Trojan IRC/Backdor.SdBot4.FRV POP-UP Scam (Mac)

Also Known As: "Trojan IRC/Backdor.SdBot4.FRV" virus
Type: Mac Virus
Distribution: Low
Damage level: Medium

How to remove "Trojan IRC/Backdor.SdBot4.FRV" from Mac?

What is "Trojan IRC/Backdor.SdBot4.FRV"?

"Trojan IRC/Backdor.SdBot4.FRV" is a fake virus alert that appears only when some scam website is visited. Scammers use it to trick people into downloading unwanted application called MacRepair that supposed to remove detected viruses. We strongly recommend not to trust this scam. However, if this website was opened unintentionally, it is very likely that it was done by installed potentially unwanted application (PUA). Apps of this type usually cause unwanted redirects, deliver intrusive ads and collect various data.

Trojan IRC/Backdor.SdBot4.FRV scam

When opened, this scam website shows a pop-up window saying that it has detected a Trojan ("Trojan IRC/Backdoor.SdBot4.FRV") installed on its visitor's Mac computer. It encourages to take immediate action (to remove it). Once this pop-up is closed, this scam page display another pop-up which includes "security recommendations" for Mac computers. In order to make sure that none of user's sensitive data such banking information, passwords, private files and other data is exposed, it suggests users to scan their Macs for viruses. It recommends to use a Mac security utility (MacRepair) which can be downloaded by clicking the "Start Now" button. It is worth mentioning that this software is not free, in order to use its all features users must to activate (purchase) it. However, we strongly recommend not to trust apps that are promoted via various deceptive websites.

It is very likely that this scam website and other unreliable pages are opened by PUAs that users have unintentionally installed on their browsers (or Macs). In addition to unwanted redirects, apps of this type usually target user's data such URLs of visited websites, entered search queries, IP addresses, geolocations and so on. Typically, PUAs target browsing-related data, however, sometimes they gather personal details as well. Besides, their developers share all of it with other parties (potentially, cyber criminals) who misuse it to generate revenue. Furthermore, many unwanted apps of this type feed their users with various ads (coupons, banners, surveys, pop-up ads and so on). These ads (when clicked) cause redirects to untrustworthy pages or trigger downloads and installations of other unwanted applications.

Threat Summary:
Name "Trojan IRC/Backdor.SdBot4.FRV" virus
Threat Type Mac malware, Mac virus
Symptoms Your Mac became slower than normal, you see unwanted pop-up ads, you get redirected to shady websites, you notice presence of questionable apps.
Distribution methods Deceptive pop-up ads, free software installers (bundling), fake flash player installers, torrent file downloads, potentially unwanted applications.
Damage Internet browsing tracking (potential privacy issues), displaying of unwanted ads, redirects to shady websites, loss of private information, installation of potentially unwanted applications, financial losses.
Removal

To eliminate Trojan IRC/Backdor.SdBot4.FRV virus our malware researchers recommend scanning your computer with Combo Cleaner.
▼ Download Combo Cleaner
Free scanner checks if your computer is infected. To remove malware, you have to purchase the full version of Combo Cleaner.

This scam (fake virus alert) is very similar to other scams of this type such as "Your Mac Is Heavily Damaged! (33.2%)", "Virus Found Apple Message", "Mac OS X Is Infected (4) By Viruses" and many others. What most of these scams have in common is that they are designed to make people believe that their computers are infected, have some errors and so on. Scammers use such deceptive websites to trick people into downloading some potentially unwanted apps that supposed to fix/remove occurred problems. However, neither these websites or apps promoted on them can be trusted.

How did potentially unwanted applications install on my computer?

Most users cause downloads and installations of PUAs unwillingly/unintentionally: either by clicking various deceptive ads or when software developers use a "bundling" method. Bundling is a marketing method used by software developers who attempt to trick users into downloading/installing potentially unwanted applications together with some other, usually free software. They do not disclose information about unwanted apps being included in installation/download setups properly, they hide them in "Custom"/"Advanced" options or settings. There are many users who skip the download/installation steps without checking any available settings. That is the most common reason behind unintentional downloads and installations of various PUAs.

