Friendlysocket.com Search Malware - How to remove

Friendlysocket.com is a malicious site that targets Macs and hijacks their search. With it taking over your browser, Yahoo.com or Bing.com return web search results. With Friendlysocket.com, your Mac may slow down and you might see unexpected pop-up ads. Removing it is not always straightforward and some people have had to use an antivirus program. Friendlysocket.com is related to Genieo malware.

Friendlysocket.com is a Mac adware infection and should be removed as soon as it’s discovered:

Classification	Adware, browser hijacker.
Friendlysocket.com infection symptoms	Using internet search leads to Friendlysocket.com, Genieosearch.com, and Yahoo.com, the Mac is slower than usual.
How the adware infects computers	Downloaded with fake software updates, installed by adware bundlers.
Remove Friendlysocket.com	Manually delete related files, automatically remove Friendlysocket with an anti-malware tool (like Combo Cleaner).

What is Friendlysocket.com

Friendlysocket.com hijacks the browsers of Mac users in order to take over their web search and send them to affiliated sites. These sites show ads that Friendlysocket.com’s creators profit off of. In addition, the fraudsters get to spy on your search activity and share that data with third parties to “…improve the Friendlysocket operation and services” (from the Search.friendlysocket.com Privacy Policy).

First, Friendlysocket.com redirects to Search2.genieosearch.com. Then it opens Yahoo.com (it used to open Bing.com). The search results are mostly normal. However, with this hijacker infecting your Mac, you can’t change your search settings, which is a major annoyance.

Not to mention, those infected with Friendlysocket.com frequently complain about their Mac using too much memory and slowing down a lot. This is an especially big problem for owners of older Macs.

FriendlySocket is very similar to StrtPoint, SearchMoose, and other adware infections. And Friendlysocket.com has been around for years, here's an Apple Support thread from 2016 that mentions it. This adware lives by many different names, which makes it hard to see the real scale of the problem, but whoever is behind this must be making a profit, or else these infections wouldn’t continue.

How Friendlysocket.com gets installed

Friendlysocket.com may come with the Genieo Newspaper Homepage or another Genieo malware version. Additional adware or even malware wouldn’t be surprising, as adware infections often spread in groups. Worse, some Mac malware can download additional malicious apps in the background.

But how do people download FriendlySocket in the first place?

One culprit is fake Flash update prompts. Despite Adobe Flash Player being barely used online and facing retirement, this program is still ingrained in many people’s consciousness as a trusted program. So, when pop-up ads telling us to update out Flash player appear, many of us agree to it on reflex. That’s a big mistake. Among malware that spreads using this method is Shlayer Trojan, a persistent adware infection that hijacks the victim’s web traffic.

Another possibility is freeware bundling. Maybe Friendlysocket.com got installed during the installation of another free app, as part of a pay-per-install scheme. This mostly happens when you download apps from unreliable sites. Although Macs should bet better protected than PCs in these situations, some smart fraudsters still come up with ways to get around the security.

How to remove Friendlysocket.com

Before deleting potentially important files, you should make a backup of your machine and make sure that you know how to restore it. If you accidentally delete a really important file, that could break your macOS a bit. So, set up a restore just in case.

First, you may want to run your Mac in safe mode (Apple support post). This stops most unnecessary programs from running and they won’t get in your way while you’re messing with their files.

Then, check ~Library/LaunchAgents and ~Library/Application Support and look for files named FriendlySocket. You can open these folders with the Go to Folder dialog, which is in Finder’s Go menu. If you find files named “FriendlySocket”, remove them. Also, check your System Preferences and see if you have Profiles there. If so, see if any of your profiles are connected with Friendlysocket.com and, if needed, remove them. This should stop Friendlysocket.com from coming back after you delete it. Then check your browser for unwanted extensions and remove those.

The problem with deleting files is not just that it’s a bit dangerous, but also that different versions of Friendlysocket.com may require different instructions. Whether or not you use the manual method, it’s recommended to let an anti-malware scanner check your Mac and see if anything is left.

For automatic removal, scan your computer with an anti-malware program, such as Combo Cleaner. Anti-malware tools can’t always reliably detect the FriendlySocket adware, so you may have to try a few different solutions. Just make sure that you use reputable programs.

Automatic Malware removal tools