E.tre456_worm_osx Trojan Virus POP-UP Scam (Mac)

Also Known As: "e.tre456_worm_osx Trojan Virus" virus
Type: Mac Virus
Distribution: Moderate
Damage level: Medium

How to remove e.tre456_worm_osx Trojan Virus from Mac?

What is e.tre456_worm_osx Trojan Virus?

"e.tre456_worm_osx Trojan Virus" is a fake error message similar to Website You Visited Infected Your Mac With A Virus, Apologies For Interruption!, and many others. It is displayed by various deceptive websites. Most users visit theses sites inadvertently - they are redirected by potentially unwanted applications (PUAs) that infiltrate systems without permission or intrusive ads generated by other dubious sites. Research shows that, in addition to redirects, potentially unwanted applications record sensitive data and deliver intrusive advertisements.

e.tre456_worm_osx Trojan Virus scam

After visiting this website, users are presented with pop-up messages stating that their computers are infected. The sites then perform a fake system scan and display "more detailed" information regarding the infection. It is stated that the malware must be eliminated immediately. Therefore, users are encouraged to download and install a 'malware removal tool' called Advanced Mac Cleaner. This is a scam. Your computer is probably optimized and virus free. The "e.tre456_worm_osx Trojan Virus" error is used only to trick gullible users into downloading and installing dubious software. After scanning the system with e.tre456_worm_osx Trojan Virus, users are presented with many existing infections, however, since the 'free version' is not capable of eliminating these threats, users are encouraged to pay for the 'full version' of this rogue software. Be aware, however, that fake errors often proliferate "anti-virus" suites that generate 'false positives' just to promote in-app purchases. For these reasons, the "e.tre456_worm_osx Trojan Virus" error should be ignored. It can be removed simply by closing the browser, however, some rogue sites employ scripts that disable closing of browsing tabs/windows. In these cases, terminate the browser via Activity Monitor or simply reboot the system. After re-running the browser, do not restore the previous session, otherwise you will return to the malicious site.

As mentioned above, potentially unwanted applications are known to gather sensitive information. The list of collected data types includes (but is not limited to) queries entered into search engines, pages viewed, website URLs visited, keystrokes, Internet Protocol (IP) addresses, and geo-locations. Recorded information usually includes personal details that developers share with third parties (potentially, cyber criminals). These people misuse private information to generate revenue. Therefore, having information-tracking apps installed on your computer can lead to serious privacy issues. Most PUAs also deliver intrusive advertisements, which are very likely to redirect to dubious websites and execute scripts that download/install other potentially unwanted applications or even malware. Therefore, clicking them risks system infection. These advertisements are delivered using tools that enable placement of third party graphical content on any visited website. Therefore, they often conceal website content. As well as posing threat to your web browsing safety, these ads diminish the browsing experience. You are strongly advised to eliminate all potentially unwanted applications immediately.

Threat Summary:
Name"e.tre456_worm_osx Trojan Virus" virus
Threat TypeMac malware, Mac virus
SymptomsYour Mac became slower than normal, you see unwanted pop-up ads, you get redirected to shady websites.
Distribution methodsDeceptive pop-up ads, free software installers (bundling), fake flash player installers, torrent file downloads.
DamageInternet browsing tracking (potential privacy issues), displaying of unwanted ads, redirects to shady websites, loss of private information.
Removal

To eliminate e.tre456_worm_osx Trojan Virus virus our malware researchers recommend scanning your computer with Combo Cleaner.
▼ Download Combo Cleaner
Free scanner checks if your computer is infected. To remove malware, you have to purchase the full version of Combo Cleaner.

As mentioned above, there are many fake errors such as "e.tre456_worm_osx Trojan Virus". All claim that the system is infected, missing files or damaged in other ways, however, these claims are merely attempts to extort money from unsuspecting users - the errors advertise paid services (fake tech support, which is not required) or paid applications. Generally, all PUAs are very similar. By offering "useful features", they attempt to give the impression of legitimacy, however, their only purpose is to generate revenue for the developers. Rather than giving any real value for regular users, potentially unwanted applications cause redirects, gather sensitive information, and deliver intrusive ads.

