Want to highlight a helpful answer? Upvote!

Did someone help you, or did an answer or User Tip resolve your issue? Upvote by selecting the upvote arrow. Your feedback helps others! Learn more about when to upvote >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

searchmine, bing, and mycouponsmart have cropped up on my mac. please help me get rid of them.

a similar question from 07/19 has been closed (https://discussions.apple.com/thread/250482284), so i am asking again.


i am running high sierra 10.13.6 and chrome 78.0.3904.108.


a mycouponsmart extension, not from the chrome store, has appeared on my mac, and the chrome extensions page gives me no opportunity to turn it off or remove it.


searchmine has replaced google as the search engine and drives searches from the address bar to bing.

the only way i can avoid this is to go to google.com and enter my search.


malwarebytes found, quarantined, and removed malware twice, and finds no more after running several more times. but the problems remain after restarting the mac.


what should i do?


in the 07/19 question, eric root advisedt:

"For Malwarebytes, it may be necessary to run more than one scan. After scanning a couple of times, restart the computer and test. If necessary, follow the manual instructions. Do not download any other programs that are listed in the articles. Malwarebytes uninstall


https://www.2-spyware.com/remove-bing-redirect-virus.html


How to get rid of Bing.com Redirect - Virus removal guide"


i don't understand his advice that i have made bold. follow what manual instructions? when he said not to download any programs that are listed in the articles, did he mean spyware.com/remove-bing-redirect-virus and https://www.pcrisk.com/removal-guides/9633-bing-com-redirect that he listed at the bottom of his comments? or did he mean to use them?


should i use them or/and something else?


those are my questions. what should i do?


thank you. i never thought i would be in this situation on a mac!


iMac Line (2012 and Later)

Posted on Nov 25, 2019 7:56 PM

Reply

Similar questions

39 replies

Nov 30, 2019 3:55 PM in response to green jean

to summarize the 3 steps in john galt's instructions for removing my malware:


  1. ~/Library/LaunchAgents


Nov 29, 2019 3:38 PM in response to John Galt

here is the screenprint of ~/Library/LaunchAgents




2./Library/LaunchDaemons


Nov 30, 2019 6:35 PM in response to John Galt

113019 /Library/LaunchDaemons


3./Library/LaunchAgents


Nov 30, 2019 6:40 PM in response to John Galt

this is the 2nd step in the response to john galt's 113019 instructions


113019 /Library/LaunchAgents


Dec 1, 2019 11:29 AM in response to John Galt

this is a reply to john galt's Nov 30, 2019 7:43 PM in response to green jean couple of questions.

  • i closed google and launched safari. safari opened with a searchmine address in the address window.
  • but safari, preferences, search showed my chosen search engine.
  • safari, preferences, extensions showed 2 extensions: a valid extension unchecked and mycouponsmart checked.
  • the apple menu, system preferences, view does show profiles in its list.

Nov 29, 2019 10:36 AM in response to green jean

Uninstall anything and everything you downloaded installed in an effort to get rid of whatever it was you downloaded and installed. Follow all their respective instructions.


Never use Google for assistance. All that will accomplish is provide a limitless supply of even more junk.


For example:


User Login Items:
Mac Cleanup Pro


That needs to go. Rule 1 of Macs is don't install junk.


Then and only then: Find out what you did and fix it. To get started read below.


---


Navigate to the following folder, and post its contents in a screenshot:


~/Library/LaunchAgents


To open that folder, copy the entire line above and paste it in the Finder's Go menu > Go to Folder... field. Make it look like this:





... and click the Go button.


A Finder window will open. Take a screenshot showing all that folder's contents, and post it in a reply. To learn how to do that please read the Appendix in the following User Tip: Writing an effective Apple Support Communities question.


Usually, there is nothing in that folder so don't be surprised to find it empty. The reason for starting with that folder is to eliminate other potential causes before proceeding with steps that will identify and eradicate whatever is affecting that Mac.


There will be additional instructions to follow and this is just the first step.


Nov 30, 2019 10:44 AM in response to green jean

i tried to amend a comment i made on Nov 27, 2019 7:18 PM in response to BDAqua. apple discussions gave me the processing indicator but never posted it.


therefore, i am adding the amendment to the end of the current comments.


i said

"malwarebytes no longer finds any files of concern, although "find my file" has found that there are still:


-a unix executable of searchmine;

-3 instances of mycouponsmart, including a unix executable." ...


malwarebytes found this later.V i have taken no action.


i have neither deleted nor restored these items.


as always, thanks for your help.


