What is the Shlayer Malware on Macs?

According to a study done by Kaspersky, the Shlayer malware is the most popular malware that attacks Macs nowadays. When a Mac is infected with the malware through fake Adobe Flash updates, the Any Search bar is installed and deployed on the computer of the victim. But what is this Shlayer malware on Macs all about?

What Is Shlayer?

You may ask, “Is Shlayer a virus?” The answer is YES.

Shlayer is a type of Trojan virus designed to distribute different adware, launch fake search engines, and install potentially unwanted applications. Although it is usually disguised as an Adobe Flash Player installer, it may take other forms, such as software cracking tools, as well.

Once Shlayer makes it to a Mac, it causes a plethora of problems, including invasive advertisements that point to malicious sites and run scripts that download malware and fake-search engines that collect sensitive information, such as IP addresses, pages viewed, geo-locations, and other personal details, from users.

It is believed that this virus can be acquired by visiting Torrent sites that flash various intrusive ads and entice you to download deceptive files. Don’t worry, though. No matter how damaging this Trojan virus may be, you can always get rid of it or prevent it from harming your Mac.

How to Remove Shlayer from Macs

If you suspect that this malicious Trojan virus has harmed your Mac, below are some Shlayer removal methods you can try:

Method #1: Remove Shlayer Without the Use of Any Third-Party App

Yes, it is possible to remove Shlayer without the involvement of any third-party app. First, you need to uninstall any suspicious apps using Finder. And then, delete the Trojan from Safari, Firefox, and Chrome.

Delete Any Suspicious Apps Using Finder

Regardless of your macOS version, the process of removing malware and adware is generally the same. Here is a step-by-step guide:

1. Open Finder and select Applications.
2. At this point, a list of all installed apps on your Mac will open. Go through the list and remove any unknown and suspicious-looking apps. Right-click on any dubious app and click Move to Trash. Alternatively, drag the app to the Trash folder.

Delete the Shlayer Trojan from Safari, Firefox, and Chrome

Are random pages opened upon the launch of your web browser? Are intrusive ads popping at random while browsing the web? Then it is likely that the Shlayer Trojan has attacked your Mac.

The Shlayer Trojan may change your web browser’s settings without your knowledge. You may even be redirected to a suspicious website and see additional toolbars and extensions. But it’s no reason to panic. What you should do is revert your browser’s default settings.

To delete the Shlayer Trojan from Safari, here’s what you should do:

1. Open Safari.
2. Click on its menu and choose Preferences. This will launch the Safari Preferences window.
3. Navigate to the Extensions tab and look for any suspicious extensions installed. If you find one, click on it and hit Uninstall. Do this with all other dubious extensions on Safari.
4. Once done, navigate to the General tab. Change the value under Default Search Engine to Google.

To delete the Shlayer Trojan from Mozilla Firefox, here’s what you should do:

1. Launch Mozilla Firefox.
2. Click on the Menu button.
3. At this point, a drop-down menu should display on your screen. Click the question mark (?) icon.
4. Select Troubleshooting Information. If you cannot see this option, type about:support into the address bar and hit Enter.
5. Choose Refresh Firefox.
6. You will be asked to confirm your action. Click Refresh Firefox again.
7. Mozilla Firefox will now begin to fix any issues that are triggered by the Shlayer Trojan. Once done, hit the Finish button.

To delete the Shlayer Trojan from Google Chrome, here’s what you should do:

1. Launch Google Chrome.
2. Click the three-dotted menu and choose More Tools.
3. Go to Extensions.
4. Go through the list of extensions currently installed on Google Chrome. If you see an add-on that is signed with Installed by your administrator or Installed by enterprise policy, then remove it.
5. Next, open the three-dotted menu again and select Settings.
6. Scroll down and click Advanced.
7. Look for the Reset section and hit Reset.
8. Chrome will now begin the clean-up process. Once it is finished, its search engine, new tab page, and home page settings will be set back to their respective default values.

Method #2: Remove the Shlayer Trojan Using Antivirus Software

If you wish to remove the Shlayer Trojan the quick and easy way, then install an antivirus tool. You can always get one for free, but make sure that you download antivirus software from the website of its official developer to avoid problems in the long run. With legit and reliable antivirus software, browser hijackers, unwanted programs, adware software, and Trojans won’t stand a chance.

Method #3: Remove All Potentially Unwanted Applications (PUAs)

The Shlayer Trojan can disguise itself as a potentially unwanted application, so be sure your Mac is free of any PUAs.

To remove PUAs from your Mac, follow these steps:

1. Click Finder to open a Finder window.
2. Choose Applications.
3. In the window that opens, look for NicePlayer, Mplayer, or other suspicious apps. If you see one, drag it to Trash.
4. Now, scan your Mac to check if there are still unwanted components associated with the suspicious apps.

Method #4: Remove All Shlayer Trojan-Related Files and Folders

Do you think there are still Shlayer Trojan-related files and folders hiding on your Mac? Then here’s what you should do:

1. Click Finder and navigate to Go > Go to Folder.
2. In the text field, input /Library/LaunchAgents.
3. Look for any suspicious files and move them to Some files you need to find are the following:
   • Installmac.AppRemoval.plist
   • Myppes.download.plist
   • Mykotlerino.ltvbit.plist
   • Kuklorest.update.plist
4. Next, go to the /Library/LaunchDaemons folder.
5. Look for any suspicious files and move them to Trash. Examples of these files are:
   • com.aoudad.net-preferences.plist
   • com.myppes.net-preferences.plist
   • com.kuklorest.net-preferences.plist
   • Com.avickUpd.plist

How to Prevent the Installation of Shlayer

To prevent the installation of Shlayer and other potentially harmful applications, pay caution when browsing the web, especially when downloading, updating, or installing software. Always remember that intrusive advertisements are often disguised as legitimate ones. Once clicked, they will only redirect you to suspicious websites.

In the event that you download dubious apps or extensions, remove them right away. Should there be a need to update an application, make sure you download the required updates from the official website of the app’s developer.

Also, be sure to have a trusted anti-malware tool installed and running on your Mac. It will help detect and eliminate viruses and malware entities before they cause harm to your Mac.

Wrapping Up

Now, your Mac should be free of the annoying Shlayer Trojan and other possible threats. Again, the key to Mac safety is caution. As long as you think before you click, then your files and data will remain safe.

Do you know other ways to remove the Shlayer Trojan? Let us know in the comments!