Bing/Search mine browser redirecting virus

Please restart your Mac, log in as usual, and launch Safari. If the same problem occurs then proceed as follows below.

---

Navigate to the following folder, and post its contents in a screenshot:

~/Library/LaunchAgents

To open that folder, copy the entire line above and paste it in the Finder's Go menu > Go to Folder... field. Make it look like this:

... and click the Go button.

A Finder window will open. Take a screenshot showing all that folder's contents, and post it in a reply. To learn how to do that please read the Appendix in the following User Tip: Writing an effective Apple Support Communities question.

Usually, there is nothing in that folder so don't be surprised to find it empty. The reason for starting with that folder is to eliminate other potential causes before proceeding with steps that will identify and eradicate whatever is affecting that Mac.

There will be additional instructions to follow and this is just the first step.

For a description of how this may have occurred, how to avoid it in the future, and for Apple's recommended actions read How to install adware.

Review that Mac's Gatekeeper settings. To learn about Gatekeeper read Safely open apps on your Mac. Gatekeeper is designed to help prevent you from inadvertently installing garbage software.

In the same manner as the above, open the following folder:

/Library/LaunchDaemons

To open that folder, copy and paste it in the Finder's Go menu > Go to Folder... field. It should look like this:

Once again ensure all its files and their names are readable, take a screenshot, and post it.

Then, repeat that exercise with the following folder:

/Library/LaunchAgents

Notice its pathname is different than the other two.

In the end, you will have captured and posted the contents of the following three separate folders:

~/Library/LaunchAgents

/Library/LaunchDaemons

/Library/LaunchAgents

Please be sure to include or otherwise indicate the name of the folder that corresponds to each screenshot, so that you and I can keep track of which ones they are.

Good. Open Safari and select the Safari menu > Preferences... > General. Review your Homepage selection. You can set it to anything you wish, such as https://www.apple.com. Also check that "New tabs open with:" and "New windows open with:" are also set to your desired preferences.

Was I supposed to delete anything in these folders after sending the screenshots?

No, with the exception of the "CleanMyMac" file which you can (and should) simply drag to the Trash. Non-Apple "cleaning" apps are scams.

Refer to Change Search preferences in Safari on Mac. Are you able to select your desired Search Engine in its dropdown menu?

Great! Thanks for the update.

Glad to help. Those things are really not difficult to get rid of, but it's much easier to avoid installing them to begin with: How to install adware describes their usual method, which is to convince you to download and install something to "optimize" or "enhance" your "browsing experience" or whatever clever yet meaningless words they have determined work best. Your first inclination upon encountering those popups or harassments or whatever you want to call them is to just say NO. It's as easy as that.

It's important to appreciate the fact that browser redirects are not viruses. They are legitimate products that do exactly what they say they will do—if you were to closely examine the lengthy and obscure "terms and conditions" that accompany them, which of course no one does. To install them, you presumably acknowledge and acquiesce to those Terms by selecting a check box, which the scammers helpfully pre-select for you, followed by providing your Mac's Admin credentials. No matter how many warnings a Mac may present, its users can still choose to ignore them and proceed to install what no reasonable Mac user would willingly install.

Effective defenses against malware and other threats also describes some general "safe computing" principles that you may find useful.

Yes, thank you. Does Safari work properly now?