Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

82 points

searchmine, bing, and mycouponsmart have cropped up on my mac. please help me get rid of them.

a similar question from 07/19 has been closed (https://discussions.apple.com/thread/250482284), so i am asking again.

i am running high sierra 10.13.6 and chrome 78.0.3904.108.

a mycouponsmart extension, not from the chrome store, has appeared on my mac, and the chrome extensions page gives me no opportunity to turn it off or remove it.

searchmine has replaced google as the search engine and drives searches from the address bar to bing.

the only way i can avoid this is to go to google.com and enter my search.

malwarebytes found, quarantined, and removed malware twice, and finds no more after running several more times. but the problems remain after restarting the mac.

what should i do?

in the 07/19 question, eric root advisedt:

"For Malwarebytes, it may be necessary to run more than one scan. After scanning a couple of times, restart the computer and test. If necessary, follow the manual instructions. Do not download any other programs that are listed in the articles. Malwarebytes uninstall

https://www.2-spyware.com/remove-bing-redirect-virus.html

How to get rid of Bing.com Redirect - Virus removal guide"

i don't understand his advice that i have made bold. follow what manual instructions? when he said not to download any programs that are listed in the articles, did he mean spyware.com/remove-bing-redirect-virus and https://www.pcrisk.com/removal-guides/9633-bing-com-redirect that he listed at the bottom of his comments? or did he mean to use them?

should i use them or/and something else?

those are my questions. what should i do?

thank you. i never thought i would be in this situation on a mac!

iMac Line (2012 and Later)

Posted on Nov 25, 2019 7:56 PM

Similar questions

39 replies

John Galt

Level 10

141,210 points

Nov 30, 2019 4:43 PM in response to green jean

Couple questions:

Close Google and launch Safari. From the Safari menu, choose Preferences... > Search.
- Does your chosen Search Engine remain unaltered, or is it replaced with "Search Mine" or something like it?
- Choose the Extensions pane. Do any Extensions appear in its left column?
Open  (Apple menu) > System Preferences... and click the View menu.
- Does Profiles appear in its list?

BDAqua

Level 10

239,351 points

Nov 26, 2019 9:19 AM in response to green jean

Eric was referring to those Green download buttons for Combo Cleaner, avoid those.

EtreCheck is a simple little app to display the important details of your system configuration and allow you to copy that information to the Clipboard. It is meant to be used with Apple Support Communities to help people help you with your Mac.

http://www.etresoft.com/etrecheck

Pastebin is a good place to paste the whole report...

https://pastebin.com/

Workable but harder for me to work with...the Note tool on the bottom of this editor's toolbar, as shown in the image, to copy and paste the output from EtreCheck.

There is also Malwarebytes which may take care of it...

https://www.malwarebytes.com/mac/

green jean Author

Level 1

82 points

Nov 29, 2019 9:59 AM in response to BDAqua

here it is. thanks for your help.

etrecheck result report for 112919

green jean Author

Level 1

82 points

Nov 27, 2019 10:18 AM in response to BDAqua

thank you, bdaqua. i have been using malwarebytes for some time-- ever since i saw it recommended in community discussions. when i saw this problem, i decided to subscribe. i don't know whether that would have helped me avoid the problem.

anyway, malwarebytes found the malfeasors, quarantined them, and then deleted them. but i still have the same problems with searchmine, bing, and mycouponsmart.

should i use the 2 mentioned in eric's post?

ps: and, i have been using etrecheck for years also-- because of a recommendation from discussions. thanks, discussions!

green jean Author

Level 1

82 points

Nov 27, 2019 4:18 PM in response to BDAqua

malwarebytes no longer finds any files of concern, although "find my file" has found that there are still:

-a unix executable of searchmine;

-3 instances of mycouponsmart, including a unix executable.

if i use time machine to go back to a point before the earliest instances of these files, will that remove them? and what are the disadvantages of doing this?

are there really no ways to get rid of them if malwarebytes thinks everything is ok?

thanks

green jean Author

Level 1

82 points

Dec 1, 2019 12:55 PM in response to John Galt

it looks like this worked, john galt! no profiles.

i thank you 1000 times over.

i read your last 2 suggestions from my email. i don't see that they appear here and i don't have a "correct answer" to click.

green jean Author

Level 1

82 points

Dec 2, 2019 6:23 AM in response to John Galt

i will, but for the next day or two i have to do what i should have done had i/we not been dealing with this problem. i'll set a reminder (sweet app).

by the way, one advantage of apple over google is that google help has been of little use for me in the past. apple discussion communities is in a whole other universe.

thanks again.

John Galt

Level 10

141,210 points

Dec 2, 2019 7:20 AM in response to green jean

by the way, one advantage of apple over google is that google help has been of little use for me in the past. apple discussion communities is in a whole other universe.

Yes it is. This site is truly Apple's secret weapon 😊

Among user-to-user support sites nothing else comes close. HP's for example. It's awful.

BDAqua

Level 10

239,351 points

Dec 3, 2019 8:34 AM in response to green jean

Supposedly...

The cool thing about Brave Shields via the lion icon in the corner is that they're site-specific, so all you have to do in order to "whitelist" a site is to turn the shields off while you're on that site.