How to avoid installation of potentially unwanted applications?

Avoid downloading software from some untrustworthy and unofficial websites, using various third party software downloaders, Peer-to-Peer networks and so on. Use only direct links and official, trustworthy websites for that. Do not skip the steps of any software download or installation setup without checking the "Custom", "Advanced" and other similar settings or options. Opt-out all additionally included, unwanted apps and only then proceed to the next step or finish the download or/and installation procedure. Avoid clicking ads displayed on questionable pages. Typically, intrusive ads redirect users to dubious and potentially malicious websites (such as gambling, pornography, adult dating and so on). If you encounter such advertisements (or/and redirects caused by them), check the list of installed applications (extensions, add-ons, plug-ins) on your web browser and remove all unwanted entries as soon as possible. Check the list of installed programs on your computer (operating system) too. If your computer is already infected with PUAs, we recommend running a scan with Combo Cleaner Antivirus for macOS to automatically eliminate them.

Text presented in a pop-up window that appears once the scam website is visited:

IMMEDIATE ACTION REQUIRED

We have detected a trojan virus (Trojan IRC/Backdor.SdBot4.FRV) on your Mac.

Screenshot of a deceptive website (its pop-up window) encouraging its visitors to download the MacRepair potentially unwanted app:

deceptive website encouraging users to download MacRepair app

Text presented in this pop-up window:

Security Recommendation for Macs
Consider running a virus scan on your Mac.
Your system may be vulnerable after you visit risky websites.

Make sure that your sensitive data isn't exposed:
Secure your credit card details and banking information.
Protect your email password and other account passwords.
Safeguard your Facebook, Skype, AIM, and other chat logs.
Keep safe your private photos, family photos, and other files.
Ensure your webcam canít be accessed remotely.
We highly recommend using Mac security utility to detect and remove malware, adware, viruses, and suspicious apps.
How to Remove:
Step 1: Click the button below to download and install App.
Step 2: Run App and remove all potential viruses immediately.

Screenshot of the MacRepair installer:

MacRepair installer

Screenshot of the MacRepair application:

MacRepair application

Screenshot of MacRepair encouraging its users to activate (purchase) it:

MacRepair app encourages user to purchase it

Instant automatic removal of Trojan IRC/Backdor.SdBot4.FRV virus: Manual threat removal might be a lengthy and complicated process that requires advanced computer skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of Trojan IRC/Backdor.SdBot4.FRV virus. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner for Mac By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. Free scanner checks if your computer is infected. To remove malware, you have to purchase the full version of Combo Cleaner.

Quick menu:

Video showing how to remove potentially unwanted applications promoted via "Trojan IRC/Backdor.SdBot4.FRV" pop-up scam using Combo Cleaner:

Potentially unwanted applications removal:

Remove potentially unwanted applications from your "Applications" folder:

mac browser hijacker removal from applications folder

Click the Finder icon. In the Finder window, select "Applications". In the applications folder, look for "MPlayerX", "NicePlayer", or other suspicious applications and drag them to the Trash. After removing the potentially unwanted application(s) that cause online ads, scan your Mac for any remaining unwanted components.

Remove "trojan irc/backdor.sdbot4.frv" virus related files and folders:

Finder go to folder command

Click the Finder icon, from the menu bar. Choose Go, and click Go to Folder...

step1Check for adware-generated files in the /Library/LaunchAgents folder:

removing adware from launch agents folder step 1

In the Go to Folder... bar, type: /Library/LaunchAgents

removing adware from launch agents folder step 2
In the “LaunchAgents” folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - “installmac.AppRemoval.plist”, “myppes.download.plist”, “mykotlerino.ltvbit.plist”, “kuklorest.update.plist”, etc. Adware commonly installs several files with the same string.

step2Check for adware generated files in the /Library/Application Support folder:

removing adware from application support folder step 1

In the Go to Folder... bar, type: /Library/Application Support

removing adware from application support folder step 2
In the “Application Support” folder, look for any recently-added suspicious folders. For example, “MplayerX” or “NicePlayer”, and move these folders to the Trash.