Nov 30, 2019 1:33 PM in response to green jean

apple discussions gave me the processing indicator but never posted it.

therefore, i am adding the amendment to the end of the current comments.


That's been happening a lot lately. I know it makes using this site difficult.


Here are the next few steps to follow. Once that's done I should have enough information to provide further instructions.


---


In the same manner as you just did, open the following folder:


/Library/LaunchDaemons


To open that folder, copy and paste it in the Finder's Go menu > Go to Folder... field. It should look like this:



Once again ensure all its files and their names are readable, take a screenshot, and post it.


Then, repeat that exercise with the following folder:


/Library/LaunchAgents


Notice its pathname is different than the other two.


In the end, you will have captured and posted the contents of the following three separate folders:


~/Library/LaunchAgents

/Library/LaunchDaemons

/Library/LaunchAgents


Please be sure to include or otherwise indicate the name of the folder that corresponds to each screenshot, so that you and I can keep track of which ones they are.

Dec 1, 2019 12:10 PM in response to green jean

• the apple menu, system preferences, view does show profiles in its list.


Assuming your Mac is not owned or otherwise under managerial control of an institution such as a school or corporation, no Profiles should appear.


Delete the rogue Profile from System Preferences. After doing that, you might need to restart your Mac so it couldn't hurt to do that also.


After restarting your Mac make sure that Profile does not spontaneously reappear.


• i closed google and launched safari. safari opened with a searchmine address in the address window.


Just reset your chosen search engine in Safari's Preferences, and confirm that it stays that way. While you're there, uninstall any suspicious Extensions. No Extensions are required for Safari, so if you decide to use any you should be absolutely certain of their purpose, meaning you were not deceived into installing them. "Coupon" and similarly categorized shopping-related Extensions are a popular vector for malware.

Nov 30, 2019 8:55 AM in response to BDAqua

bdaqua said Nov 29, 2019 8:36 PM in response to green jean

"Try these manual instructions...


https://malwaretips.com/blogs/remove-mycouponsmart-mac/"


bdaqua, is your reply another approach to my problem or the 2nd step of the process that john gault started in

"

John Galt

User level:

Level 10

(80,558 points)

macOS

Speciality level out of ten: 1


Nov 29, 2019 1:36 PM in response to green jean

Uninstall anything and everything you downloaded installed in an effort to get rid of whatever it was you downloaded and installed. Follow all their respective instructions.


Never use Google for assistance. All that will accomplish is provide a limitless supply of even more junk.


For example:


User Login Items:
Mac Cleanup Pro



That needs to go. Rule 1 of Macs is don't install junk.


Then and only then: Find out what you did and fix it. To get started read below." ... [specific steps follow.] his step 1 above said that step 2 would follow after i finished the steps in part 1.


thanks for your help.

Nov 30, 2019 1:31 PM in response to green jean

Try a safe boot.


    Shutdown your machine.  Hold down the shift

key.  Poweron.  The boot up will take longer than normal

because the filesystem on the startup drive is being checked and

repaired as needed.   All about safe mode including what

features and apps safe boot leaves out. 

Safe boot uses a software driver instead

of using your machines video hardware.

http://support.apple.com/kb/ht1455


R

Dec 1, 2019 2:16 PM in response to green jean

does my mac log activities in any way that would help me determine what i did?


Sort of, but it might not help. Try looking in (Apple menu) > About This Mac > System Report...


Under Software, click Installations. You will find a long list of software that has ever been installed on that Mac. All it will show is when it was installed though, not how.


You might also find information under Logs. The Installer Log will reveal what was installed and when.


I actually keep a logbook of various abuses I inflict upon my Mac. Deciphering what I wrote long after I wrote it is another story.


---


There is at least one other ASC participant who appears to be experiencing a similar if not identical problem. It seems to affect Google but not Safari, or at least it was easily eradicated in Safari while Google is proving more difficult. I don't know if it has been resolved or not, but read it and see what you think: How do I permanently get rid of TotalResultsSearch from Google Chrome.


I don't (and won't) use Google, so my ability to assist is limited. Perhaps you could help?

searchmine, bing, and mycouponsmart have cropped up on my mac. please help me get rid of them.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.