Home » How to Remove DNSChanger From Mac OS X
Mac OS Malwares

How to Remove DNSChanger From Mac OS X

Remove DNSChanger From Mac OS X
Remove DNSChanger From Mac OS X

What is DNSChanger? How it got installed on my mac?

If you the one noticing DNSChanger installed on your Mac then you must read this post. 

What is DNSChanger

DNSChanger also known as RSPlug is detected as a destructive program for the Mac users. It is also detected as Trojan:OSX/DNSChanger.  The threat likely to silently modify the DNS settings which leads to change in the original DNS address of the infected Mac system. It can be used to carry out various illegal tasks after successful intrusion.

There is a persistent similar threat known as DNSUnlocker that targets Windows users, but DNSChanger targets the Mac users. This potentially undesirable program is generally distributed via freeware downloads from third-party sites. There are also various social engineering tactics to distribute such PUPs like SelectMaker, CrescentCore, and MatchKnowledge. When users go for free downloads from unverified sites, then additional program often comes bundled up within the installers.

Thus, it can accidentally get installed on the Mac without additional user’s permission. Also, DNSChanger is often advertised as a helpful program that can assist users in surf freely without any geo-restriction. But you should never use such tools, instead you should rely on trusted VPN services.

Once successfully installed on your Mac, DNS Changer targets the hosts file that contains the allowed or blocked web addresses. on your Mac. But the host file contains much more information that can be helpful to the cyber-criminals. Most of the illegal activities occurs within the background that is out of the knowledge of users. But due to various changes to the web browser and Domain name settings, you can face trouble while browsing. For instance, you may see your homepage and search engine altered by some unknown one that further causes mislead of information. Users affected with DNSChanger often complain about plenty of ads, pop-ups, intrusive links, and browser redirects to undesirable web pages.

Apart from that, it silently keeps on tracking the browsing activities of users as it has the full control over your network. All these activities can consequence to scams, click frauds, download of any fake security tool like Advanced Mac Cleaner, Quick Mac Care, Mac Auto Fixer and Smart Mac Tuneup. Thus, it is important to quickly remove DNSChanger malware as soon as possible.

Special Offer
“DNSChanger” may reinstall itself multiple times if you don’t delete its core files. We recommend downloading Combo Cleaner to scan for malicious programs. This may save your precious time and effort.
Download Combo Cleaner Anti-Malware For Mac
More information on Combo CleanerEULA,and Privacy Policy. Combo Cleaner scans the infected PC for free but you need to purchase its full version for complete removal.
Mac OS: Use Anti-Malware To Scan And Remove DNSChanger (Recommended)

Combo Cleaner is a complete security suite for Mac OS that is developed by “RCS LT” company. This program is featured with anti-virus scanner and system optimization tools like disk cleaner, duplicate files finder, application uninstaller, privacy scanner, and 24*7 customer support service.

Rather than being just a traditional anti-virus or a system optimizer, this single program takes a different approach that eases the user from using a different application to keep their MAC OS protected and optimized.

It is very important to have a reliable anti-virus solution for the computer system. Combo cleaner is one of the best options for MAC users as detects and eliminates all sorts of threats like adware, browser hijacker, Trojans, and other malware. It is a light-themed, easy-to-use interface and keeps updating its threat database hourly to instant detect and remove any sort of malware. Thus ensuring not any malicious stuff is behind within the system.

How to Install and Scan with Combo Cleaner

  • Click the above button to Download the “Combo Cleaner”;
  • Once the download completes, double-click on the downloaded file;
  • After the window opens, drag the Combo Cleaner program icon and drop into your “Applications folder” icon.
    Combo Cleaner Install Step 2
    Combo Cleaner Install Step 2
  • Now, open your “Launchpad” and click on the “Combo Cleaner” icon.
    Combo Cleaner Install Step 3
    Combo Cleaner Install Step 3
  • This will start the combo cleaner installation and updates its latest virus definition. Once done, Combo cleaner will launch;
    Combo Cleaner Dashboard
    Combo Cleaner Dashboard
  • Click on “Antivirus” tab and choose the scan options like Quick, Full, and custom. (Full is recommended for the first time)
    Start Scan For DNSChanger
    Start Scan For DNSChanger
  • Let the scan be completed and it will list all the threat found. Now, click on “Remove All Threats”;
    Scan Result Shows Program associated with DNSChanger
    Scan Result Shows Program associated with DNSChanger
  • After removing the threats, click on the “uninstaller” to find and remove any unwanted programs. Select the program from the list and its related files and then click on “Remove Selected Items
Remove DNSChanger
Remove DNSChanger

download-for-mac

If you still have the second thought about this anti-malware, then you may want to check out our review article about Combo Cleaner.