How did potentially unwanted applications install on my computer?

A small percentage of PUAs have official download/promotion websites. Most, however, infiltrate systems without users' consent, since developers proliferate them using intrusive advertising and "bundling" (stealth installation of third party applications together with regular [typically free] software) methods. Developers do not disclose "bundled" PUAs' installations properly - they hide them within "Custom/Advanced" settings (or other sections) of the download/installation processes. Furthermore, many users often click advertisements and skip most download/installation steps. In doing so, they expose their systems to risk of various infections and compromise their privacy.

How to avoid installation of potentially unwanted applications?

To prevent this situation, be very cautious when browsing the Internet and downloading/installing software. Carefully analyze each window of the download/installation dialogs and opt-out additionally-included programs. We recommend that you download programs from official sources only, using direct download links. Third party downloaders/installers often promote rogue apps, and thus these tools should never be used. Remember that developers invest many resources into intrusive ad design, thereby making them seem legitimate, but most redirect to dubious websites (pornography, adult dating, survey, and so on). If you encounter these redirects, check the list of installed applications/browser plug-ins and eliminate any suspicious entries. The key to computer safety is caution. If your computer is already infected with PUAs, we recommend running a scan with Combo Cleaner Antivirus for macOS to automatically eliminate them.

Appearance of "e.tre456_worm_osx Trojan Virus" scam (GIF):

Appearance of e.tre456_worm_osx Trojan Virus scam (GIF)

Text presented in this fake error:

We have detected a trojan virus (e.tre456_worm_osx) on your Mac. Press OK to begin the repair process.

Your system is infected with 3 viruses!

Your Mac is infected with 3 viruses. Our security check found traces of 2 malware and 1 phishing/spyware. System damage: 28.1% - Immediate removal required!

The immediate removal of the viruses is required to prevent further system damage, loss of Apps, Photos or other files.
Traces of 1 phishing/spyware were found on your Mac with OSX.

Personal and banking information are at risk.

To avoid more damage click on 'Scan Now' immediately. Our deep scan will provide help immediately!
0 minute and 0 seconds remaining before damage is permanent.

Deceptive website displaying fake scan results:

E.tre456_worm_osx Trojan Virus fake scan

Text presented in this page:

Your Mac is heavily damaged! (33.2%)
Please download the Advanced MacCleaner application to remove 3 Viruses from Mac.
VIRUS INFORMATION
Virus Name: Tapsnake, CronDNS, Dubfishicv
Risk: High
Infected Files: /os/apps/hidden/os-component/X/snace.icv;/local/conf/keyboard/retype.icv...

Update 17 December, 2018 - Crooks have released an updated version of websites that display "e.tre456_worm_osx Trojan Virus" pop-up:

Screenshot of the pop-up:

e.tre456_worm_osx Trojan Virus pop-up

Screenshot of the website:

e.tre456_worm_osx Trojan Virus website

Text presented in the pop-up and website:

IMMEDIATE ACTION REQUIRED

We have detected a trojan virus (e.tre456_worm_osx) on your Mac.

Press OK to begin the repair process.

 

-------------------------


Your MacOS 10.14 Mojave
is infected with 3 viruses!
Monday December 17, 2018 12:57 PM

Your Mac is infected with 3 viruses. Our security check found traces of 2 malware and 1 phishing/spyware. System damage: 28.1% - Immediate removal required!

The immediate removal of the viruses is required to prevent further system damage, loss of Apps, Photos or other files. Traces of 1 phishing/spyware were found on your Mac with OSX.

To avoid more damage click on 'Scan Now' immediately. Our deep scan will provide help immediately!

4 minute and 29 seconds remaining before damage is permanent.

