is distributing an emerging Mac threat codenamed Tarmac. Also known as OSX/Tarmac, this infection relies on another type of harmful code called Trojan:OSX/Shlayer. The latter is a notorious Mac Trojan whose objective is to set large-scale malvertising schemes in motion. Its original entry point is a phony alert about an out-of-date version of the Flash Player. Once inside, it reaches out to the Command and Control server and downloads a copy of Tarmac onto the host. The second-stage malware is code signed and leverages RSA encryption to camouflage the fishy gist of its payload, which allows the pest to fly below the radar of quarantine-aware software running on the Mac. As soon as OSX/Tarmac is launched, it attempts to elevate its privileges on the machine by generating a dialog that says, “Play wants to make changes”.
This popup asks for the administrator’s username and password, making it look like the request comes from Adobe Flash Player. Even if the victim is prudent enough to refrain from entering the credentials, Tarmac continues to run with fairly high permissions. Just like Shlayer, it can easily connect to its C&C server and download arbitrary code from it, such as rogue system utilities, adware, or even Mac ransomware. This recently discovered tandem of dangerous programs relying on counterfeit Flash Player update ads demonstrates that the campaign is evolving and assuming more unsettling characteristics.
In January 2020, security analysts unveiled some eyebrow-raising details about the scope of Shlayer wave that piggybacks on rogue Flash Player update popups. According to these findings, one of this Trojan’s iterations was the top Mac threat picked up by a popular antimalware solution last year. Aside from well-orchestrated social engineering trickery, its domination stems from the fact that the operators of this scam have been actively recruiting YouTube channel owners, Wikipedia writers, and bloggers with large subscriber audiences to post ads leading to the malware-riddled downloads. There is also a hefty number of malicious sites created specifically to spread the plague. Some of these trojanized links posted on various legit web outlets lead to domains that expired recently, and it appears that the crooks have bought and repurposed them to serve up the infection. As a result, Mac users who are looking up some trending terms on search engines, such as a new TV show episode or a live stream of a sports event, run the risk of visiting the wrong page that hosts the shady installer.
This troublemaking scenario tends to be bolstered by a malicious browser plugin or extension. The fake helper object modifies Internet settings, such as the homepage or search defaults, and may even interfere with the DNS server preset. This is what causes the redirects in the first place. What happens if you click “OK” and actually download the pseudo Adobe Flash Player update is a whole new attack layer. The affiliated harmful program will establish persistence on the Mac by adding itself to Login Items and utilizing antivirus evasion mechanisms. Then, it will start launching scans of the macOS, purporting to find numerous memory issues and security problems each time. Again, this routine is aimed at pressuring the victim into making a hasty decision to pay for the cyber-impostor’s licensed version. So much for the tactic. Speaking of the fix for the Adobe Flash Player update virus activity, the only method is to spot the components of the pest on the Mac and remove them. See below to learn how it’s done.
Fake Adobe Flash Player update virus manual removal for Mac
The steps listed below will walk you through the removal of this malicious application. Be sure to follow the instructions in the order specified.
- Open up the Utilities folder as shown below
- Locate the Activity Monitor icon on the screen and double-click on it
- Under Activity Monitor, find an entry that appears suspicious and shouldn’t be among the running processes, select it and click Quit Process
- A dialog should pop up, asking if you are sure you would like to quit the troublemaking process. Select the Force Quit option
- Click the Go button again, but this time select Applications on the list. Find the malicious entry on the interface, right-click on it and select Move to Trash. If user password is required, go ahead and enter it
- Now go to Apple Menu and pick the System Preferences option
- Select Accounts and click the Login Items button. The system will come up with the list of the items that launch when the computer is started up. Locate the likely culprit that doesn’t belong there and click on the “-“ button
Get rid of fake Adobe Flash Player update popups in web browser on Mac
To begin with, settings for the web browser that got hit by the Adobe Flash Player update Mac virus should be restored to their default values. The overview of steps for this procedure is as follows:
- Reset Safari
- Open the browser and go to Safari menu. Select Preferences in the drop-down list
- Once the Preferences screen appears, hit the Privacy tab at the top. Find the option that says Remove All Website Data and click on it
- The system will display a confirmation dialog that also includes a brief description of what the reset does. Specifically, you may be logged out of some services and encounter other changes of website behavior after the procedure. If you’re okay with that, go ahead and click the Remove Now button
- In order to selectively clear data generated by certain websites only, not all of them, hit the Details button under the Privacy section of Safari Preferences
- This feature will list all websites that have stored potentially sensitive data, including cache and cookies. Select the one, or ones, that might be causing trouble and click the appropriate button at the bottom (Remove or Remove All). Click the Done button to exit.