Mac OS: Manually Find And Remove DNSChanger ( Not Recommended)

If you are going for the manual removal process, then we recommend you to print/download these instructions or open it from another uninfected computer or laptop and follow step-by-step manual removal instruction. Mac OS PDF Guide

Step 1. Ending Process Running Under The “Activity Monitor”

  1. Type “Activity Monitor” in the Launchpad to open it;
    Launchpad-1.1.1
    Launchpad-1.1.1
    Activity Minor - 1.1.2
    Activity Minor – 1.1.2
  2. Scroll through the list of running apps, look for the suspicious ones that appear unknown to you or taking huge CPU resources.
  3. Use the [x] button to quit the process.
    Force Stop -1.2 and 1.3
    Force Stop -1.2 and 1.3

Step 2. Remove DNSChanger Malicious Apps From Mac OS

  1. Open “Finder” by clicking on the Finder application on your dock.
    Finder - 2.1
    Finder – 2.1
  2. In the left pane of the Finder, click on “Applications“.
    Applications - 2.2
    Applications – 2.2
  3. Next, you need to locate the DNSChanger Adware/suspicious apps and remove them. The “Applications” window will display the list of all apps installed on your Mac OS.
    Step - 2.3
    Step – 2.3
  4. Now, you need to go through the list to find out the DNSChanger and other suspicious/malicious or infectious app, select it then right click and then select “Move to Trash”. (Repeat this step until you remove all such apps).
    Move to Trash - 2.4
    Move to Trash – 2.4
  5. Now you need to empty the trash as sometimes program can restore themselves from the trash. On your dock, right-click on the trash icon and then select “Empty Trash”.
    Step - 2.5.1
    Step – 2.5.1
    Step 2.5.2
    Step 2.5.2

NOTE: if something looks suspicious to you but you are not sure of that, search the web to find out more about that app.

Step 3. Remove DNSChanger Apps From Auto-Startup

Generally, malicious programs, Adware and spyware add themselves to the boot process to launch automatically whenever the device boots. So, you need to find such apps and remove from the startups.

  1. Open Apple menu ? System Preferences
    Step - 3.1
    Step – 3.1
  2. Now, choose “Users & Groups” section
    Step - 3.2
    Step – 3.2
  3. Select your username from the left pane;
    Step - 3.3
    Step – 3.3
  4. A list will appear showing login items; check the list and use “” sign to disable DNSChanger or other suspicious/unwanted apps you see. Close the screen.
    Step - 3.4
    Step – 3.4
  5. Next step, from the top menu, choose Go ? Go to Folder, then type /Users/Shared/ within the search box. In the “Sharedfolder”, you need to delete the “Similar” files and folders.
    Step - 3.5.1
    Step – 3.5.1
    Step - 3.5.2
    Step – 3.5.2
    Step - 3.5.3
    Step – 3.5.3
  6. Now Restart your Mac to make the changes into effect.
    Step - 3.6
    Step – 3.6

Step 4. Remove DNSChanger Daemons And Agents From Mac’s Startup

  1. From top menu ? Choose Go ? Go to Folder
    Step - 4.1
    Step – 4.1
  2. Type in “/Library/LaunchDaemons”, within this location you will see lots of files with .plist extension. Scroll through it and find the ones which appear to be suspicious and delete them.
    Step - 4.2.1
    Step – 4.2.1
    Step - 4.2.2
    Step – 4.2.2
  3. Do the same for other launching agents locations:
      1. /Library/LaunchAgents
      2. ~/Library/LaunchAgents

    For example: an adware named Vsearch, you may get launching agent as :
    /Library/LaunchAgents/com.vsearch.agent.plist
    ~/Library/LaunchAgents/com.vsearch.agent.plist
    Don’t forget to empty the trash and then restart the computer.

