Here is what I have prepared:
Removal of Nation Advanced Search
Caveat: The following worked for me in early September, 2013. There is no guarantee that these guys will not change their modus operandii. Proceed with caution. I am not responsible for any issues that may arise. Let me know how you get on or if you want me to look at other options, such as Chrome as I have an old macbook that I have left infected.
This company is owned by InfoSpace which is in turn owned by publicly listed company Blucora (see http://en.wikipedia.org/wiki/Blucora). It has a colourful background. If interested, look at their SEC filings - quite interesting the revenue available from hijacking one's browser. See http://www.sec.gov/edgar/searchedgar/companysearch.html and enter Blucora. The interesting filing is 10-Q.
Protect yourself from future intrusion by using Web of Trust plugin (http://www.mywot.com) and a product such as Intego Virus Barrier - and don't do what I did - turn off the real time scanner!!!! Intego picks this malware up and quarantines it.
Hope this helps….
Safari & Firefox
- Open Safari.
- Select /Preferences/Extension
- Click on 'NationBar' and then "Uninstall" on right hand panel.
- Click on "General".
- Change default search engine to your preferred search engine.
- Change the "Homepage" to your preferred home page.
- In Spotlight search for "zako".
- Select option to open all the zako's that have been found in a Finder window.
- Carefully go through and delete any that are not associated with an application that you know. I found one that commenced with "com.zako".
- In Spotlight enter "Nation Toolbar".
- Open the results in a Finder window.
- Look through the list and remove the "Nation Toolbar Uninstaller.pkg" and any others that appear to belong to this crowd. DO NOT run this package as it will uninstall the package AND report aspects of your system back to Search Nation.
- If you DO NOT have Firefox installed go to step 17
- In the Spotlight toolbar enter "ADFA33FD-16F5-4355-8504-DF4D664CFE09"
- Open the result in Finder and delete this directory.
- Go to Firefox preferences and reset the default search engine and homepage as in Safari.
- Go to your apps folder and then the "Utilities" folder.
- Open "Activity Monitor"
- Click on "Process column" to sort the process list into alphabetic order.
- Look down the list for a process that contains the word "zako" and click it.
- Click red "Quit Process" on top left hand side.
- Select "Force Quit".
- Restart