Convuster Adware - How to remove

Convuster is adware – malicious software that shows unwanted ads and opens sponsored websites. It might cause ad spam, browser redirects, and slow down your computer or your internet connection.

Convuster targets Macs. It shows fake Flash Player update prompts to trick users into installing it. It likely gets installed together with other malware, so when removing it, it’s important to check for other malware.

About Convuster adware:

Classification	Trojan, adware.
How Convuster gets installed	It spreads with the help of malicious ads, it’s downloaded with other adware infections.
How to avoid adware infections	Block malicious websites and ads, recognize fake and malicious ads, protect your computer with security tools.
How to remove Convuster and other adware	Use antivirus apps (Combo Cleaner, Malwarebytes, others), find and delete malicious files.

What is Convuster?

Convuster is adware that targets Macs. As Macs get more popular, malicious actors pay more attention to macOS users. Convuster is one of many adware families that affect Mac computers, together with Pirrit, Shlayer, Adload, Cimpli, and others.

Something interesting about Convuster is that it’s written in a programming language unusual for malware (Rust), but that hasn’t stopped malware analysts from unraveling this threat.

How Convuster is distributed

Malware researchers who analyzed Convuster (Securelist.com) believe that this adware is downloaded by another adware infection. This could also mean that, if Convuster is installed, it might not be the only malware on the computer.

Convuster gets around Gatekeeper, which is supposed to keep unauthorized apps from being installed.

Likely, Convuster adware is promoted by fake Flash Player update ads. That’s not surprising – such fake advertisements are used often by many different cybercriminals groups to spread all kinds of malware.

Fake Flash Player update prompts appear on websites that show aggressive ads, as well as on sites that have been infected with malicious redirects.

How Convuster infects Macs

When Convuster infects a computer, it begins by showing a fake Flash Player installation prompt. Interacting with the prompt (even trying to close the window) causes Convuster to download more malware.

Here’s what adware programs like Convuster do to Macs if they’re successfully installed:

• They change search and new tab settings in web browsers. This causes browsers to open unexpected websites (like Searchlee) to deliver search results.
• They change network settings and set up proxies to redirect traffic to their partner websites.
• They install new apps and browser extensions.

Convuster is adware, which means that its goal is to display ads by its partners. But some adware viruses also take up spying – they track user browsing habits, some even read login credentials.

How to get rid of Convuster

Remove Convuster adware

Manual removal instructions for Mac malware can be found below, but it’s advisable to use antivirus tools (such as Combo Cleaner, Malwarebytes, and others.) to remove Convuster, or to at least check your computer with them to make sure that no malware is left on the system.

Antivirus programs detect files related to Convuster as Adware, Bundlore, and Malicious. Some give Convuster its own label, but that’s not common (Virustotal.com).

Some adware infections steal credentials. So, once Convuster and other adware are gone, you might want to reset your passwords.

Avoid adware infections

To avoid Convuster and other Mac adware, it is important to avoid malicious ads. After all, fake software update prompts and other malicious ads seem to be a very common way for malware to spread to macOS systems.

You could avoid visiting websites that show aggressive advertisements. It’s also good to use malicious site blockers and/or adware apps to stop some of the malicious ads that you might encounter. Security apps can help, as can good app security settings (Support.apple.com).

Since Convuster relies on fake Flash Player updates to spread, it’s also good to remember that Flash Player is no longer active and any update prompts you might see online are almost certainly fake.

Automatic Malware removal tools

Manual removal instructions

How to remove Convuster Adware from macOS

Delete Convuster Adware from your applications.

1. Open Finder.
2. In the menu bar, click Go.
3. Select Applications from the dropdown.
4. Find the Convuster Adware app.
5. Select it and right-click it (or hold the Ctrl and click the left mouse button).
6. In the dropdown, click Move to Bin/Trash. You might be asked to provide your login password.

(Optional) Delete related settings

Some malicious apps make themselves difficult to delete by changing various settings and leaving behind malicious files. Remove settings related to Convuster Adware.

• Click the Apple logo in the menu bar. Open System Preferences.
• Some malicious applications set profiles to enforce unwanted settings. Remove unwanted configuration profiles.

1. 1. In System Preferences, click the Profiles icon. This icon is only visible if there are profiles on your Mac.
   2. Select unwanted profiles and remove them by pressing the minus '-'  button at the bottom.

• Some adware applications set SOCKS proxy to manipulate your internet traffic. Remove unwanted proxies:

1. 1. In System Preferences, click Network, Advanced, Proxies.
   2. If a proxy is set without your permission, uncheck it and click OK.

(Optional) Delete malicious files

Some malicious apps leave behind dangerous files in your Library folders. Delete files related to Convuster Adware.

1. Open Finder.
2. In the menu bar, click Go -> Computer.
3. In the search box, type in Convuster Adware and variations of it.
4. Delete the files that are found and that seem to be related to Convuster Adware.