step3Check for adware-generated files in the ~/Library/LaunchAgents folder:

removing adware from ~launch agents folder step 1


In the Go to Folder bar, type: ~/Library/LaunchAgents

removing adware from ~launch agents folder step 2

In the “LaunchAgents” folder, look for any recently-added suspicious files and move them to the Trash. Examples of files generated by adware - “installmac.AppRemoval.plist”, “myppes.download.plist”, “mykotlerino.ltvbit.plist”, “kuklorest.update.plist”, etc. Adware commonly installs several files with the same string.

step4Check for adware-generated files in the /Library/LaunchDaemons folder:

removing adware from launch daemons folder step 1
In the Go to Folder... bar, type: /Library/LaunchDaemons

removing adware from launch daemons folder step 2
In the “LaunchDaemons” folder, look for recently-added suspicious files. For example “com.aoudad.net-preferences.plist”, “com.myppes.net-preferences.plist”, "com.kuklorest.net-preferences.plist”, “com.avickUpd.plist”, etc., and move them to the Trash.

step 5 Scan your Mac with Combo Cleaner:

If you have followed all the steps in the correct order you Mac should be clean of infections. To be sure your system is not infected run a scan with Combo Cleaner Antivirus. Download it HERE. After downloading the file double click combocleaner.dmg installer, in the opened window drag and drop Combo Cleaner icon on top of the Applications icon. Now open your launchpad and click on the Combo Cleaner icon. Wait until Combo Cleaner updates it's virus definition database and click "Start Combo Scan" button.

scan-with-combo-cleaner-1

Combo Cleaner will scan your Mac for malware infections. If the antivirus scan displays "no threats found" - this means that you can continue with the removal guide, otherwise it's recommended to remove any found infections before continuing.

scan-with-combo-cleaner-2

After removing files and folders generated by the adware, continue to remove rogue extensions from your Internet browsers.

"Trojan IRC/Backdor.SdBot4.FRV" virus removal from Internet browsers:

safari browser iconRemove malicious extensions from Safari:

Remove "trojan irc/backdor.sdbot4.frv" virus related Safari extensions:

safari browser preferences

Open Safari browser, from the menu bar, select "Safari" and click "Preferences...".

safari extensions window

In the preferences window, select "Extensions" and look for any recently-installed suspicious extensions. When located, click the "Uninstall" button next to it/them. Note that you can safely uninstall all extensions from your Safari browser - none are crucial for normal browser operation.

  • If you continue to have problems with browser redirects and unwanted advertisements - Reset Safari.

firefox browser iconRemove malicious plug-ins from Mozilla Firefox:

Remove "trojan irc/backdor.sdbot4.frv" virus related Mozilla Firefox add-ons:

accessing mozilla firefox add-ons

Open your Mozilla Firefox browser. At the top right corner of the screen, click the "Open Menu" (three horizontal lines) button. From the opened menu, choose "Add-ons".

removing malicious add-ons from mozilla firefox

Choose the "Extensions" tab and look for any recently-installed suspicious add-ons. When located, click the "Remove" button next to it/them. Note that you can safely uninstall all extensions from your Mozilla Firefox browser - none are crucial for normal browser operation.

  • If you continue to have problems with browser redirects and unwanted advertisements - Reset Mozilla Firefox.

chrome-browser-iconRemove malicious extensions from Google Chrome:

Remove "trojan irc/backdor.sdbot4.frv" virus related Google Chrome add-ons:

removing malicious google chrome extensions step 1

Open Google Chrome and click the "Chrome menu" (three horizontal lines) button located in the top-right corner of the browser window. From the drop-down menu, choose "More Tools" and select "Extensions".

removing malicious Google Chrome extensions step 2

In the "Extensions" window, look for any recently-installed suspicious add-ons. When located, click the "Trash" button next to it/them. Note that you can safely uninstall all extensions from your Google Chrome browser - none are crucial for normal browser operation.

  • If you continue to have problems with browser redirects and unwanted advertisements - Reset Google Chrome.