    Step - 4.3.1
    Step – 4.3.1
    Step - 4.3.2
    Step – 4.3.2
  4. After restart, again repeat step 1-2 and type in: /System/Library/Frameworks/ (look for the malicious file with .framework extension like /System/Library/Frameworks/VSearch.framework)
    Step 4.4.1
    Step 4.4.1
    Step - 4.4.2
    Step – 4.4.2
  5. Put the file to trash, if you find one with a malicious name.
  6. Similarly, do more searches within the location:
    • /Library/Application Support/
    • /Library/PrivilegedHelperTools/
      Step - 4.6.1
      Step – 4.6.1
      Step - 4.6.2
      Step – 4.6.2
      Step - 4.6.3
      Step – 4.6.3
      Step - 4.6.4
      Step – 4.6.4
  7. Put them to trash and again empty the trash and restart the computer.
    Step- 4.7.1
    Step- 4.7.1
    Step - 4.7.2
    Step – 4.7.2
    Step - 4.7.3
    Step – 4.7.3

Step 5. Uninstall DNSChanger Or Unwanted/Suspicious Extensions From Browsers

Reset Safari Browser Guide

Follow the steps to remove unwanted and suspicious extensions from the Safari browser:

  • On the Safari browser, click the “Safari” menu then select “Preferences”.
    Reset Mac Chrome Step-1
    Reset Mac Safari Step-1
  • On the General tab of the Safari preferences, check for any unknown URL added as the default homepage, Within the “Homepage” field enter your preferred URL as your default start-page of the browser.
    Reset Mac Chrome Step-2
    Reset Mac Safari Step-2
  • Next, you need to check for malicious extensions, click on the “Extensions” tab on the same window.
  • Extensions” screen will list all the extensions installed on your safari browser, you need to browse through the list and uninstall the ones which appear to be Adware. If you find a malicious extension select it and then click on “Uninstall”. Repeat the steps to remove all unwanted extensions.
    Reset Mac Safari Step-3
    Reset Mac Safari Step-3
  • Close the Safari browser.
Reset Chrome Browser Guide

To check for unknown extensions installed:

  1. Click on Chrome Menu(three vertical dots at top-right corner) ? Select “Settings” ? Choose “Extensions”.
    Remove Chrome Extensions 1
    Remove Chrome Extensions 1
  2. Scroll through the list of extensions installed on the Chrome browser, if any one of them appears to malicious then click on the “trash” icon next to it. This will remove the extension.
    Remove Chrome Extensions 2
    Remove Chrome Extensions 2
  3. Repeat the step until you are sure of the ones you like to keep.

To Reset The Browser:

Next, you need to reset the default settings like search engines, startup, and new tabs. It is better to use the default reset feature of the Google Chrome which will reset all the unwanted modifications done by third-party programs. Don’t worry you will not lose your saved passwords and bookmarks. However, it will delete cookies, extensions, startups, URLs, homepage and new tabs preferences.

  • Click on Chrome’s main menu then choose “Settings“.
    Reset Browser Chrome 1
    Reset Browser Chrome 1
  • Scroll to the bottom of the page and click on “Advanced”.
    Reset Browser Chrome 2
    Reset Browser Chrome 2
  • Under the Advanced page, go for “Reset and clean up” section, then click on “Reset settings to their original defaults”.
    Reset Browser Chrome 3
    Reset Browser Chrome 3
  • Next, click on “Reset”, you will be prompted for a confirmation This will reset your startup page, a new tab page, search engine, and pinned tabs. It will also disable all extensions and clear temporary data like cookies. Your bookmarks, history, and saved passwords will not be cleared”
  • Click on the “Reset Settings” button to confirm the procedure.
    Reset Browser Chrome 4
    Reset Browser Chrome 4
  • After that, it may ask to restart your browser, click “Yes”.

About the author

UnboxHow Team

If you have come this far, it means that you liked what you are reading. Why not reach little more and connect with us directly on Google Plus, Facebook or Twitter. We would love to hear your thoughts and opinions on our articles directly.

Add Comment

Click here to post a comment