WebAssistSearch Mac Malware - How to remove

WebAssistSearch is an annoying and persistent macOS infection that causes issues with the web browser. WebAssistSearch hijacks web searches, logs browsing data, displays annoying pop-ups, and refuses to be deleted. WebAssistSearch needs to be removed, which can be done manually or with an anti-malware app.

In short about WebAssistSearch:

Type of threat	Adware, trojan.
Effects of WebAssistSearch	The browser is hijacked, the default search engine is changed, pop-up ads and redirects intrude on normal browsing.
How adware gets installed	Pushed by deceptive ads, installed under false pretenses, the malicious app cannot be removed normally.
Removing WebAssistSearch	Use anti-malware apps (like Combo Cleaner, Malwarebytes, etc.) to find and remove the malicious files, delete associated files, settings, app, and browser extensions.

What is WebAssistSearch?

You might have noticed the WebAssistSearch app as it starts with your web browser. Or maybe you saw it among your browser extensions. WebAssistSearch might have also shown up in a pop-up asking you to please allow it access to incoming traffic.

If you were to scan your Mac with an anti-malware application, it would show that there’s an adware infection on your Mac (VirusTotal link).

WebAssistSearch is adware. It tries to get you to visit certain websites. It changes your search engine settings and the new tab page. Something like Anysearchmanager might show up on your screen and try to deliver your search results. Sometimes a webpage might open unexpectedly or pop-up ads appear on top of webpage content.

There are some other annoying effects:

• WebAssistSearch causes the browser to stop working sometimes. Simply, no webpage will load until you restart your Mac. Might be connected to WebAssistSearch manipulating network settings (System Preferences -> Network -> Advanced -> Proxies) to reroute your traffic.
• The browser extension version of WebAssistSearch has the disturbingly intrusive permission to read your data on all the sites that you visit, which includes things like addresses and passwords. After you remove WebAssistSearch, it’s advisable to create new passwords for all the potentially exposed accounts.
• Likely, WebAssistSearch arrives in an adware bundle. Adware apps cause pop-up ads and redirects in your web browser, change your default search engine, and track your browsing activities.

How to avoid adware

WebAssistSearch infiltrates Macs through fake installers, infected free apps, and deceptive advertisements. Visiting potentially dangerous sites that allow aggressive and unsafe ads to display does put you in danger of getting your Mac infected. So does downloading free apps from poor-reputation websites.

One common example of adware using deceptive ads is a fake warning of Adobe Flash Player being outdated:

1. Some scammer makes a website, decorates it with Flash Player imagery, and puts up the text similar to “Your Flash Player might be out-of-date”.
2. They upload the WebAssistSearch malware in a file named “Flash” or something similar.
3. Then they promote this fake Flash site (which has absolutely nothing to do with Adobe) with ads.
4. The ads appear on free video streaming sites as pop-ups and are easy to mistake for genuine warnings about Flash Player issues.
5. People get convinced by the fake site and download and install the malware, thinking that it’s a real Flash update.

Other methods for malware distribution similarly rely on confusing and misleading people. ConsoleLog, UniversalWebSearch, AristotleLookup, DisplayUpdate, and other malware infect Macs the same way. With the growing macOS userbase, cybercriminals use all kinds of underhanded tactics to make a profit. And though most macOS threats are not as dangerous as Windows malware, they’re still very annoying, and they’re getting more widespread.

How to remove WebAssistSearch

The quickest and easiest way to remove WebAssistSearch is to use an anti-malware app. Combo Cleaner, Malwarebytes, and other reputable security tools can scan your Mac, find the malicious files, remove them, and get rid of the WebAssistSearch problem just like that.

Manual removal is a bit more complicated, but also very viable. However, it would still be a good idea to scan your Mac afterward to make sure that you’ve taken care of all the suspicious items. If something else is found by the anti-malware app, you’ve still got work to do.

