KaeleaAnn
Level 1 (4 points)
Safari

Q: Snowbitt Browser High-Jacker

I have had Macs for YEARS and have never run into such an issue and I am about to lose my mind.

 

Basically, I must have downloaded malware (or maybe something else?) and now I have this Snowbitt "search engine" that shows up in my preferences in Safari and Firefox and it will not let me remove it. It high-jacks my browser every time I close and reopen it and changes my preferences every time, then leading to unwanted weird pop-up links. I have troubleshot through all the basics, ran Sophos, I don't have MacDefender, MacSecurity etc (that all the articles suggest to remove) so I am at a loss.

 

Anyone experience this? Thank you in advance!

 

Here's what it looks like in Firefox (oops! sorry for the cursing!):

 

Screen Shot 2016-08-13 at 10.15.49.pngScreen Shot 2016-08-13 at 10.16.05.png

MacBook Pro (13-inch Mid 2012), OS X Mavericks (10.9.5)

Posted on Aug 13, 2016 1:31 AM

by dominic23,Solvedanswer
dominic23 dominic23
Level 8 (41,450 points)
Mac OS X
A:

Please try refreshing Firefox.

 

https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings

Posted on Aug 14, 2016 2:37 AM

Close
KaeleaAnn

Q: Snowbitt Browser High-Jacker

  • All replies
  • Helpful answers

  • by dominic23,Helpful

    dominic23 dominic23 Aug 14, 2016 12:24 AM in response to KaeleaAnn
    Level 8 (41,450 points)
    Mac OS X
    Aug 14, 2016 12:24 AM in response to KaeleaAnn

    How to remove adware?

     

    Please try a different approach.

     

    You will have t do this after starting up in Safe Mode to prevent adware

    from interfering with the removal of adware .

     

    1. Shut down the computer.

        Press the power button. Immediately after you hear the startup sound,

        press and hold the Shift key.

     

        The Shift key should be pressed as soon as possible after startup,

        but not before the startup sound.

     

        Release the Shift key when you see the Apple logo on the screen.

        Startup will take longer than usual.

        Screen flickering is normal in Safe Mode.

        Login to your account. Launch Safari.

     

        Enter this address       https://www.malwarebytes.org/antimalware/mac/

     

        in the Safari address bar.

     

        Download,   Install , open,  and run it by clicking “Scan”  button   to remove adware, if present.

        Once done, quit MalwareBytes.

     

     

    2. Safari > Preferences > Extensions

        Turn all extensions off

         or  uninstall all extensions you haven’t installed knowingly.

     

    3. Safari > Preferences >  Search > Search Engine :

        Select your preferred   search engine.

     

    4. Safari > Preferences > General > Homepage:

         Set your Homepage.

     

    5. Quit Safari, launch Firefox, change search engine, remove add ons and set homepage.

     

    6. Restart normally from  menu in the menu bar.

  • by Eric Root,

    Eric Root Eric Root Aug 13, 2016 6:43 AM in response to KaeleaAnn
    Level 9 (69,546 points)
    iTunes
    Aug 13, 2016 6:43 AM in response to KaeleaAnn

    1. Find and delete malicious files related to Feed.snowbitt.com in “Library” : Finder >> Go >>Library

    You may see the following files in Library:

    /Library/Application Support/Feed.snowbitt.com/

    ~/Library/Internet Plug-Ins/Feed.snowbitt.com NPAPIPlugin.plugin

    /Library/PrivilegedHelperTools/Jack

    /Library/InputManagers/CTLoader/

    /System/Library/Frameworks/Feed.snowbitt.com.framework

    2. Uninstall suspicious applications that may be connected with Feed.snowbitt.com: Finder>>Applications >> Move to Trash

    3. Delete suspicious extensions associated with Feed.snowbitt.com from Safari: ‘Safari’ >> ‘Preferences’>> extensions >> select suspicious extensions and click Uninstall

  • by KaeleaAnn,Helpful

    KaeleaAnn KaeleaAnn Aug 14, 2016 12:23 AM in response to dominic23
    Level 1 (4 points)
    Safari
    Aug 14, 2016 12:23 AM in response to dominic23

    I tried this, safe mode and regular, it doesn't come up in Safari, but it's still attached to Firefox.

  • by KaeleaAnn,

    KaeleaAnn KaeleaAnn Aug 13, 2016 11:48 AM in response to Eric Root
    Level 1 (4 points)
    Safari
    Aug 13, 2016 11:48 AM in response to Eric Root

    I also tried this and I didn't see anything with "snowbitt" in it.

    Is there anything else to try besides throwing my machine out the window?

  • by dominic23,

    dominic23 dominic23 Aug 13, 2016 12:49 PM in response to KaeleaAnn
    Level 8 (41,450 points)
    Mac OS X
    Aug 13, 2016 12:49 PM in response to KaeleaAnn

    KaeleaAnn wrote:

     

    I tried this, safe mode and regular, it doesn't come up in Safari, but it's still attached to Firefox.

    Is Safari free of this  SnowBitt search engine issue now?

     

     

     

    Firefox

    Remove search engine.

    If you haven’t  tried this already,please try it.

    https://support.mozilla.org/en-US/kb/add-or-remove-search-engine-firefox#w_remov e-search-engines_2

  • by KaeleaAnn,

    KaeleaAnn KaeleaAnn Aug 14, 2016 12:21 AM in response to dominic23
    Level 1 (4 points)
    Safari
    Aug 14, 2016 12:21 AM in response to dominic23

    Yes, I have tried that too countless times, it's still stuck in there and won't get me delete it. When I check it and hit the remove button and uncheck it and hit the remove button, nothing. It's also still in the top right hand search box as an option. Not sure if that matters.

     

    Safari seems to be completely free of it, no problems so far.

  • by dominic23,Solvedanswer

    dominic23 dominic23 Aug 14, 2016 2:37 AM in response to KaeleaAnn
    Level 8 (41,450 points)
    Mac OS X
    Aug 14, 2016 2:37 AM in response to KaeleaAnn

    Please try refreshing Firefox.

     

    https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings

  • by KaeleaAnn,

    KaeleaAnn KaeleaAnn Aug 14, 2016 2:52 AM in response to dominic23
    Level 1 (4 points)
    Safari
    Aug 14, 2016 2:52 AM in response to dominic23

    NAILED IT.

     

    Thanks so much!

  • by eltonlevin,

    eltonlevin eltonlevin Sep 4, 2016 6:27 PM in response to Eric Root
    Level 1 (4 points)
    Sep 4, 2016 6:27 PM in response to Eric Root

    This tip did the trick. I already ran a Malwarebytes Scan but the problem still went on: all my browsers frequently crashed and my search engines still defaults to Snowbitt / Safe finder. So I checked the Library folders and found a certain .exe file named "Quoroden," a "backup.zip" file, and a "Watch.log" file. Deleted them and fixed the problem.Screen Shot 2016-09-05 at 8.36.05 AM.png