Screenshot of website displaying fake scan results (at the time of research the site was promoting Mac Cleanup Pro unwanted application):

e.tre456_worm_osx Trojan Virus fake scan results

Text presented within this site:

DOWNLOAD REQUIRED
Your Mac is heavily damaged! (33.2%)
Please download the Advanced Mac Cleaner application to remove 3 Viruses from your Mac.
VIRUS INFORMATION
Virus Name: Tapsnake; CronDNS; Dubfishicv
Risk: HIGH
Infected Files: /os/apps/hidden/os-component/X/snake.icv; /os/local/conf/keyboard/retype.icv...
REMOVE VIRUSES NOW
VIRUS REMOVAL
Application: Advanced Mac Cleaner
Rating: 9.9/10
Price: Free

Appearance of the new variant of "e.tre456_worm_osx Trojan Virus" pop-up scam (GIF):

e.tre456_worm_osx Trojan Virus pop-up scam GIF

Instant automatic removal of e.tre456_worm_osx Trojan Virus virus: Manual threat removal might be a lengthy and complicated process that requires advanced computer skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of e.tre456_worm_osx Trojan Virus virus. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner for Mac By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. Free scanner checks if your computer is infected. To remove malware, you have to purchase the full version of Combo Cleaner.

Quick menu:

Video showing how to remove adware and browser hijackers from a Mac computer:

Potentially unwanted applications removal:

Remove potentially unwanted applications from your "Applications" folder:

mac adware removal from applications folder

Click the Finder icon. In the Finder window, select “Applications”. In the applications folder, look for “MPlayerX”,“NicePlayer”, or other suspicious applications and drag them to the Trash. After removing the potentially unwanted application(s) that cause online ads, scan your Mac for any remaining unwanted components.

Remove "e.tre456_worm_osx trojan virus" virus related files and folders:

Finder go to folder command

Click the Finder icon, from the menu bar. Choose Go, and click Go to Folder...

step1Check for adware-generated files in the /Library/LaunchAgents folder:

removing adware from launch agents folder step 1

In the Go to Folder... bar, type: /Library/LaunchAgents

removing adware from launch agents folder step 2
In the “LaunchAgents” folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - “installmac.AppRemoval.plist”, “myppes.download.plist”, “mykotlerino.ltvbit.plist”, “kuklorest.update.plist”, etc. Adware commonly installs several files with the same string.

step2Check for adware generated files in the /Library/Application Support folder:

removing adware from application support folder step 1

In the Go to Folder... bar, type: /Library/Application Support

removing adware from application support folder step 2
In the “Application Support” folder, look for any recently-added suspicious folders. For example, “MplayerX” or “NicePlayer”, and move these folders to the Trash.

step3Check for adware-generated files in the ~/Library/LaunchAgents folder:

removing adware from ~launch agents folder step 1


In the Go to Folder bar, type: ~/Library/LaunchAgents

removing adware from ~launch agents folder step 2

In the “LaunchAgents” folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - “installmac.AppRemoval.plist”, “myppes.download.plist”, “mykotlerino.ltvbit.plist”, “kuklorest.update.plist”, etc. Adware commonly installs several files with the same string.

step4Check for adware-generated files in the /Library/LaunchDaemons folder:

removing adware from launch daemons folder step 1
In the Go to Folder... bar, type: /Library/LaunchDaemons

removing adware from launch daemons folder step 2
In the “LaunchDaemons” folder, look for recently-added suspicious files. For example “com.aoudad.net-preferences.plist”, “com.myppes.net-preferences.plist”, "com.kuklorest.net-preferences.plist”, “com.avickUpd.plist”, etc., and move them to the Trash.

step 5 Scan your Mac with Combo Cleaner:

If you have followed all the steps in the correct order you Mac should be clean of infections. To be sure your system is not infected run a scan with Combo Cleaner Antivirus. Download it HERE. After downloading the file double click combocleaner.dmg installer, in the opened window drag and drop Combo Cleaner icon on top of the Applications icon. Now open your launchpad and click on the Combo Cleaner icon. Wait until Combo Cleaner updates it's virus definition database and click "Start Combo Scan" button.

scan-with-combo-cleaner-1

Combo Cleaner will scan your Mac for malware infections. If the antivirus scan displays "no threats found" - this means that you can continue with the removal guide, otherwise it's recommended to remove any found infections before continuing.

scan-with-combo-cleaner-2

After removing files and folders generated by the adware, continue to remove rogue extensions from your Internet browsers.

