Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

How do I remove "dnsrsearch.com" from Safari? It has installed itself and is hijacking my searches.

Not sure how it happened but I want to know how to remove it. I have already used CCleaner for Mac, and that didnt help. I deleted any recently installed apps that may have installed it somehow but that was not successful.

MacBook Pro, OS X Mavericks (10.9.1), Disk Repair result: drive is OK

Posted on Mar 20, 2014 6:46 PM

Reply
Question marked as Best reply

Posted on Mar 20, 2014 10:17 PM

Back up all data.

Unlock the Network preference pane, if necessary, by clicking the lock icon in the lower left corner and entering your password. Cllck Advanced, open the DNS tab, and change the server addresses to the following:


8.8.8.8

8.8.4.4


That's Google DNS. Click OK, then Apply.


In Safari, select

Safari ▹ Preferences... Privacy Remove All Website Data

and confirm. If you’re using another browser, empty the cache. Test. Any difference?


Notes:


1. If you lose Internet access after making the above change to your network settings, delete the Google servers in the Network preference pane, then select the TCP/IP tab and click Renew DHCP Lease. That should restore the original DNS settings; otherwise restore them yourself. Remember that you must click Apply in order for any changes to take effect.


2. I don't use Google DNS myself, though I have tested it, and I'm not recommending it or any other DNS provider; the server addresses are offered merely for testing purposes. There may be privacy and technical issues involved in using that service, which you should investigate personally before you decide whether to keep the settings. Other public DNS services exist.

12 replies
Question marked as Best reply

Mar 20, 2014 10:17 PM in response to bl9ckm9mb9

Back up all data.

Unlock the Network preference pane, if necessary, by clicking the lock icon in the lower left corner and entering your password. Cllck Advanced, open the DNS tab, and change the server addresses to the following:


8.8.8.8

8.8.4.4


That's Google DNS. Click OK, then Apply.


In Safari, select

Safari ▹ Preferences... Privacy Remove All Website Data

and confirm. If you’re using another browser, empty the cache. Test. Any difference?


Notes:


1. If you lose Internet access after making the above change to your network settings, delete the Google servers in the Network preference pane, then select the TCP/IP tab and click Renew DHCP Lease. That should restore the original DNS settings; otherwise restore them yourself. Remember that you must click Apply in order for any changes to take effect.


2. I don't use Google DNS myself, though I have tested it, and I'm not recommending it or any other DNS provider; the server addresses are offered merely for testing purposes. There may be privacy and technical issues involved in using that service, which you should investigate personally before you decide whether to keep the settings. Other public DNS services exist.

Dec 1, 2014 12:27 AM in response to Linc Davis

It's been a day. I upgraded to Yosemite, only to find out, after the fact, that it is not compatible with the system where I work (I work from home remotely). After speaking with Apple, I was told that my only option was to bring my system back to factory reset, then the initial OSX would install. There's a lot more to that story, but that is what did ultimately happen. Now, with Lion, OSX 10.7.5, things were looking alright, but I have the exact same problem as bl9ckmpmb9, above (which I did not have prior to installing Yosemite, nor during my brief time with Yosemite). I tried your suggestion, but with no success. I know that it's somehow related to Time Warner, but they're not owning up to it. I had one of their reps on the phone and he said that I should uninstall/reinstall Safari and that should take care of it, and if it doesn't to contact Apple. It only happens on the Safari browser. I read this forum often and find it's information valuable. Any further direction or guidance on the dnsrsearch would be immensely appreciated. Thanks, in advance.

