Google search hijacked to yahoo

Question

Level 1

7 points

Google search hijacked to yahoo

I hope someone can help with this. Yesterday I noticed any search in Google directed to Yahoo. I've tried all the suggestions online. There are no extensions in my preferences, I've cleaned out my cache, deleted all my history, I ran Malwarebytes, which found 3 PUP files and deleted them. This didn't sort the problem. I've manually searched for rogue apps or files in the library following some guidance on another page, but found nothing.

In developer mode in Safari I disabled javascript - I'm not a specialist, by this time was trying anything! - and it stopped the highjack to Yahoo and came up with an address in the browser (see below). I've searched for anything related to searchitnow but can't find it. I tried upgrading to Mojave hoping that it would solve it, but it didn't work either. There is some script being enabled when I do a Google search, I've downloaded Firefox and it isn't affected. Does anyone know if I can search for this Javascript command in terminal or something? I've spent hours on this and I'm getting nowhere.

https://goto-searchitnow.global.ssl.fastly.net/v1/hostedsearch?aid=29&data=aWlkP TY5ODYmdWlkPTE5NzU5NTcw&keyword=hom&apso…

iMac, macOS Mojave (10.14)

Posted on Sep 29, 2018 2:38 AM

Reply

Answer 1

DondiGBD

Level 1

8 points

Oct 29, 2018 10:15 PM in response to geecee55

I was stumped by this issue as well but after searching and searching every possible solution, I finally found a website that gave me 4 options to remove the infected malware/adware. This is the website:

https://www.pcrisk.com/removal-guides/11494-searchanysearchcom-redirect-mac#a2

Scroll down to the middle of the page until you see this:

What is search.anysearch.net?

Steps #1 & 2 were the saviors for me. I hope this helps whoever comes upon this issue in the future.

Reply

Answer 2

Sep 30, 2018 2:43 PM in response to jinyoung_20

Through a bit of trial and error I've fixed it, look at your login items under system prefs/users groups

I found one in there called Mac Mechanic had a little yellow warning triangle next to it. I do vaguely remember that popping up when I ran the fake Flash update, didn't install it but it presumably installed itself as part of the fake install.

Removed it, restarted the Mac and hey presto no more Google redirects!

Reply

Answer 3

Feb 5, 2019 10:42 AM in response to geecee55

Hi! I was having the same problem. My search bar was set to google. Couldn’t figure out the problem until:

go to your SAFARI PREFERENCES
click “EXTENSIONS”
if there is an extension named “SEARCH IT!” or anything else that you didn’t sign up for in there, DELETE IT!

That should solve it!

Reply

Answer 4

Oct 3, 2018 1:35 AM in response to geecee55

Exactly what happened to me. Anyway, good news - try running malware bytes again - i did this morning, and it found a couple of dodgy files, which it hadn't before. Got my google search back.

Reply

Answer 5

Eric Root

Level 10

685,293 points

Sep 30, 2018 11:19 AM in response to geecee55

It may not help, but try downloading this program which was written by Thomas Reed, a long time poster. The program will search for malware/adware The program will do the work for you which makes it easy. There is no reason to leave it installed once troubleshooting is finished. The free version doesn't update itself. If you need it again, you can download it again.

Malwarebytes Anti-Malware for Mac 10.10 and later

Malwarebytes uninstall

Reply

Answer 6

Eric Root

Level 10

685,293 points

Sep 29, 2018 5:45 PM in response to geecee55

Please do a manual uninstall and do not download anything but Malwarebytes.

See if the below helps. I would scroll down to the below or you might fall asleep.

Step 1. Eliminate Yahoo Redirect from Windows
Step 2. Delete Yahoo Redirect from Mac OS X
Step 3. Uninstall Yahoo Redirect from Internet Explorer
Step 4. Remove Yahoo Redirect from Microsoft Edge
Step 5. Erase Yahoo Redirect from Mozilla Firefox
Step 6. Get rid of Yahoo Redirect from Google Chrome
Step 7. Eliminate Yahoo Redirect from Safari

https://www.2-spyware.com/remove-yahoo-redirect-virus.html

Reply

Answer 7

Oct 1, 2018 8:14 AM in response to geecee55

Yes I tried the same thing. Removing it as a login item seems to have worked for me at least. I did try and search for any residual files but to no avail. I guess they are pretty well hidden but hopefully will remain dormant. Sadly I don't know enough about the deep level files to track them down.

