How to remove iCalc adware from Google Chrome, Mozilla Firefox and Internet Explorer

iCalc is a malicious extension that was found in Google Chrome Web Store. This malware add-on once installed, secretly created proxy and redirected all users to sponsored web sites. Therefore, iCalc can be considered as an adware which in addition to written above also demonstrated an annoying obsession, requiring the installation.

Despite the name, extension iCalc – is not a calculator. Instead, when this adware is installed, it creates a proxy and drives all the traffic of the victim through the bestex9.xyz domain. Obviously, the attackers were selling the data collected from the victims to the advertisers. iCalc adware is also able to communicate with the command server located on the same domain to obtain additional commands at regular intervals of time.

iCalc adware extension installation process is quite interesting. The extension for the Chrome browser in many respects similar to the application for Android, at least, installation process is quite similar. Same as in the mobile operating system, the user has to manually approve the installation of the add-on, after reading the permissions that the add-on requests, and accept them. Since many users do not fully understand, what program wants from them, cyber criminals are actively exploiting social engineering aggressive techniques to spread their malware.

For the first time we faced iCalc by coincidence, after clicking on a pop-up advertisement which was distributing this adware. Clicking on the banner redirected us to the malicious website, which was not easy to leave. The web page was spawning numerous pop-up windows, offering to install the malicious extension. Whenever we tried to close one window, the new one appeared and so on. Moreover, when we tried to move the cursor to URL address bar or to close the browser, another, much bigger dialog box appeared. Also, the malicious website during all the time that we spent there was playing an audio message as follows: “Click on the “Add” button to install the extension”. We were able to leave the page only by killing the browser process via the Task Manager. Unfortunately, most ordinary users click “Add” button and install the iCalc adware. During the installation the extension honestly reporting that it will view and modify all the information on the websites that user visits, but it doesn’t stop novice users, they simply not paying attention.

iCalc adware was presented in the official Web Store. Although, the “calculator” had no reviews or ratings, it still managed to get downloaded by more than 1000 people. Currently, Google has removed the dangerous adware from the store. However, infected users cannot that simply remove this adware from their browsers. If you want to get rid of iCalc adware from your computer, simply follow the removal guide written below or download our automatic removal tool.