Want to highlight a helpful answer? Upvote!

Did someone help you, or did an answer or User Tip resolve your issue? Upvote by selecting the upvote arrow. Your feedback helps others! Learn more about when to upvote >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

http://websearch.searchitwell.info IS IN URL WINDOW IN STARTUP OF Chrome or Safari or Firefox

http://websearch.searchitwell.info appears in my url box when I start up Chrome (preferred browser). Same with Safari and Firefox when I test those browsers.

Oddly, if I delete the start up window and reclick the Chrome (or Safari or Firefox) icon in my dock or the application in my application folder, the programs go to my designated start-up page that I have set up in preferences for the respective programs.


Here is another odd thing, if I enter a search term in the http://websearch.searchitwell.info url bar, it takes my to bing and the search results appear in Bing.


For example, here I entered the term "google" in the phony search box and here were results.

http://www.bing.com/search?q=google&pc=cosp&ptag=A79870AE2B5&form=CONMHP&conlogo =CT3210127


I'm quickly getting rid of this url when it pops up when I initially start up Chrome.

By the way, a sort of "senior" experienced person on the Apple Discussions forum on adware suggested www.adwaremedic.com a free downloadable program. I tried this multiple times and followed their other instructions and it did not get rid of the http://websearch.searchitwell.info in the url bar. When I ran Adware Medic the first time, it did come up with some adware which I removed. I rebooted a number of times after that and re-ran Adware Medic and each time subsequently is detected no adware. I don't think Adware Medic has been recently updated to detect this particular adware, if that is indeed what it is.


So any suggestions for what to do next? By the way, another Apple Discussions forum from about a month or two ago went through manual steps to remove various files and plists. I painstakingly did this and it was of no help.


I've also tried disabling all extensions (I don't have very many extensions) and that did not help. I disabled all my login items in system preferences and rebooted and that did not help. I also rebooted in safe mode to delete any past potential corrupted caches and that did not help


By the way, I recently (finally) updated to Mountain Lion 10.8.5 from Snow Leopard and this is when the trouble started. I may have mistakenly clicked a download link as I was trying to update some of my software after the installation of Mountain Lion - but I'm not sure what happened. (as an aside unrelated to this issue but just as an FYI, my "Early 2009 24" iMac" has been a little sluggish since the download and I just received from Amazon 8Gigs of Crucial RAM to install, replacing my 4GB. Amazing how much resources\s Mountain Lion seems to take up. It is hard to run Chrome and iTunes simultaneously with just my 4 Gigs - virtual memory accessing the hard drive its off the charts, resulting in little free space. But meanwhile, I'd appreciate suggestions about getting rid of the http://websearch.searchitwell.info/?r=q7oexS2dXrB8znikg07tETra9wUZOD5d&reloaded= 1

OS X Mountain Lion (10.8.5), 4 GB RAM now - just received 8GB

Posted on Apr 25, 2015 9:36 PM

Reply
12 replies

Apr 26, 2015 6:55 AM in response to momomentous

From the Safari menu bar, select

Safari Preferences... Extensions

Turn all extensions OFF and test. If the problem is resolved, turn extensions back ON and then disable them one or a few at a time until you find the culprit.

Do the equivalent in the other browsers.

If there is an item named "MacCoupons" or similar in the Applications folder, delete it.

Apr 26, 2015 9:12 AM in response to Linc Davis

Hi Link - thanks for your input but turning off extensions did not seem to have an impact on Safari, Chrome or Firefix (Chrome is my primary browser). I tried finding MacCoupons or similar in my apps or anywhere on my iMac and it does not appear.


HOWEVER!! I seemed to have found a "workaround" - here is the explanation - this is when I sent Thomas Reed of thesafemac.com who is associated with the malware removal app AdwareMedic. He also offered some suggestions. HERE IS THE WORKAROUND. BUT UNDERLYING MALWARE STILL NOT REMOVED!


========


Hi Thomas - Thanks for getting back to me.

Just to confirm, the same behavior happened with all 3 browsers when I booted up in "Safe Mode"

I just tested it again.

HOWEVER ... I THINK I HAVE FIXED IT WITH A POSSIBLE WORKAROUND (?) YEAH! FINALLY!

