UpgradeAgent Hijacker - How to remove

UpgradeAgent hijacker (UpgradeAgent.app) infects macOS devices through fake software updates. Trying to delete it normally doesn’t work – it comes back the next time you restart your Mac. And while UpgradeAgent hijacker is installed, it keeps changing your default search engine. Removing UpgradeAgent hijacker requires finding and removing files related to UpgradeAgent hijacker or using an antivirus program.

There are some legitimate products, programs, and functions called UpgradeAgent, and these aren’t what this post is about. The UpgradeAgent hijacker should not negatively reflect on those legitimate applications.

In short about UpgradeAgent hijacker:

Type of threat	Adware, browser hijacker.
Distribution and installation	Advertised by adware viruses, advertised by malicious ads and on infected websites.
Symptoms	Changed default browser search, unwanted apps come back after being deleted, apps crash or stop working, excessive pop-up ads appear.
Removing UpgradeAgent hijacker	Use an antivirus scanner (Combo Cleaner, etc.) to remove malicious files, delete the files that are related to UpgradeAgent hijacker.

How UpgradeAgent gets installed

Most likely, UpgradeAgent hijacker was downloaded in an adware bundle. In the last few months, fake Adobe Flash and macOS update warnings have been used again and again to spread similar malware (SkilledDeskSearch, BrowserProduct, etc.), so they can be suspected to be responsible for UpgradeAgent, too.

Fake software update warnings are designed to look like real macOS system windows and dialogs, and they’re so well-made that they trick a lot of people into thinking that these warnings are real. In reality, these are websites that download adware bundles.

These fake warnings appear as ads on infected websites, which include small, niche sites, as well as old websites. Cybercriminals infect sites with malicious code that causes visitors like us to be redirected to malicious ads. The owners of these infected sites don’t have the resources to catch and stop the infections. Sometimes they don’t even know about the problem.

Adware viruses can also end with a UpgradeAgent hijacker infection. They often push dangerous, even illegal ads.

Once UpgradeAgent hijacker is downloaded and installed, it appears as an app (you can find it in your Applications folder), as well as a browser extension. UpgradeAgent hijacker opens with your browsers and appears in the dock, but it doesn’t appear to do anything. The UpgradeAgent extension, if you check it in browser settings, can read your data on the websites that you visit, which includes usernames, passwords, and other sensitive data.

Infection symptoms

UpgradeAgent hijacker can have some different effects of different Macs, so you might not experience all these symptoms, but it can:

• hijack browser settings, changing your default search engine,
• cause some online applications to crash,
• cause the internet connection to drop,
• install adware that shows pop-up ads.

UpgradeAgent hijacker can come back after being deleted because there are some files that cause the malware to start up every time you log in. These files might not be called “UpgradeAgent”, they might be called “AphroditeResults”, “SoloProcess”, “SystemExtr”, etc. UpgradeAgent hijacker might change its name sometimes, and so the files on your system are named differently from the app.

UpgradeAgent hijacker’s files can be found in ~/Library/LaunchAgents, ~/Library/Application Support, /Library/Application Support, and /Library/LaunchDaemons. To open these folders, you can use the “Go to Folder” dialog, which is found in the Go menu of Finder. The name of a folder should be copied or typed in exactly, the tilde is important.

While UpgradeAgent hijacker is installed, you should check your System Preferences for unfamiliar profiles. The Profiles section only appears in System Preferences when you have a Profile. Profiles are present on Macs that are in some way managed by an organization or an administrator. A mac lent to you by your job or school will have profiles on it. But this can be abused by malicious programs to make unwanted changes to your computer.

How to remove UpgradeAgent hijacker

The easiest way to get rid of UpgradeAgent hijacker is to use an anti-malware program, such as Combo Cleaner or another app – pick one that you trust and that has a good reputation.

Or you can manually remove the Profiles and files that were mentioned in the previous section that are causing UpgradeAgent hijacker to be restarted. Once you have deleted those files, remove the UpgradeAgent hijacker app and browser extension.

Then, restart your Mac and see if the issue comes back. If it does, scan your computer with a security program. If the issue keeps coming back, you may need to seek the help of an IT specialist. Or you can post a comment below this post and we will do our best to help you.

Automatic Malware removal tools

Manually remove browser extensions

TopRemoving UpgradeAgent Hijacker from Safari (Mac OS X)

• Click on the Safari menu.
• Choose Preferences.
  
• Click on the Extensions Tab.
• Click on the Uninstall button near the UpgradeAgent. Remove all other unknown or suspicious entries too. If you are not sure whether you need the extension or not, you can simply uncheck the Enable check-box to disable the extension temporarily.
  
• Restart Safari.

(Optional) Reset your browser’s settings

If you are still experiencing any issues related to UpgradeAgent Hijacker, reset the settings of your browser to its default settings.

• Click on the Safari menu on the top left corner of the screen. Select Reset Safari.
  
• Select which options you want to reset (usually all of them come preselected) and click on the Reset button.
  

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program.

TopRemoving UpgradeAgent from Chrome

• Click on the menu button on the top right corner of a Google Chrome window. Select “Settings”.
  
• Click “Extensions” on the left menu bar.
• Go through the extensions list and remove programs you do not need, especially similar to UpgradeAgent Hijacker. Click on the trash bin icon next to UpgradeAgent or other add-ons you want to remove.
  
• Press on the “Remove” button on the Confirmation window.
  
• If unsure, you can disable them temporarily.
  
• Restart Chrome.

(Optional) Reset your browser’s settings

If you are still experiencing any issues related to UpgradeAgent Hijacker, reset the settings of your browser to its default settings.

• Click on Chrome’s menu button (three horizontal lines) and select Settings.
  
• Scroll to the end of the page and click on the Reset settings button.
  
• Click on the Reset button on the confirmation box.
  

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program.

TopRemoving UpgradeAgent from Firefox

• Click on the menu button on the top right corner of a Mozilla window and select the “Add-ons” icon (or press Ctrl+Shift+A on your keyboard).
  
• Go through Extensions and Addons list, remove everything UpgradeAgent Hijacker related and items you do not recognise. If you do not know the extension and it is not made by Mozilla, Google, Microsoft, Oracle or Adobe then you probably do not need it.
  

(Optional) Reset your browser’s settings If you are still experiencing any issues related to UpgradeAgent, reset the settings of your browser to its default settings.

• Click on the menu button on the top right corner of a Mozilla Firefox window. Click on the Help button.
  
• Choose Troubleshooting Information on the Help menu.
  
• Click on the Reset Firefox button.
  
• Click on the Reset Firefox button on the confirmation box. Mozilla Firefox will close and change the settings to default.
  

If you cannot reset your browser settings and the problem persists, scan your system with an anti-malware program.