Dec 9, 2014 7:50 AM in response to KMinNC

I've had the TW tech people on the line also for the same problem. I do believe it is in their servers somewhere. I noticed it first in my Firefox browser. Once in your computer it can infect other browsers because I've had Chrome infected also. At first I thought it was a TW redirect for a search in the URL bar that it didn't know what to do with. It made no sense, but I thought maybe TW was using those searches for revenue or Firefox was doing the same. That was my first call to TW. They had no clue after spending an hour with me. I resigned myself to never searching in the URL bar of Firefox. Then I noticed that my husband didn't have the problem on his computer using our same network. So back to TW and finally getting a technician who knew what I was talking about. He had experience with Firefox and suggested it might be coming through there. I cleaned my home computer using Sophos and Avira and I think it's gone. But when I brought my work laptop home to my network, using Firefox, I got the virus again. I've been using Firefox for years and at work it's fine on three computers that I regularly use. Bringing my laptop home and putting it on my network is what brought the problem back.I'm seriously thinking of ditching TW.

Dec 9, 2014 9:07 AM in response to Jansmern

I'm very unclear on what exactly is going on in all the cases described here. However, it should be noted that dnsrsearch.com is a legit Time Warner server. The Time Warner DNS servers redirect there if you type an address in your browser's address bar that does not exist. For example, if you were to try to go to "thisdomaindoesnotexist.com" while connected to Time Warner's internet service - and using Time Warner's DNS servers - you will be redirected to dnsrsearch.com, which will show you search results that may match things similar to that address. This includes advertising, of course, which pays Time Warner.


There is some debate as to whether this is legit behavior. It is definitely a violation of standards, but many internet service providers do this these days. Time Warner is not alone. In any case, though, this is not a "virus" that needs to be removed. If you do not like this behavior on the part of Time Warner's DNS servers, change to a different server. It's important to note, though, that the most commonly-used free DNS servers - Google's DNS servers, which Linc referred to previously, and the OpenDNS servers - will do the same thing, but will redirect to a server other than dnsrsearch.com.

Dec 10, 2014 9:05 AM in response to thomas_r.

I've had the TW tech people on the line also for the same problem. I do believe it is in their servers somewhere. I noticed it first in my Firefox browser. Once in your computer it can infect other browsers because I've had Chrome infected also. At first I thought it was a TW redirect for a search in the URL bar that it didn't know what to do with. It made no sense, but I thought maybe TW was using those searches for revenue or Firefox was doing the same. That was my first call to TW. They had no clue after spending an hour with me. I resigned myself to never searching in the URL bar of Firefox. Then I noticed that my husband didn't have the problem on his computer using our same network. So back to TW and finally getting a technician who knew what I was talking about. He had experience with Firefox and suggested it might be coming through there. I cleaned my home computer using Sophos and Avira and I think it's gone. But when I brought my work laptop home to my network, using Firefox, I got the virus again. I've been using Firefox for years and at work it's fine on three computers that I regularly use. Bringing my laptop home and putting it on my network is what brought the problem back.I'm seriously thinking of ditching TW.

Dec 10, 2014 9:20 AM in response to thomas_r.

Perhaps what you say is true about the "hijacking"...and I don't doubt it in the least...but it's interesting that it doesn't happen right away.It's also interesting that it didn't happen on Safari and Chrome right away (very proprietary browsers) but did happen in Firefox. It's also interesting that the TW tech support was the first one to look at my computer, scratch their head, and then after Googling come up with the dnsrsearch "virus." According to them, it's not something TW does and they recommended I dump my infected browsers and start again. They also noted that in the "preferences" on the redirect page you are supposed to be able to opt out of this service and the opt out doesn't work. That was a red flag to the TW support guy.


Curiously it didn't infect Safari or Chrome right away either. Now that my Chrome is "infected" my Google login is also corrupted as evidenced by a virus scan. (story too long to relate here). When I dump the browsers, it goes away. I'm still sitting on the fence. This is something so egregious that it will lose TW customers over the long haul. That's why I am giving them the benefit of the doubt. The question is what to do about it until it's proven one way or the other.

Dec 10, 2014 9:47 AM in response to Jansmern

Jansmern wrote:


Once in your computer it can infect other browsers because I've had Chrome infected also.


You have missed the point entirely. This is not something that can "infect" anything... it's just a normal part of using Time Warner's DNS servers. The reason you don't notice it often is that it only appears in certain very limited situations - specifically, when you type an invalid URL in the address bar in your browser, or attempt to click a link to an invalid URL.