Oddly, for the first time when I just now tested Safari and Firefox - this time the default page that one selects to appear when the program starts up

was the actual http://websearch.searchitwell.info . This was the first time I noticed that the actual

http://websearch.searchitwell.info url appearing in that box (though the browser opened up there the box did not have

that info but had a google.com address)

So I changed the boxes in Safari and Firefox

to open at "google.com" and things are now fixed with those two browsers (if you call that fixed! the malware must still be in my system

somewhere)

However, it was still broken in Chrome - the problem persisted - but I found a workaround -

I just discovered that if I select the "open blank tab page" button then it seems to fix

the problem and it still opens up at google.com

However, if I select a "custom" default start up page in Chrome, whether it be google.com or my gmail mailbox or whatever -

it still starts up at the "http://websearch.searchitwell.info "

Isn't that strange? I attached a screen shot of the selection for page startup in Chrome preferences that seems to "fix" the problem

since my explanation might be a little convoluted.

So I hope this gives you a little more ammunition if you decide to explore this issue more.

Let me know if you want me to send you any more system data that will help you understand the underlying problem. I"m hoping

to find the embedded malware plist and other type files in my system to get rid of this once and for all.

If you have anymore insight about the http://websearch.searchitwell.info malware I'd like to know - I have no idea of malicious it is

and what else it can do besides redirect me.... very strange about the redirect to a Bing search engine - is Bill Gates behind this

malware? haha.

Again thanks for you help and let me know.

Apr 26, 2015 9:23 AM in response to momomentous

1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

The test works on OS X 10.7 ("Lion") and later. I don't recommend running it on older versions of OS X. It will do no harm, but it won't do much good either.

Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.

You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.

In this case, however, there are a couple of ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone with the necessary skill can verify what it does.

You may not be able to understand the script yourself. But variations of it have been posted on this website thousands of times over a period of years. The site is hosted by Apple, which does not allow it to be used to distribute harmful software. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message. See, for example, this discussion.

Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.

4. Here's a general summary of what you need to do, if you choose to proceed:

☞ Copy a particular line of text to the Clipboard.

☞ Paste into the window of another application.

☞ Wait for the test to run. It usually takes a few minutes.

☞ Paste the results, which will have been copied automatically, back into a reply on this page.

These are not specific instructions; just an overview. The details are in parts 7 and 8 of this comment. The sequence is: copy, paste, wait, paste again. You don't need to copy a second time.

5. Try to test under conditions that reproduce the problem, as far as possible. For example, if the computer is sometimes, but not always, slow, run the test during a slowdown.

You may have started up in "safe" mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

6. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

7. Load this linked web page (on the website "Pastebin.") The title of the page is "Diagnostic Test." Below the title is a text box headed by three small icons. The one on the right represents a clipboard. Click that icon to select the text, then copy it to the Clipboard on your computer by pressing the key combination command-C.

If the text doesn't highlight when you click the icon, select it by triple-clicking anywhere inside the box. Don't select the whole page, just the text in the box.

8. Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Click anywhere in the Terminal window to activate it. Paste from the Clipboard into the window by pressing command-V, then press return. The text you pasted should vanish immediately.

9. If you see an error message in the Terminal window such as "Syntax error" or "Event not found," enter

exec bash

and press return. Then paste the script again.

10. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt. Again, the script will still run.

If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

11. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, a series of lines will appear in the Terminal window like this:

[Process started]

Part 1 of 8 done at … sec

Part 8 of 8 done at … sec

The test results are on the Clipboard.

Please close this window.

[Process completed]

The intervals between parts won't be exactly equal, but they give a rough indication of progress. The total number of parts may be different from what's shown here.

Wait for the final message "Process completed" to appear. If you don't see it within about ten minutes, the test probably won't complete in a reasonable time. In that case, press the key combination control-C or command-period to stop it and go to the next step. You'll have incomplete results, but still something.

12. When the test is complete, or if you stopped it because it was taking too long, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "Process completed" message to appear in the Terminal window. Please wait for it and try again.

If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

13. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "The message contains invalid characters." That's a bug in the forum software. Please post the test results on Pastebin, then post a link here to the page you created.

