Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

SearchBunny took over Safari and Chrome

How concerned should I be?


I've been having problems with my 2010 Mac Mini 2.4GHz, 2Gb ram, 320 Gb, running OSX 10.6.8. I have asked questions about browsers crashing regularly here in the User Support groups before, and was told it was unlikely I could have any virus affecting this Mac. Browsers still crash regularly, and I've stopped using Safari and Chrome because the troubleshooting advice about fixing the crashes in those apps didn't lead me to a solution. Firefox is my default browser, and after a few months of it crashing during use, it now mostly waits to crash until I "QUIT" the application. It doesn't crash every single time I quit, but if I am online for more than an hour or so, it seems to crash every time I quit. Currently I have the preferences set to always delete History on quitting, thinking maybe it was crashing because I spend too much time surfing and all those temp files were overwhelming the system.


For a while, when either Firefox or Safari crashed while I was actively working in one or the other, the crash seemed to affect the computer...that is, I lost control of the computer (that's why I thought maybe I'd contracted a virus somehow). That is, the only way to get my computer back was to push and hold the power button 5 seconds so the machine would force "shut down". Then I'd restart and try again.


After months of this, and seeking help in here, I finally took the machine to the Apple Store in town and had the "genius bar" look at it. Ultimately he could not find anything wrong with it, except that I'm still using OSX 10.6.8. (There is one small bug he couldn't figure out.....that whenever I start up the computer I get an error message that the "Startup Folder" has something in it that has the wrong security settings and wasn't "started" because of that, but there's NOTHING in the startup folder.) And the folder itself seems to have the proper security settings. But, I digress....that's not the problem I'm here about.


Genius Bar representative said I need to upgrade to OSX 10.10 and it will solve all my problems. He also warned me I will have to upgrade Office 2004 to Office 2008 if I use MS Word or Excel or the other apps (which, of course, I do). "Office 08" of course is no longer "supported" by Microsoft, though it is still available for sale from them for about $140. Great! $140 for an unsupported/unsupportable office suite.... Doing my diligence, I checked for compatibility of my other regularly-used applications with 10.10 and several aren't guaranteed to work, or flat out admit they won't work.


So, I did the stupid thing. I went looking for Office 2008 on the Google. Several links pointed to "FREE" downloads of MS Office 2008 for Mac. So, of course, I followed one of them and read the boilerplate stuff on the "home page" and decided it sounded legit, and I clicked the "download" button. That page's downloader/installer advised me that as part of my agreement to use their service, I had to download and install their "InstallMac" application, which would also install some other integrated applications to "improve" my Mac's performance. D'Oh! (Oh, and the "full version of Office 2008 for Mac" was actually just an update v12.3 or something....of course useless if you don't already have Office 2008 installed......requiring the Microsoft user license to be entered....and now even that file is invisible to me on the hard drive.)


One of the applications apparently installed at the same time is MacKeeper, and it is constantly asking me to "instant activate" my account to clean up the leftovers of the other InstallMac junk that was "given" to me, but of course won't tell me what that costs--I'm guessing there's a fee service to use it--but that's not what I'm here for.


The application that's really bothering me right now is that, with Firefox crashing all the time, I opened Safari for the first time in a couple of months and Safari opened to a "new" homepage called "SearchBunny" on a "web search" page, which is described as some fantastic new search engine that makes finding and installing applications easier than ever and efficient and etc and etc.....but which has automatically installed itself as my default search engine and homepage! On BOTH Safari AND Chrome. (On the "uninstall" page it reminds me that SearchBunny's "service was provided to you by a third party application".)


REading their "About" home page, there's an option to uninstall the application if you don't want it to take over all your brower search features. After reading their Privacy Policy I decided I want nothing to do with their service--which installed itself already, apparently with my approval when I thought I was getting Office 2008. The "good news" is if you'd like to "uninstall" the "SearchBunny" application, you should just "click here" to download and install the "Uninstaller" for SearchBunny. (They do give detailed instructions how to manually change all your browsers BACK to the way they were before SearchBunny was installed and installed itself as the default home page in all my browsers--which also means you have to change the default Search engine back, too. But, nothing about actually making "SearchBunny" go away permanently, unless that's up to their "uninstaller".....)


So, how concerned should I be that I willfully accepted terms of service that allowed InstallMac to install SearchBunny as my default search engine and default home page for every new window or tab opened in Safari, and that the "best way to remove SearchBunny" from my system is to download their uninstaller from their web site and install it so it will allow me to uninstall SearchBunny?!


Summary:

•All browsers suddenly began crashing regularly after years of non-problematic use (about 3 months ago). I trouble-shot the problem from advice given in these Apple User Support forums and could not find a solution to the crashes.