- Open the browser and go to Safari menu. Select Preferences in the drop-down list
- Reset Google Chrome
- Open Chrome, click the More (⁝) icon in the top right-hand part of the window, and select Settings in the drop-down
- When on the Settings pane, select Advanced
- Scroll down to the Reset settings section. Under the Restore settings to their original defaults option, click the Reset settings button
- Confirm the Chrome reset on a dialog that will pop up. When the procedure is completed, relaunch the browser and check it for malware activity.
- Reset Mozilla Firefox
- Open Firefox and select Help – Troubleshooting Information
- On the page that opened, click the Reset Firefox button
Get rid of Adobe Flash Player update virus using Freshmac removal tool
When confronted with malicious code like the Adobe Flash Player update virus on Mac, you can neutralize its toxic impact by leveraging a specially crafted system utility. The Freshmac application (read review) is a perfect match for this purpose as it delivers essential security features along with must-have modules for Mac optimization.
This tool cleans unneeded applications and persistent malware in one click. It also protects your privacy by eliminating tracking cookies, frees up disk space, and manages startup apps to decrease boot time. On top of that, it boasts 24/7 tech support. The following steps will walk you through automatic removal of the Adobe Flash Player update infection from Mac.
1. Download Freshmac installer onto your machine. Double-click the Freshmac.pkg file to trigger the installer window, select the destination disk and click Continue. The system will display a dialog asking for your password to authorize the setup. Type the password and click Install Software.
2. Once the installation has been completed, Freshmac will automatically start a scan consisting of 5 steps. It scans cache, logs, unused languages, trash, and checks the Mac for privacy issues.
3. The scan report will then display your current system health status and the number of issues detected for each of the above categories. Click the Fix Safely button to remove junk files and address privacy issues spotted during the scan.
4. Check whether the Adobe Flash Player update virus problem has been fixed. If it perseveres, go to the Uninstaller option on Freshmac GUI. Locate an entry that appears suspicious, select it and click Fix Safely button to force-uninstall the unwanted application.
5. Go to Temp and Startup Apps panes on the interface and have all redundant or suspicious items eliminated as well. The Flash Player update malware shouldn’t be causing any further trouble.
Whereas Adobe Flash Player is useful software that enhances your online experience in plenty of ways, it can as well be a source of vulnerabilities exposing your Mac to cyber-attacks. Furthermore, many users simply don’t catch up with the frequent patches rolled out by the publisher, inadvertently turning their computers into low-hanging fruit.
It comes as no surprise that many users end up disabling the Flash plugin in their web browser at some point. This tool can be safely turned off at the browser level without the need to uninstall it from a Mac altogether. Here is how to disable it in popular browsers:Safari:
- In Safari menu bar, select Preferences
- Select the Security tab, spot the Internet Plug-ins area, and click Plug-in Settings
- Remove the checkmark next to Adobe Flash Player in the subsequent screen
- Click Done
- Type chrome://settings/content in Chrome’s URL bar
- Scroll down and find the Flash entry on the page. Click it
- Spot the Allow sites to run Flash option and toggle it off using the adjacent slider
- Type about:addons in the URL bar and hit Enter
- Select Plugins in the left-hand navigation bar
- Find the Flash Player plugin and expand the appropriate menu
- Choose between Ask to Activate and Never Activate options. The latter is preferable if you don’t want to see annoying popup dialogs during web surfing.
In case the regular Flash Player update popups are interrupting your activities, there is a way to get them out of sight. Be advised that by clicking the Remind Me Later button on these notifications you simply postpone the process, and the irritating message will reappear in an hour. Here’s how to prevent these messages from appearing on your Mac for good:
- Go to the Finder and select System Preferences
- Click the Flash Player icon
- When on the Flash Player screen, hit the Updates tab in its upper part
- You will see the following options to choose from: Allow Adobe to install updates, Notify me to install updates, and Never check for updates
- Enable a radio button next to the Never check for updates option. You can alternatively allow Adobe to install updates – in that case, Flash Player will be updated on its own without producing any popups
If a malicious app is already on board your system, then a macOS update isn’t likely to fix the problem. That being said, updating your Mac does address known security vulnerabilities so that you are protected against common exploits and mainstream viruses further on. Another benefit of applying the updates as soon as they are available is that your Mac will be optimized to ensure smooth performance. Keep in mind that human error might undermine the built-in Mac defenses no matter how top-notch they are.
No, you can’t – as long as you diligently keep Flash Player up to date and all the new versions are installed from the official source. In a vast majority of incidents where this utility is exploited to deposit malware onto Macs, the victims neglect the update hygiene and use very old versions of the product with multiple unpatched security loopholes in them.
Flash updates pushed via popup alerts on rogue websites are a completely different story. The installation clients in this case include bundled malware. If you happen to opt for this kind of an offer, a contamination is pretty much inevitable. The article above highlights the common infection scenarios through fake Adobe Flash Player update notifications. Note that Mac users are typically redirected to these landing pages because their browsers have been hijacked. Therefore, removal of the underlying virus is a prerequisite of addressing the predicament.