14. This is a public forum, and others may give you advice based on the results of the test. They speak for themselves, not for me. The test itself is harmless, but whatever else you're told to do may not be. For others who choose to run it, I don't recommend that you post the test results on this website unless I asked you to.

______________________________________________________________

Copyright © 2014, 2015 by Linc Davis. As the sole author of this work (including the referenced "Diagnostic Test"), I reserve all rights to it except as provided in the Use Agreement for the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

Apr 27, 2015 6:55 AM in response to momomentous

From our conversation via e-mail, it seems that the websearch.searchitwell.info site had been added to the pages to load with Chrome's "Open a specific page or set of pages" option, which is why changing it to "Open the new tab page" fixed the problem.


For others who may be reading this and looking for a similar solution, once you have removed the adware responsible (see my Adware Removal Guide if you need help with that), you must change your browser's home page and search engine settings. See:


http://www.adwaremedic.com/kb/browsersettings.php


(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com.)

May 10, 2015 8:59 AM in response to momomentous

I had the same issue - I was trying to download a YouTube video and my usual place to do so was not working. I found another website - clipconverter (dot) CC. The supposed video file came up as a disk image. Anyway I wasn't as careful as I normally am ( I was tired) and ended up with this thing.


I quickly figured out to change my home page and search engine on my web browsers. But then I ended up here to see if there is anything actually installed on the computer and if so how to remove it. I've run adware and malware removal software and neither shows anything installed. Also under the system profiler, it doesn't show anything having been installed. But I know on the Windoze side of the world it does.


So my question is this - does anyone know if this thing installs something on the Mac or is it only a change of web browser settings? It's one of those feelings of is there really nothing or is there something I've just not found.

May 10, 2015 11:02 AM in response to tpaairman

If you opened whatever was on that disk image, you probably ended up with adware. I have yet to see an installer like that that only changes browser settings. (The only exception would be if you "opted out" of whatever the adware installer allowed you to, by unchecking boxes for "special offers"... in some cases, that actually prevents the adware from being installed.) It wouldn't show up on the system profiler's list of installations because adware installers these days are all apps, rather than install packages. They're usually tiny apps that download the payload when opened.


What adware removal software did you use? If you used AdwareMedic, and it didn't find anything, and you're still having ads, see:


http://www.adwaremedic.com/kb/unsolved.php


If you used something else, like my older (and discontinued) TSM Adware Removal Tool or BitDefender's Adware Removal Tool, those won't do the job these days.


(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com.)

May 10, 2015 7:45 PM in response to thomas_r.

I used Adware Medic and Bitdefender. Neither found anything. However, I'm not having any ads pop up. I also can't find anything added to the computer or modified near the time it started, other than the supposed Youtube video disk image which I trashed. Pretty much changing the home page on my browsers and changing the default search engine back to Bing has corrected anything I can find. Also, not sure if this makes a difference but I have a second user account on my computer (that one is for my business items). Nothing seems affected there.


One thing that comes to mind though is I do have Little Snitch installed, and denied a whole bunch of stuff. Maybe that was what kept if from doing anything else?


My question at this point though would be how would I find where it installed anything if it did at all? I went to the hard drive and none of the folders showed modified at the suspect time, other than that disk image which went on my desktop, and I can see there I don't have anything that shouldn't be there.

May 11, 2015 3:54 AM in response to tpaairman

tpaairman wrote:


One thing that comes to mind though is I do have Little Snitch installed, and denied a whole bunch of stuff. Maybe that was what kept if from doing anything else?


That's probably why you don't have any of the adware installed. These installers typically download the adware payload, rather than having it contained within the installer app itself. So if you blocked the connections, the adware wouldn't have been downloaded, but the app still would have changed your browser settings.


My question at this point though would be how would I find where it installed anything if it did at all?


That can be difficult to do unless you know what you're doing. The only reliable way to know what would be installed where would be to run the installer on a test system and see how it behaves... tracking changes to the file system, for example.

http://websearch.searchitwell.info IS IN URL WINDOW IN STARTUP OF Chrome or Safari or Firefox

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.