AlphaRecord Adware - How to remove

AlphaRecord is a browser add-on that causes your browser to be “managed by your organization”. As a result, AlphaRecord can’t be uninstalled – at least, not in the same way as all browser extensions can be.

Once it’s in the browser, AlphaRecord takes over the browsers’ search settings and redirects search queries to potentially unwanted websites. It might also expose your search history to third parties.

About AlphaRecord:

Threat type	Adware, trojan, browser hijacker.
Problems caused by AlphaRecord	AlphaRecord managed your browser, preventing its own removal, it hijacks internet search, it does not protect users’ privacy.
How browser hijackers spread	Adware bundles install unwanted extensions, these bundles and downloaded from the internet, the download links are falsely, deceptively advertised online.
How to remove AlphaRecord	Manually review and change the settings that are hijacked by AlphaRecord, use anti-malware apps (Spyhunter for Mac, Malwarebytes, others) to find and delete other malware.

What is AlphaRecord?

AlphaRecord hijacks search settings

AlphaRecord is a browser add-on that hijacks the browser’s search settings. It’s similar to ProManagerRecord, DeployPlatform, wOfficeMusic, OpticalRatePro, OperativeBitUnit, and similar adware infections.

When AlphaRecord is installed on a browser, it changes how web search works on that browser:

• If you use Chrome’s default new tab page, it might look different. It might be missing the search box that is usually in the middle of the page.
• When you search the web from your browser’s address bar, the results are delivered by Yahoo or another unexpected site.
• In the UI of your browser, you might see messages that say that “Your browser is managed by your organization”.
• AlphaRecord stays under the radar. This add-on has no notable features. But you should still see this extension among your installed add-ons.

It abuses Chrome policies

Normally, browser extensions can be removed very easily by right-clicking their icons and choosing the “Remove” option.

But when your browser is managed by a policy, that policy can prevent some extensions from being removed. In this case, it’s AlphaRecord that’s stuck like a leech.

To confirm that it’s AlphaRecord that’s responsible for the “managed” state, type “chrome://policy/” (no quote marks) into your address bar and see what’s listed there.

It tracks user data

Naturally, as a search hijacker, AlphaRecord can track user data.

First, AlphaRecord sends user search queries to Search.2yhzsy.com. This website doesn’t make its privacy policy easily accessible, but if it wanted to, it could access people’s search queries.

This is a problem because search queries can include a lot of private information. Normally, search engines like Google and Bing encrypt traffic, which means that your search history is between you and them. And while that’s not perfect for privacy, these sites let you manage your search history and other data (for example, you can delete entries).

On the other hand, 2yhzsy.com is a random site with no presence on the web. Who knows what it does with the data that it collects.

Another problem is that Search.2yhzsy.com doesn’t load HTTPS by default. Instead, it opens HTTP. If that’s how it always works, this is a big privacy problem. It could let outsiders, such as your internet service provider, read your search queries.

How browser hijackers get installed

AlphaRecord doesn’t ask for permission to be installed. It infiltrates browsers by deceiving users.

Adware like AlphaRecord tends to spread with the help of fake ads:

• Fake Flash Player updates.
• Fake browser updates.
• Fake macOS updates.

These malicious ads appear on the internet, usually as new tab ads. They encourage you to download and install an app. This app is made to look trustworthy, but it’s actually full of adware.

Have you recently installed a suspicious app? It might have appeared to do nothing at all, which is pretty normal for malware.

It might be a good idea to limit new apps to only trusted ones, as described on Support.apple.com.

How to get rid of AlphaRecord

Deleting AlphaRecord is not as simple as uninstalling a browser extension. Not even reinstalling your browser might work.

AlphaRecord is persistent because it abuses enterprise policy. Check this post for more information on how you might get rid of such an add-on. You might need to access some of your system settings.

Since AlphaRecord is likely to attack Mac users, below are instructions for how to remove persistent malware from Macs. You might need to find and delete malicious profiles, startup items, check your network settings, and look in the hidden Library folders.

You might find anti-malware apps (Spyhunter for Mac, Malwarebytes, others) useful, as they can detect adware bundles and other potentially unwanted apps. Security apps can help you avoid adware infections.

But security apps might not be able to completely remove the AlphaRecord malware. You might need to do this yourself.

Automatic Malware removal tools

Delete malware manually

How to remove AlphaRecord Adware from macOS

Delete AlphaRecord Adware from your applications.

1. Open Finder.
2. In the menu bar, click Go.
3. Select Applications from the dropdown.
4. Find the AlphaRecord Adware app.
5. Select it and right-click it (or hold the Ctrl and click the left mouse button).
6. In the dropdown, click Move to Bin/Trash. You might be asked to provide your login password.

(Optional) Delete related settings

Some malicious apps make themselves difficult to delete by changing various settings and leaving behind malicious files. Remove settings related to AlphaRecord Adware.

• Click the Apple logo in the menu bar. Open System Preferences.
• Some malicious applications set profiles to enforce unwanted settings. Remove unwanted configuration profiles.

1. 1. In System Preferences, click the Profiles icon. This icon is only visible if there are profiles on your Mac.
   2. Select unwanted profiles and remove them by pressing the minus '-'  button at the bottom.

• Some adware applications set SOCKS proxy to manipulate your internet traffic. Remove unwanted proxies:

1. 1. In System Preferences, click Network, Advanced, Proxies.
   2. If a proxy is set without your permission, uncheck it and click OK.

(Optional) Delete malicious files

Some malicious apps leave behind dangerous files in your Library folders. Delete files related to AlphaRecord Adware.

1. Open Finder.
2. In the menu bar, click Go -> Computer.
3. In the search box, type in AlphaRecord Adware and variations of it.
4. Delete the files that are found and that seem to be related to AlphaRecord Adware.