CustomSuccess Malware - How to remove

CustomSuccess is a suspicious Safari extension that gets installed with the help of fake system windows and deceptive online ads. Once it’s installed, CustomSuccess has access to your data on the sites you visit using Safari: it can read your name, usernames, passwords, and even credit card numbers if you fill them in. Plus, it can read your browsing history. Trying to delete CustomSuccess normally just results in it changing its name and then reinstalling. CustomSuccess looks like it could be related to Shlayer Trojan, which spreads malicious browser extensions using fake Flash Player update prompts online.

CustomSuccess is an adware infection that’s tricky to remove:

Type of threat	Adware, browser hijacker, trojan.
How CustomSuccess gets installed	Downloaded in adware bundles, promoted as fake software updates.
Hijacking symptoms	Yahoo as the default search engine, crashing or freezing apps, unstable internet connection, unfamiliar pop-ups.
Removing CustomSuccess	Find and remove malware (Combo Cleaner, etc.), delete startup files by CustomSuccess, remove malicious profiles, delete the app, delete the extension.

CustomSuccess hijacking symptoms

CustomSuccess is a completely useless browser extension/app and should be removed as soon as it’s discovered: all it really does is redirect your search to Yahoo and read your browsing history. It is a malicious adware app made to manipulate people’s search behavior. The goal of CustomSuccess’s makers is to earn more advertising money and to gather valuable data about people’s browsing habits and personal information. Not sure what, if anything, is done with your personal information, but your browsing history and search logs are greatly valuable for advertisers.

CustomSuccess extension uses the same icon as Any Search Manager by Safe Finder: a blue magnifying glass with a stylized “any” behind it.

Here are some of the symptoms that those infected with CustomSuccess may experience:

• changed default search engine (the site that returns your internet search results after you use the address box to search),
• stuck or hijacked mouse cursor,
• random pop-ups asking you to confirm installations,
• apps crashing or malfunctioning (especially online apps, such as Mail or Discord),
• more ads and pop-ups than usual.

Most likely, CustomSuccess got downloaded in an adware bundle, like a fake system update or Flash update. Normally, you would need to give your password to allow it to be installed. To get around this, the malware must have used windows that cover up the other windows. You might see a window saying “Installation Complete” with an ‘OK’, but it’s covering a window aking if you wish to allow CustomSuccess to be installed. This way, malware can sneak onto your computer without you realizing it.

How to remove CustomSuccess

CustomSuccess usually can’t be removed normally. That’s because it leaves behind a few malicious files and settings that bring it back. Those need to be removed first. You can scan your computer with an anti-malware tool, such as Combo Cleaner, to get rid of any obvious malware, but you may need to delete CustomSuccess’s files manually.

You may need to start your Mac in safe mode – a mode in which your Mac doesn’t load unnecessary apps. Restart your Mac and hold the Shift key until you see the login screen.

Next, look for suspicious login items. These can be found in System Preferences, Users & Groups, Login items. Look for anything similar to CustomSuccess – including items named ActionHow, FocusProvide, LogicalSearch, and others. You might be able to get a feel for how these adware items are named from these examples.

Make sure you have made backup copies that you can recover your Mac from. That’s needed in case you delete something important. Then, open Finder, Go, Go to Folder and go to these folders using the dialog:

• ~/Library/LaunchAgents,
• /Library/LaunchAgents,
• ~/Library/Application Support,
• /Library/Application Support,
• /Library/LaunchDaemons.

Look for files that have “CustomSuccess” in their names or are otherwise suspicious (google the ones that are suspicious). Delete them. Now, you should be able to get rid of CustomSuccess from Safari. The instructions are below. Also, if CustomSuccess is in your Applications, remove it from there, too.

Check your System Preferences for unknown Profiles. Profiles help administrators manage your Mac, but can be abused by malware to reinstall unwanted apps. You can remove unwanted profiles by selecting them and pressing the button with a minus on it.

Finally, restart your Mac: it will exit safe mode and function normally again.

Automatic Malware removal tools

Remove malicious extensions

TopRemoving CustomSuccess Malware from Safari (Mac OS X)

• Click on the Safari menu.
• Choose Preferences.
  
• Click on the Extensions Tab.
• Click on the Uninstall button near the CustomSuccess. Remove all other unknown or suspicious entries too. If you are not sure whether you need the extension or not, you can simply uncheck the Enable check-box to disable the extension temporarily.
  
• Restart Safari.

(Optional) Reset your browser’s settings

If you are still experiencing any issues related to CustomSuccess Malware, reset the settings of your browser to its default settings.

• Click on the Safari menu on the top left corner of the screen. Select Reset Safari.
  
• Select which options you want to reset (usually all of them come preselected) and click on the Reset button.
  

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program.