ConnectionFormat is a malicious app that changes browser settings and installs unwanted extensions. It is dangerous enough that multiple anti-malware programs flag it as Adware, Malicious, Adload, and Adagent: Virustotal.com. It should be removed as soon as possible: ConnectionFormat’s files need to be deleted and the settings that it hijacked need to be fixed.
Connectionformat Malware quicklinks
- How to remove ConnectionFormat
- Delete malicious files
- Restore settings
- How ConnectionFormat works
- How adware spreads
- Automatic Malware removal tools
- Restore browser settings
- How To remove ConnectionFormat Malware from Firefox on Mac OS:
ConnectionFormat in short:
|How to remove ConnectionFormat||Delete malicious files and apps manually and with an anti-malware app (Combo Cleaner, Malwarebytes, others),
restore macOS and browser settings.
|How ConnectionFormat affects your Mac||It changes how web browsers behave, forcing them to open shady websites.|
|How malware spreads||Promoted by deceptive ads on infected websites,
downloaded and installed while deceiving the victim.
How to remove ConnectionFormat
Removing ConnectionFormat might take a bit of effort but it’s worth it. Here are the two things that you need to do:
- Find and delete malicious files.
- Check and fix macOS and browser settings.
Delete malicious files
Start your Mac in safe mode (Support.apple.com). This will stop ConnectionFormat and other malware from running until the next time you reboot.
Search for malicious files yourself, too, by opening Finder, Go, Computer, searching for “ConnectionFormat”, and deleting the items that are found. Including the ConnectionFormat app and various plist files.
You can also check hidden library folders by opening Finder, Go, Go to Folder, and navigating to these folders: ~/Library/LaunchAgents, ~/Library/Application Support, /Library/Application Support, /Library/LaunchDaemons. Some of the files in these folders belong to your normal apps and programs, but others may be malicious. Especially those whose date of being added matches the date that ConnectionFormat appeared on your Mac. Figuring out which ones are which might be a little imprecise, so an anti-malware scan is recommended alongside your human judgment.
Malware on Mac has a few ways to root itself in, hiding its files in hidden folders is one of them.
Also, go to System Preferences, Users & Groups, Login Items, and remove all the unwanted or unfamiliar items.
Besides malicious files exist malicious settings, such as configuration profiles. These are often used by malware to hijack macOS settings. Go to System Preferences, find Profiles. If the icon is there, click in and remove all the items that you or your administrator did not add.
Another thing that ConnectionFormat might have done is set up a Socks proxy to hijack your internet traffic. In System Preferences, click Network, Advanced, Proxies. If something doesn’t look right (if there’s a proxy configured but you did not do it), then undo it and click OK.
The instructions to fix browser settings can be found below.
How ConnectionFormat works
ConnectionFormat is a malicious Mac app:
- It installs browser extensions that spy on you, inject ads into webpages, and redirect internet searches.
- It changes the default search engine and the new tab page of the browser to some strange website like Searchmarquis, Safe Finder, or a randomly named site.
- It may try to hijack your Network settings.
- Even if the ConnectionFormat app and browser extension are deleted, they might come back in a few hours or days.
- Additional malware, including Mac “cleaner” apps and random browser extensions, may get installed.
Safari is most likely to be strongly affected by ConnectionFormat. But the other browsers (Chrome and Firefox) might be changed, too.
How adware spreads
Fake Flash updates and infected installers for free apps are ways in which adware like ConnectionFormat (as well as ExpandedSkill, NetModuleSearch, others). They appear on all kinds of websites, from free movie sites to legitimate but infected sites (malicious actors can infect sites with malicious code to cause redirects to other websites).
Once the malicious file is downloaded and run, it downloads and installs malware. But the way the installation and setup process is presented to you is meant to hide the maliciousness from you. That’s why victims of ConnectionFormat and similar malware often don’t know how they got infected.
Automatic Malware removal tools
Restore browser settings
How to remove ConnectionFormat Malware from Safari:TopRemove malicious extensions
- Click on Safari menu on the top left corner of the screen. Select Preferences.
- Select Extensions and uninstall ConnectionFormat Malware and other suspicious extensions.
- If your homepage was changed, click on Safari menu on the top left corner of the screen. Select Preferences and choose General tab. Enter preferable URL to the homepage field.
- Click on Safari menu on the top left corner of the screen. Select Reset Safari…
- Select which options you want to reset (usually all of them come preselected) and click on the Reset button.
TopHow to remove ConnectionFormat Malware from Google Chrome on Mac:
- Open Chrome browser.
- Enter in the url field “chrome://extensions” address and hit Enter.
- Find ConnectionFormat Malware on the extensions list and click on the recycle bin icon next to it.
- Click on 'Chrome' button at the top left corner. Select 'Preferences' on a drop-down menu box.
- Find 'Search' options on Settings tab. If your search engine is changed, click 'Manage Search Engines' and set your preferred search engine.
- On the same page find 'Show home button' checkbox and change your homepage.
- On the 'Preferences' menu window, scroll down to the bottom and find 'Reset settings' button. Click it.
- Confirm your selection and click 'Reset' on the following window.
How To remove ConnectionFormat Malware from Firefox on Mac OS:
- Click on the menu button on the top right corner of a Mozilla window and select the “Add-ons” icon (Or press cmd+Shift+A on your keyboard).
- Go through Extensions list, remove everything ConnectionFormat Malware related and items you do not recognise. If you do not know the extension and it is not made by Mozilla, Google, Microsoft, Oracle or Adobe then you probably do not need it.
- Enter “about:preferences” in URL bar and hit enter.
- Open Search settings tab.
- If your search engine is changed, click 'Default Search Engines' and set your preferred search engine.
- If your homepage was changed, click on the Firefox menu in the top right corner, select Preferences-> General. Enter a preferable URL to the home page field.
- Click on the menu button on the top right corner of a Mozilla Firefox window. Click on the Help button.
- Choose Troubleshooting Information on the Help menu.
- Click on the Refresh Firefox button.
- Click on the Refresh Firefox button on the confirmation box. Mozilla Firefox will close and change the settings to default.