"e.tre456_worm_osx Trojan Virus" virus removal from Internet browsers:

safari browser iconRemove malicious extensions from Safari:

Remove "e.tre456_worm_osx trojan virus" virus related Safari extensions:

safari browser preferences

Open Safari browser, from the menu bar, select "Safari" and click "Preferences...".

safari extensions window

In the preferences window, select "Extensions" and look for any recently-installed suspicious extensions. When located, click the "Uninstall" button next to it/them. Note that you can safely uninstall all extensions from your Safari browser - none are crucial for normal browser operation.

  • If you continue to have problems with browser redirects and unwanted advertisements - Reset Safari.

firefox browser iconRemove malicious plug-ins from Mozilla Firefox:

Remove "e.tre456_worm_osx trojan virus" virus related Mozilla Firefox add-ons:

accessing mozilla firefox add-ons

Open your Mozilla Firefox browser. At the top right corner of the screen, click the "Open Menu" (three horizontal lines) button. From the opened menu, choose "Add-ons".

removing malicious add-ons from mozilla firefox

Choose the "Extensions" tab and look for any recently-installed suspicious add-ons. When located, click the "Remove" button next to it/them. Note that you can safely uninstall all extensions from your Mozilla Firefox browser - none are crucial for normal browser operation.

  • If you continue to have problems with browser redirects and unwanted advertisements - Reset Mozilla Firefox.

chrome-browser-iconRemove malicious extensions from Google Chrome:

Remove "e.tre456_worm_osx trojan virus" virus related Google Chrome add-ons:

removing malicious google chrome extensions step 1

Open Google Chrome and click the "Chrome menu" (three horizontal lines) button located in the top-right corner of the browser window. From the drop-down menu, choose "More Tools" and select "Extensions".

removing malicious Google Chrome extensions step 2

In the "Extensions" window, look for any recently-installed suspicious add-ons. When located, click the "Trash" button next to it/them. Note that you can safely uninstall all extensions from your Google Chrome browser - none are crucial for normal browser operation.

  • If you continue to have problems with browser redirects and unwanted advertisements - Reset Google Chrome.

About the author:

Tomas Meskauskas

Tomas Meskauskas - expert security researcher, professional malware analyst.

I am passionate about computer security and technology. I have an experience of over 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an author and editor for pcrisk.com since 2010. Follow me on Twitter and LinkedIn to stay informed about the latest online security threats. Contact Tomas Meskauskas.

PCrisk security portal is brought by a company RCS LT. Joined forces of security researchers help educate computer users about the latest online security threats. More information about the company RCS LT.

Our malware removal guides are free. However, if you want to support us you can send us a donation.

Removal Instructions in other languages
Malware activity

Global virus and spyware activity level today:

Medium threat activity
Medium

Increased attack rate of infections detected within the last 24 hours.

QR Code
e.tre456_worm_osx Trojan Virus virus QR code
A QR code (Quick Response Code) is a machine-readable code which stores URLs and other information. This code can be read using a camera on a smartphone or a tablet. Scan this QR code to have an easy access removal guide of "e.tre456_worm_osx Trojan Virus" virus on your mobile device.
We Recommend:

Get rid of e.tre456_worm_osx Trojan Virus virus today:

▼ REMOVE IT NOW with Combo Cleaner for Mac

Platform: macOS

Editors' Rating for Combo Cleaner:
Editors ratingOutstanding!

[Back to Top]

Free scanner checks if your computer is infected. To remove malware, you have to purchase the full version of Combo Cleaner.