Reply

Answer 8

trivanks

Level 1

9 points

Feb 22, 2019 12:11 PM in response to geecee55

Follow this threads i have given the answer there hope you like this task is so easy to perform for the your browser visit Redirecting to yahoo search - Apple Community

Reply

Answer 9

geecee55 Author

Level 1

7 points

Sep 30, 2018 11:02 AM in response to geecee55

As a bit of an update, still not eradicated the offending file, but I found that changing my search from Google to Bing within Safari prefs stops the hijack to Yahoo. I then tried deleting everything on my Mac that includes Google in any shape or form in case some rogue file had found it's way in there, but this had not effect. I've narrowed it down to something in my account that only affects Safari when searching with Google!

At least I can now use Safari again. I will keep pursuing the issue and update if I ever get to the bottom of it and get Google back again.

Reply

Answer 10

geecee55 Author

Level 1

7 points

Oct 1, 2018 5:36 AM in response to Will Hamlyn

I’m not sure a clean install will work as I created a new account on my Mac and Safari works fine. It’s obviously linked into your account somewhere rather than just Safari. If you switch off java script via the developer menu, it stops the link to Yahoo happening and instead shows the java script command that’s forcing the search to the Yahoo page. If there is some way of searching for this command I think we could finally get to the bottom of it.

Reply

Answer 11

Oct 3, 2018 1:33 AM in response to dominic23

Thanks Dominic - unfortunately, this wasn't working for any of us. However, good news! Malwarebytes has picked it up this morning (it didn't previously) and I have my Google search back in Safari. Phew

Reply

Answer 12

Dec 17, 2018 1:32 AM in response to geecee55

I too clicked on a malware flash upgrade and in spite of rapidly cancelling some of it installed. The google redirect to yahoo I found in Safari's extensions, called Searchit.

I deleted it and now it's not redirecting. Malwarebytes also found some associated adware files

Overall though it's the Boaz “Virus” Search Tool. Lot's of entries in google.

Reply

Answer 13

aja_59

Level 1

4 points

Feb 22, 2019 1:03 AM in response to Will Hamlyn

Sorry to drag this thread back up, but I'm having this same Yahoo issue. I found the same Mac icons in my user groups, but I cannot seem to delete them. Please can you tell me how you did this? Each time I try to remove them it returns me back to my main systems pref menu saying there "There was an error in Users & Groups preferences." I'm at a loss now and very frustrated!

Thanks, any help would be great.

Sorted - just re-started everything and tried to delete again and it's worked! No more Yahoo direct!

Reply

Answer 14

dominic23

Level 10

84,018 points

Sep 29, 2018 4:16 AM in response to geecee55

1. Remove any Profile you have not installed knowingly.

Profiles

System Preferences > Profiles

Launch System Preferences. Do you see any profiles added to the pane at the bottom next to Accessibility?

How to remove a configuration profile? https://support.apple.com/kb/PH25680?locale=en_US

2.Remove Adware/Malware installed on your Mac without your knowledge.

Please take all these steps.

1. Use MalwareBytes for Mac to remove malware/adware.

Install guide: https://support.malwarebytes.com/docs/DOC-1817

Uninstall Guide: https://support.malwarebytes.com/docs/DOC-1190

The installer may ask you to allow it in Security & Privacy /System Preference. Allow it.

2. Choose a search engine.

Delete all text in the Smart Search field, click the magnifying glass , then choose a search engine from the list.

https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac

3. Set your Home Page. https://support.apple.com/guide/safari/set-your-homepage-ibrw1020/mac

4. Restart your Mac.

5. Launch Safari holding the Shift key down.

Reply

Answer 15

geecee55 Author

Level 1

7 points

Sep 29, 2018 6:31 AM in response to dominic23

Thanks for taking the time to reply. I followed all of your advice and restarted my Mac. On first opening Safari, my first search worked and I gave a little cheer, the second however was redirected to the Yahoo page again. I downloaded Avast for Mac as I saw a review that said it was very good at finding malware. The scan ran for a couple of hours and found and quarantined 14 suspect files, which I deleted. This still did not delete the Google hijacking. If I put a website in the Safari address line it will connect properly, but anything in the search box triggers the redirect. It's getting very frustrating as I just can't figure out where it is hiding!

Reply