In short, you need to remove files like “~/Library/LaunchAgents/com.WebAssistSearch.plist”, “~/Library/Application Support/com.WebAssistSearch”, and others. Any file that has “WebAssistSearch” in its name. You should check these folders:

• Library/LaunchDaemons
• /Library/LaunchAgents
• ~/Library/LaunchAgents
• ~/Library/Application Support

You can visit them by using the Go to Folder dialog in Finder. It’s in Finder’s Go menu.

Open System Preferences and go to Profiles. Remove items related to WebAssistSearch.

Also in System Preferences, go to Users & Groups, Login Items, and remove all the items but the ones that you want to start when your Mac starts.

Remove the WebAssistSearch app by dragging it to Trash. And remove the browser extension (instructions below).

If you have any difficulties with manual removal of WebAssistSearch, try starting your Mac in safe mode. It disables unnecessary apps from running. Just hold the Shift key while you boot your Mac until you see the Apple logo. Some anti-malware apps may also prompt you to restart your Mac in safe mode.

Automatic Malware removal tools

Remove malicious browser extensions

How to remove WebAssistSearch Mac Malware from Safari:Top

Remove malicious extensions

• Click on Safari menu on the top left corner of the screen. Select Preferences.
  
• Select Extensions and uninstall WebAssistSearch Mac Malware and other suspicious extensions.
  
• If your homepage was changed, click on Safari menu on the top left corner of the screen. Select Preferences and choose General tab. Enter preferable URL to the homepage field.
  

(Optional) Reset your browser’s settings(older versions) If you are still experiencing any issues related to WebAssistSearch, reset the settings of your browser to its default settings.

• Click on Safari menu on the top left corner of the screen. Select Reset Safari…
  
• Select which options you want to reset (usually all of them come preselected) and click on the Reset button.
  

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program.

TopHow To remove WebAssistSearch Mac Malware from Google Chrome:

• Click on the 3 horizontal lines icon on a browser toolbar and Select More Tools→Extensions
  
• Select all malicious extensions and delete them.
  
• Click on the 3 horizontal lines icon on a browser toolbar and Select Settings
  
• Select Manage Search engines
  
• Remove unnecessary search engines from the list
  
• Go back to settings. On Startup choose Open blank page (you can remove undesired pages from the set pages link too).
• If your homepage was changed, click on Chrome menu on the top right corner, select Settings. Select Open a specific page or set of pages and click on Set pages.
  
• Delete malicious search websites at a new Startup pages window by clicking “X” next to them.
  

(Optional) Reset your browser’s settings

If you are still experiencing any issues related to WebAssistSearch Mac Malware, reset the settings of your browser to its default settings.

• Click on a Chrome’s menu button (three horizontal lines) and select Settings.
• Scroll to the end of the page and click on theReset browser settings button.
  
• Click on the Reset button on the confirmation box.
  

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program.

How To remove WebAssistSearch Mac Malware from Firefox:Top

• Click on the menu button on the top right corner of a Mozilla window and select the “Add-ons” icon (Or press Ctrl+Shift+A on your keyboard).
  
• Go through Extensions and Addons list, remove everything WebAssistSearch Mac Malware related and items you do not recognise. If you do not know the extension and it is not made by Mozilla, Google, Microsoft, Oracle or Adobe then you probably do not need it.
  
• If your homepage was changed, click on the Firefox menu in the top right corner, select Options → General. Enter a preferable URL to the homepage field and click Restore to Default.
  

(Optional) Reset your browser’s settings If you are still experiencing any issues related to WebAssistSearch, reset the settings of your browser to its default settings.

• Click on the menu button on the top right corner of a Mozilla Firefox window. Click on the Help button.
  
• ChooseTroubleshooting Information on the Help menu.
  
• Click on theReset Firefox button.
  
• Click on the Reset Firefox button on the confirmation box. Mozilla Firefox will close and change the settings to default.
  

If the problem persists, scan your system with an anti-malware program to identify malicious entries.