James Harris

Q: Safari linked to something called smart search.net

Hi,

I was recently looking for a media player to download and have inadvertantly added a new default search engine that I now cannot remove.

 

Even though I have changed the Safari preferences to use a homepage of google or apple.com it reverts back to a homepage of smart search.net

 

I now frequently get additional tabs opening with links to sites - usually Mackeeper and I get various advertisement bars at the top of pages like amazon or eBay.

 

My preferences are set to block pop ups and I have removed all history and caches that I know about but I assume there is some sort of setting within the OS somewhere that I need help with.

 

I am running the latest version of Yosemite.

 

Any help would be great

 

thanks

iMac, Mac OS X (10.6.7)

Posted on Jan 16, 2015 4:04 AM

Close

Q: Safari linked to something called smart search.net

  • All replies
  • Helpful answers

  • by stedman1,

    stedman1 stedman1 Jan 16, 2015 4:05 AM in response to James Harris
    Level 9 (73,345 points)
    Apple Watch
    Jan 16, 2015 4:05 AM in response to James Harris

    Check the links below for options to remove the Adware.

     

     

    The Easy, safe, effective method:

    http://www.adwaremedic.com/index.php

     

     

    If you are comfortable doing manual file removals use the somewhat more difficult method:

    http://support.apple.com/en-us/HT203987

     

     

    Also read the articles below to be more prepared for the next time there is an issue on your computer.

    https://discussions.apple.com/docs/DOC-7471

    https://discussions.apple.com/docs/DOC-8071

  • by James Harris,

    James Harris James Harris Jan 16, 2015 4:41 AM in response to stedman1
    Level 1 (5 points)
    Jan 16, 2015 4:41 AM in response to stedman1

    Thanks for the quick reply. I'll have a look and let you know.

  • by Linc Davis,Solvedanswer

    Linc Davis Linc Davis Jan 16, 2015 10:11 AM in response to James Harris
    Level 10 (207,926 points)
    Applications
    Jan 16, 2015 10:11 AM in response to James Harris

    There is no need to download anything to solve this problem. You may have installed a variant of the "VSearch" ad-injection malware.

    Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination  command-C:

    /Library/LaunchDaemons

    In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

    A folder named "LaunchDaemons" may open. Look inside it for a file with a name of the form

              com.something.daemon.plist

    Here something is a variable word, which can be different in each case. It could be "cloud," "dot," "highway," "submarine," "trusteddownloads," or pretty much anything else.

    There may also be a file named

               com.something.helper.plist

    in the same folder.

    Leave the LaunchDaemons folder open, and open the following folder in the same way:

    /Library/LaunchAgents

    In this folder, there may be a file named

              com.something.agent.plist

    where the word something is exactly the same as before.

    If you feel confident that you've identified these three files, back up all data, then drag the three files you found to the Trash. You may be prompted for your administrator login password. Close the windows and restart the computer.

    Don't delete the "LaunchAgents" or "LaunchDaemons" folder or anything else inside either one.

    The malware is now permanently inactivated, as long as you never reinstall it. You can stop here if you like, or you can remove two remaining components for the sake of completeness.

    Open this folder:

    /Library/Application Support

    If it has a subfolder named just

               something

    (where something is the same word as before), drag that subfolder to the Trash and close the window.

    Don't delete the "Application Support" folder or anything else inside it.

    Finally, in this folder:

    /System/Library/Frameworks

    there may an item named exactly

                v.framework

    It's actually another folder, though it has a different icon. Drag it to the Trash and close the window.

    Don't delete the "Frameworks" folder or anything else inside it.

    If you didn't find the files or you're not sure about the identification, post what you found.

    If in doubt, or if you have no backups, change nothing at all.

    The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.

    This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.

    In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere  should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

    Then, still in System Preferences, open the App Store or Software Update pane and check the box marked

              Install system data files and security updates (OS X 10.10 or later)

    or

              Download updates automatically (OS X 10.9 or earlier)

    if it's not already checked.

  • by James Harris,

    James Harris James Harris Jan 16, 2015 10:48 AM in response to Linc Davis
    Level 1 (5 points)
    Jan 16, 2015 10:48 AM in response to Linc Davis

    Thats great thanks. I seem to be back to normal. Thanks for the quick replies.

  • by seekmachelp,

    seekmachelp seekmachelp Feb 17, 2015 2:21 PM in response to Linc Davis
    Level 1 (0 points)
    Feb 17, 2015 2:21 PM in response to Linc Davis

    Hi Linc Davis

    Thanks a lot!!! I have been struggling with this issue of Mackeeper popping up whenever I was trying to watch videos on youtube. Thanks for the solution provided, I got rid of this problem by following the instructions you provided. Thanks a ton for sharing this.

    Regards

    Raj

  • by yakich,

    yakich yakich Mar 15, 2015 12:11 AM in response to James Harris
    Level 1 (0 points)
    Mar 15, 2015 12:11 AM in response to James Harris

    This was SO helpful!!!! THANK YOU!

  • by jules10028,

    jules10028 jules10028 Mar 29, 2015 8:22 PM in response to Linc Davis
    Level 1 (0 points)
    Mar 29, 2015 8:22 PM in response to Linc Davis

    Linc - this worked great. I was very frustrated by the pop ups and changes in search engine as well as slowness.  Thank you.

  • by srideo,

    srideo srideo Apr 2, 2015 8:08 PM in response to Linc Davis
    Level 1 (0 points)
    Apr 2, 2015 8:08 PM in response to Linc Davis

    Hi Davis,

     

    Thanks. I hope these steps will work for me also, but before moving further I have a query from your above suggested steps: "If you feel confident that you've identified these three files, back up all data, then drag the three files you found to the Trash. You may be prompted for your administrator login password. Close the windows and restart the compute

    What do you mean by 'back up all data' ? Do I need to take backup of all the data on my MAC to some external disk?

     

     

    Thanks!!!

  • by dokudami,

    dokudami dokudami May 9, 2015 3:50 AM in response to srideo
    Level 1 (0 points)
    May 9, 2015 3:50 AM in response to srideo

    Are you serious? Always back up to an external drive. You run the risk of losing everything and believe me I found out the hard way after having my Macbook die and having to pay serious cash to get the data retrieved.

  • by dokudami,

    dokudami dokudami May 9, 2015 3:53 AM in response to Linc Davis
    Level 1 (0 points)
    May 9, 2015 3:53 AM in response to Linc Davis

    Thanks so much. Worked like a charm!