House call threat OSX ref.9eae4e3a

Hi

Noticed someone had similar problem June 7th 2020. Basically, noticed my safari search bar was defaulting to yahoo, something seemed wrong. Went on preferences - extensions, and noticed an 'Extension tool 2.0', on the details it said it had permission to access everything, inc. read passwords. Deleted and removed extension, seemed to be okay.

Happened again a few days later, with Safari (however different extension name, Search Tool 2.0?) opened Chrome (different browser) and this also had the same, an extension and was reloading all my searches via a yahoo search bar. I then noticed on my Chrome that there was a 'Person 1' alongside my user account, with a balaclava as their icon (!!) however it said signed out and the option to remove them was greyed out.

Restarted my computer after redeleting the extensions...then, discovered there was another 'User' next to my profile when I turned on my Mac. It said User 1, from memory, and required a password. I could not however delete this from Users & Groups as it was not showing up! I googled & found out how to delete a user via command prompt so swiftly did so.

I then downloaded Housecall upon advice from my Dad, the most independent and trustworthy malware tool around atm I think, and it found 2 threats it was able to remove. All was okay for about 3 weeks.

However, today, the same first problem randomly happened again on Safari (my search was redirected, the presence of a new extension, this time 'LogStandard'). I removed the extension, and I do not have another User appearing on my computer. I no longer have Chrome however as I deleted the browser so don't know whether this would be affected.

Such a pain and rather worrying! If anyone could help, that would be great as I am one step away from removing everything on my Mac and starting again.

Best regards,

Jess