Then I noticed that my husband didn't have the problem on his computer using our same network.


If that's the case, it's probably because he's not using Time Warner's DNS servers.


I'm seriously thinking of ditching TW.


That is your right, of course. Time Warner is far from a perfect company. However, ditching Time Warner over this particular issue is like saying you can't root for your favorite baseball team anymore because one of their players "stole" second base.

Dec 10, 2014 11:25 AM in response to thomas_r.

I didn't miss any point. I understand exactly what you are saying. I ALWAYS search in my URL bar. I started having the problem in Firefox and thought it was because it was freeware. At the same time I did not have the problem searching in the Chrome URL bar or the Sarari URL bar. Only later that changed. And only after I brought my work laptop home did my work laptop start having issues. Too much of coincidence to my way of thinking. The reason my husband has no problem is that he searches in the search box not in the URL bar.


Your point is also counter to what Time Warner is saying. THEY are the ones who looked into the dnsrseach problem. I had no clue. THEY are the ones who told me that the fact that the preferences link doesn't work is a red flag to them. THEY are the ones who told me to dump my browsers. Perhaps their tech people do not know what is going on in their own company. That's not my problem. When TW tells me to be careful, then I will be careful and suspicious.


Your analogy makes no sense. IF in fact I like to search in my URL bar, and IF in fact that will ALWAYS reroute me to a search engine I don't like and to search results that are not as accurate, and IF in fact the TW people tell me that site is not theirs and they don't choose to correct it, then rather than inadvertently type a search in the URL bar and PERHAPS pollute my computer I will find another provider. The issue is not whether I like or don't like TW's business model. The issue is whether or not it is a potential problem for my computer if I don't correct my searching habits which I don't feel I should have to do. And so far no one besides you is saying it is normal. Not even TW.

Dec 10, 2014 11:56 AM in response to Jansmern

You know how I said Time Warner is not a perfect company? In tech support, they are WAY not perfect. It does not surprise me in the least to hear that their techs don't have a clue what their employer is doing. Their techs often barely seem to know anything. (Except for the service techs who have to actually come out to your house and make something work. They know their stuff decently well, in my experience.)


You should go take a look at the domain name registration for "dnsrsearch.com". That domain is owned by Time Warner Cable.


https://who.is/whois/dnsrsearch.com

Dec 17, 2014 10:46 PM in response to Linc Davis

I used to use the Google DNS servers in my Network preferences and it worked but then I got a new modem and it no longer worked.
Then I noticed that dnsrsearch has a preferences link that lets you turn it off but that didn't work for me either.
Then I logged into my modem and found DNS preferences there and I changed them to Google's.

8.8.8.8
8.8.4.4

which anyway refresh much faster than Time Warner's. For example if you change host providers for your website, then the IP will change.
Time Warner's DNS takes hours to reflect the change while Google's take minutes.


You can test if you got rid of dnsrsearch by trying impossible domain names like

fghgfgdkjslaslfas.com


This works with all browsers. Firefox, Safari, Chrome.



User uploaded file

User uploaded file

Nov 30, 2015 7:20 PM in response to bl9ckm9mb9

I had this same problem. It seems to be more of a browser problem than anything else (less used browsers may not have this error). (My problem: Whenever I typed you it would add a / and redirect me.)

I did 3 things:

1-When you get redirected to dnsrsearch, to the right there is a link that says "Why am I here?" and one that says "Preferences." On Preferences, make sure that your "redirecting" is disabled. Also scroll to the bottom and click on the bottom that says something like "Opt in Opt Out."

2- Check your search engine abilities, as this may be hidden in the "other" section of search engines- possibly more than once. Remove it if it is there.

3- Clear your browsing history as far back as you feel you need to revert to before this website started hijacking your searches. (Step 2 may not be necessary due to this step.)

Double check that the error is gone. (If it's not, you might need to clear your browsing history farther back.)

How do I remove "dnsrsearch.com" from Safari? It has installed itself and is hijacking my searches.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.