•I stopped using Safari and Chrome and decided I could live with Firefox crashing since it had features I liked and I was used to using it.

•Firefox changed its crash behavior from crashing during use to crashing when I attempt to Quit it. Which wouldn't be a problem, except, why is it crashing? (I've been submitting Crash Reports to Firefox after most of the crashes.....have yet to hear anything back from them...)

•Finally I got fed up and took the computer to the Genius Bar. They found nothing wrong but my "old" operating system.

•Upgrading from OSX 10.6.8 will cause me to lose the use of Filemaker Pro 8.5, Office 2004, and possibly some other apps I use regularly. Upgrading any of those apps will cost money.....they don't give them away any more.....the "Genius" at Apple Store said intermediate OSX upgrades are futile....I must go the whole way to 10.10. (He also said the reason I read all those negative reviews of OSX 10.10 is that only unsatisfied users complain.....and the vast majority of 10.10 users are happy.)

•I tried to find a lower-priced option for Office 2008 and got hornswoggled into installing some "helper" apps, all to no avail since Office 2008 wasn't really downloaded......and now my browsers have been taken over by one of the "helper" apps that will randomly seek and install other "useful" apps based on the advertisements that it procures during it's "web searches"....

•So now Firefox crashes almost every time I use it, and my other browsers were taken over by SearchBunny, and MacKeeper wants to "help" me clean up my hard drive of some 16,000 "junk" files, for an undisclosed fee up front, of course.

•I'm now also worried that if I find an unrecognized application on my hard drive and try to uninstall it, when it asks for my password to authorize the "move" of the file, it's possibly trying to capture my admin password to access the rest of my system and screw me.


Help?


b2young

Mac mini, Mac OS X (10.6.8), core duo

Posted on May 20, 2015 7:48 PM

Reply
4 replies

May 20, 2015 9:10 PM in response to blick

There is no need to download anything to solve this problem.

If Safari crashes on launch and you don't have another web browser, you should be able to launch Safari by starting up in safe mode.

You may have installed the "Genieo" or "InstallMac" ad-injection malware. Follow the instructions on this Apple Support page to remove it.

Back up all data before proceeding.

Malware is always changing to get around the defenses against it. In addition to the files listed in the support article, you may also have to remove the following in the same way:

~/Library/LaunchAgents/com.Installer.completer.download.plist
~/Library/LaunchAgents/com.Installer.completer.ltvbit.plist
~/Library/LaunchAgents/com.Installer.completer.update.plist
~/Library/LaunchAgents/com.spigot.SearchProtection.plist
~/Library/Application Support/IM.Installer/Completer.app

One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.

After removing the malware, remember to reset your home page in all the web browsers affected, if it was changed.

If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, then you may have one of the other kinds of adware covered by the support article. Follow the rest of the instructions in the article.

If you find Apple's instructions too hard to follow, ask for an alternative that doesn't require you to trust a black-box application without knowing what it does.

Make sure you don't repeat the mistake that led you to install the malware. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

May 21, 2015 4:11 AM in response to blick

Since you are currently using Mac OS X 10.6.8, you will not be able to use AdwareMedic. Instead, see the manual removal instructions in my Adware Removal Guide. This will help you get rid of InstallMac, as well as any other adware that may be present. (Don't stop looking after you've found something, as you may very well have other adware installed. I've seen as many as 6 different adware programs on one computer, and have seen installers that would install as many as 4 different adware programs at one time.)


Also, note that I would not recommend upgrading from 10.6.8 all the way to 10.10 without a LOT of thought, a LOT of research to understand what apps you will have to upgrade or replace, and a thorough set of backups (ie, on at least two separate physical media, and preferably using two different backup apps, such as the built-in Time Machine and "cloning" apps like Carbon Copy Cloner). Some hardware running 10.6.8 will not run 10.10 well, or at all, and replacing numerous apps could get costly. (Still, at any point, you could be forced to upgrade by something like a hardware failure, so you need to be ready for that.)


In the future, never download something from the internet that is offered to you for free if it should normally cost you money. Doing so can not only expose you to adware, but to real malware. In fact, it may not be a bad idea for you to just cut your losses, erase your hard drive and reinstall the system and your apps from scratch, then restore documents only from backups. I say this not only because you downloaded and installed an illegal copy of Microsoft Office, but also because it sounds like you were having other problems prior to that. A reinstall will not only protect you from whatever nasty stuff might have been installed, but could also potentially solve the other problems as well.


(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com.)

SearchBunny took over Safari and Chrome

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.