ConnectionFormat Malware - How to remove

ConnectionFormat is a malicious app that changes browser settings and installs unwanted extensions. It is dangerous enough that multiple anti-malware programs flag it as Adware, Malicious, Adload, and Adagent: Virustotal.com. It should be removed as soon as possible: ConnectionFormat’s files need to be deleted and the settings that it hijacked need to be fixed.

ConnectionFormat in short:

Classification	Adware, browser hijacker.
How to remove ConnectionFormat	Delete malicious files and apps manually and with an anti-malware app (Combo Cleaner, Malwarebytes, others), restore macOS and browser settings.
How ConnectionFormat affects your Mac	It changes how web browsers behave, forcing them to open shady websites.
How malware spreads	Promoted by deceptive ads on infected websites, downloaded and installed while deceiving the victim.

How to remove ConnectionFormat

Removing ConnectionFormat might take a bit of effort but it’s worth it. Here are the two things that you need to do:

• Find and delete malicious files.
• Check and fix macOS and browser settings.

Delete malicious files

Start your Mac in safe mode (Support.apple.com). This will stop ConnectionFormat and other malware from running until the next time you reboot.

Now, you can use an anti-malware program like Combo Cleaner, Malwarebytes, and others to find and delete all suspicious, malicious, and potentially unwanted apps, programs, and their components.

Search for malicious files yourself, too, by opening Finder, Go, Computer, searching for “ConnectionFormat”, and deleting the items that are found. Including the ConnectionFormat app and various plist files.

You can also check hidden library folders by opening Finder, Go, Go to Folder, and navigating to these folders: ~/Library/LaunchAgents, ~/Library/Application Support, /Library/Application Support, /Library/LaunchDaemons. Some of the files in these folders belong to your normal apps and programs, but others may be malicious. Especially those whose date of being added matches the date that ConnectionFormat appeared on your Mac. Figuring out which ones are which might be a little imprecise, so an anti-malware scan is recommended alongside your human judgment.

Malware on Mac has a few ways to root itself in, hiding its files in hidden folders is one of them.

Also, go to System Preferences, Users & Groups, Login Items, and remove all the unwanted or unfamiliar items.

Restore settings

Besides malicious files exist malicious settings, such as configuration profiles. These are often used by malware to hijack macOS settings. Go to System Preferences, find Profiles. If the icon is there, click in and remove all the items that you or your administrator did not add.

Another thing that ConnectionFormat might have done is set up a Socks proxy to hijack your internet traffic. In System Preferences, click Network, Advanced, Proxies. If something doesn’t look right (if there’s a proxy configured but you did not do it), then undo it and click OK.

The instructions to fix browser settings can be found below.

How ConnectionFormat works

ConnectionFormat is a malicious Mac app:

• It installs browser extensions that spy on you, inject ads into webpages, and redirect internet searches.
• It changes the default search engine and the new tab page of the browser to some strange website like Searchmarquis, Safe Finder, or a randomly named site.
• It may try to hijack your Network settings.
• Even if the ConnectionFormat app and browser extension are deleted, they might come back in a few hours or days.
• Additional malware, including Mac “cleaner” apps and random browser extensions, may get installed.

Safari is most likely to be strongly affected by ConnectionFormat. But the other browsers (Chrome and Firefox) might be changed, too.

How adware spreads

Fake Flash updates and infected installers for free apps are ways in which adware like ConnectionFormat (as well as ExpandedSkill, NetModuleSearch, others). They appear on all kinds of websites, from free movie sites to legitimate but infected sites (malicious actors can infect sites with malicious code to cause redirects to other websites).

Once the malicious file is downloaded and run, it downloads and installs malware. But the way the installation and setup process is presented to you is meant to hide the maliciousness from you. That’s why victims of ConnectionFormat and similar malware often don’t know how they got infected.

Automatic Malware removal tools

Restore browser settings

How to remove ConnectionFormat Malware from Safari:Top

Remove malicious extensions

• Click on Safari menu on the top left corner of the screen. Select Preferences.
  
• Select Extensions and uninstall ConnectionFormat Malware and other suspicious extensions.
  
• If your homepage was changed, click on Safari menu on the top left corner of the screen. Select Preferences and choose General tab. Enter preferable URL to the homepage field.
  

(Optional) Reset your browser’s settings(older versions) If you are still experiencing any issues related to ConnectionFormat Malware, reset the settings of your browser to its default settings.

• Click on Safari menu on the top left corner of the screen. Select Reset Safari…
  
• Select which options you want to reset (usually all of them come preselected) and click on the Reset button.
  

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program.

TopHow to remove ConnectionFormat Malware from Google Chrome on Mac:

• Open Chrome browser.
• Enter in the url field “chrome://extensions” address and hit Enter.
• Find ConnectionFormat Malware on the extensions list and click on the recycle bin icon next to it.
• Click on 'Chrome' button at the top left corner. Select 'Preferences' on a drop-down menu box.
• Find 'Search' options on Settings tab. If your search engine is changed, click 'Manage Search Engines' and set your preferred search engine.
• On the same page find 'Show home button' checkbox and change your homepage.

(Optional) Reset your browser’s settings If you are still experiencing any issues related to ConnectionFormat Malware, reset the settings of your browser to its default settings.

• On the 'Preferences' menu window, scroll down to the bottom and find 'Reset settings' button. Click it.
• Confirm your selection and click 'Reset' on the following window.

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program. Top

How To remove ConnectionFormat Malware from Firefox on Mac OS:

• Click on the menu button on the top right corner of a Mozilla window and select the “Add-ons” icon (Or press cmd+Shift+A on your keyboard).
• Go through Extensions list, remove everything ConnectionFormat Malware related and items you do not recognise. If you do not know the extension and it is not made by Mozilla, Google, Microsoft, Oracle or Adobe then you probably do not need it.
• Enter “about:preferences” in URL bar and hit enter.
• Open Search settings tab.
• If your search engine is changed, click 'Default Search Engines' and set your preferred search engine.
• If your homepage was changed, click on the Firefox menu in the top right corner, select Preferences-> General. Enter a preferable URL to the home page field.

(Optional) Reset your browser’s settings If you are still experiencing any issues related to ConnectionFormat Malware, reset the settings of your browser to its default settings.

• Click on the menu button on the top right corner of a Mozilla Firefox window. Click on the Help button.
• Choose Troubleshooting Information on the Help menu.
• Click on the Refresh Firefox button.
• Click on the Refresh Firefox button on the confirmation box. Mozilla Firefox will close and change the settings to default.

If the problem persists, scan your system with an anti-malware program to identify malicious entries.