Worthut is a browser hijacker. It takes control of Safari, Google Chrome, Mozilla Firefox and changes browser’s home page and a default search engine on Search.worthut.com.
When your Mac is infected, every time you start your browser, it will display a page Search.worthut.com. This page shows only advertising and sponsored links. As mentioned above, the browser hijacker changed the default search engine on the Search.worthut.com, so all your search queries will be redirected to this site. Thus the authors of the virus may collect the search terms of your queries, and redirect you to malicious websites.
Technically, Worthut hijacker is not a virus, but the virus behaves similarly. As a rootkit hides in the system, changes browser settings, and blocks them from changing. Also this browser hijacker can install additional browser addons, extensions and modules that will display advertising banners and popups.
How to Worthut infection get installed onto computer
Probably this browser hijacker get installed onto your Mac when you have installed a free software like PDF creator, video codec, etc. Because, most commonly Worthut malware is bundled within the installation packages from Softonic, Cnet, Soft32, Brothersoft or other similar web sites. So, read term of use and user agreement very carefully before installing any software or otherwise you can end up with another malicious software like Worthut hijacker on your Mac.
Symptoms of Worthut infection
- Worthut hijacks your web browser homepage, default search engine and browser shortcuts.
- Internet Searches are redirected to Search.worthut.com
- Internet may be slow.
How to remove Worthut from Mac (Step-by-step instructions)
The following instructions is a full step-by-step guide, which will help you to remove Worthut hijacker from Safari, Mozilla Firefox and Google Chrome. Moreover, the steps below will help you to uninstall potentially unwanted software such as adware and toolbars that your Mac may be infected. Please do the instructions step by step. If you need a help or have any questions, then ask for our assistance here or type a comment below.
1. Uninstall Worthut
Open Finder and click Applications.
Look for Worthut, right click to it and select Move to Trash or drag the Worthut from the Applications folder to the Trash. Most important, scroll through the all list, and move to trash any unknown applications. Don’t forget, choose Finder -> Empty Trash.
2. Remove Worthut hijacker and malicious extensions from Firefox, Safari and Chrome
Click Safai menu and select Preferences.
It will open the Safari Preferences window. Next, click the Extensions tab. Look for Worthut on left panel, select it, then click on the Uninstall button.Most important to remove all unknown extensions from Safari.
Once complete, click General tab. Change the Default Search Engine to Google.
Find the Homepage and type into textfield “https://www.google.com”.
Open Firefox. Type into the address bar about:support
Press Enter. It will open the Troubleshooting Information screen as shown below.
Click on the Reset Firefox button. It will open the confirmation prompt. Click to Reset Firefox button once again.
Click on Chrome’s main menu button () and select Settings option as shown below.
It will open the Chrome settings screen. Scroll to the bottom of the screen and click on the Show advanced settings (look the example below).
Chrome’s advanced settings should now be displayed. Scroll down until the Reset browser settings. Next, click on the Reset browser settings button. It will open the confirmation prompt. Click to Reset button to continue.
3. Remove Worthut related files and registry keys with MalwareBytes Anti-malware
Download MalwareBytes Anti-malware (MBAM) from the link below.
Once downloaded, click on the Scan button to start a system scan like a shown below.
When the scan is finished, make sure all entries have “checkmark” and click Remove Selected Items button. MalwareBytes Anti-malware for Mac will start to remove all malicious files and folders.
Your Mac should now be free of Worthut. If you need help with the instructions, then ask for help here.