A few days ago a popup appeared in Safari about "an update"; Safari closed & since then links from emails no longer work: a tab with just a search field appears. Is this an attack?

A few days ago an "update notice" popup appeared in Safari, then Safari closed & since then links from emails no longer work - instead of the appropriate website, a screen in a new tab with just a search field appears. The same happens with opening a new tab - the usual Top Sites appears briefly but is then replaced with the blank page with a search field. Is this an attack by Spectre or Meltdown? I checked Updates on the App Store, which does not show any Safari update in the last 30 days. What can I do if this is an attack?

iMac (Retina 4K, 21.5-inch, 2017), iOS 11.4

Posted on Jun 30, 2018 1:42 PM

Reply
Question marked as Top-ranking reply

Posted on Jul 1, 2018 11:34 PM

Thanks Eric. As it turns out, I took another look at the mysterious search field and realized it said "AnySearchManager." A quick search revealed that this is another notorious malware/adware akin to the equally notorious MacKeeper (don't anyone EVER download and install MacKeeper, which will take over your browser and make it unusable). AnySearchManager comes along with a fake Adobe Flash updater (or maybe a fake Adobe Reader updater). I do remember getting a Flash notice and must have gone ahead and "updated" it, which installed AnySearchManager in Safari.


After much searching, I did two things to eliminate it: first, in the Finder click Go>Go to Folder and enter /Library/LaunchAgents; in that folder look for a suspicious file installed recently. In this case it was called something like "SearchSystem." You move it to the trash and empty the trash. I searched for AnySearchManager and other names I found online using Spotlight but couldn't find anything. Then I remembered I had installed the Malwarebytes Anti-Malware app, which is legitimate, and ran it. It immediately found the offending files and deleted them. I forget what they were called, but apparently they keep changing names in any case. So if anyone starts seeing the AnySearchManager screen in Safari when you click a link or open a new tab, it's malware/adware and the system I described will find and delete it.

3 replies
Question marked as Top-ranking reply

Jul 1, 2018 11:34 PM in response to Eric Root

Thanks Eric. As it turns out, I took another look at the mysterious search field and realized it said "AnySearchManager." A quick search revealed that this is another notorious malware/adware akin to the equally notorious MacKeeper (don't anyone EVER download and install MacKeeper, which will take over your browser and make it unusable). AnySearchManager comes along with a fake Adobe Flash updater (or maybe a fake Adobe Reader updater). I do remember getting a Flash notice and must have gone ahead and "updated" it, which installed AnySearchManager in Safari.


After much searching, I did two things to eliminate it: first, in the Finder click Go>Go to Folder and enter /Library/LaunchAgents; in that folder look for a suspicious file installed recently. In this case it was called something like "SearchSystem." You move it to the trash and empty the trash. I searched for AnySearchManager and other names I found online using Spotlight but couldn't find anything. Then I remembered I had installed the Malwarebytes Anti-Malware app, which is legitimate, and ran it. It immediately found the offending files and deleted them. I forget what they were called, but apparently they keep changing names in any case. So if anyone starts seeing the AnySearchManager screen in Safari when you click a link or open a new tab, it's malware/adware and the system I described will find and delete it.

Jul 1, 2018 1:47 PM in response to Lorenxo22

Safari/Preferences/Advanced - enable the Develop menu, then go there and Empty Caches. Quit/reopen Safari and test. Then try Safari/History/Show History and delete all history items. Quit/reopen Safari and test. You can also try try Safari/Clear History…. The down side is it clears all cookies. Doing this may cause some sites to no longer recognize your computer as one that has visited the web site. Go to Finder and select your user/home folder. With that Finder window as the front window, either select Finder/View/Show View options or go command - J. When the View options opens, check ’Show Library Folder’. That should make your user library folder visible in your user/home folder. Select Library/Caches/com.apple.Safari/Cache.db and move it to the trash.


Go to Safari Preferences/Extensions and turn all extensions off. Test. If okay, turn the extensions on one by one until you figure out what extension is causing the problem.


Safari Corruption See post by Linc Davis


If that doesn't work, try running this program in your normal user account , then copy and paste the output in a reply. The program was created by etresoft, a frequent contributor. Please use copy and paste as screen shots can be hard to read. On the screen with Options, please open Options and check the bottom 2 boxes before running. Click “Share Report” button in the toolbar, select “Copy Report” and then paste into a reply. This will show what is running on your computer. No personal information is shown.

Etrecheck – System Information

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

A few days ago a popup appeared in Safari about "an update"; Safari closed & since then links from emails no longer work: a tab with just a search field appears. Is this an attack?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.