Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Google search hijacked to yahoo

I hope someone can help with this. Yesterday I noticed any search in Google directed to Yahoo. I've tried all the suggestions online. There are no extensions in my preferences, I've cleaned out my cache, deleted all my history, I ran Malwarebytes, which found 3 PUP files and deleted them. This didn't sort the problem. I've manually searched for rogue apps or files in the library following some guidance on another page, but found nothing.

In developer mode in Safari I disabled javascript - I'm not a specialist, by this time was trying anything! - and it stopped the highjack to Yahoo and came up with an address in the browser (see below). I've searched for anything related to searchitnow but can't find it. I tried upgrading to Mojave hoping that it would solve it, but it didn't work either. There is some script being enabled when I do a Google search, I've downloaded Firefox and it isn't affected. Does anyone know if I can search for this Javascript command in terminal or something? I've spent hours on this and I'm getting nowhere.


https://goto-searchitnow.global.ssl.fastly.net/v1/hostedsearch?aid=29&data=aWlkP TY5ODYmdWlkPTE5NzU5NTcw&keyword=hom&apso…

iMac, macOS Mojave (10.14)

Posted on Sep 29, 2018 2:38 AM

Reply
Question marked as Best reply

Posted on Sep 29, 2018 4:16 AM

1. Remove any Profile you have not installed knowingly.


Profiles

System Preferences > Profiles

Launch System Preferences. Do you see any profiles added to the pane at the bottom next to Accessibility?

How to remove a configuration profile? https://support.apple.com/kb/PH25680?locale=en_US

User uploaded file

2.Remove Adware/Malware installed on your Mac without your knowledge.


Please take all these steps.


1. Use MalwareBytes for Mac to remove malware/adware.


Install guide: https://support.malwarebytes.com/docs/DOC-1817

Uninstall Guide: https://support.malwarebytes.com/docs/DOC-1190


The installer may ask you to allow it in Security & Privacy /System Preference. Allow it.


2. Choose a search engine.

Delete all text in the Smart Search field, click the magnifying glass , then choose a search engine from the list.

https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac


3. Set your Home Page. https://support.apple.com/guide/safari/set-your-homepage-ibrw1020/mac

4. Restart your Mac.

5. Launch Safari holding the Shift key down.

35 replies
Question marked as Best reply

Sep 29, 2018 4:16 AM in response to geecee55

1. Remove any Profile you have not installed knowingly.


Profiles

System Preferences > Profiles

Launch System Preferences. Do you see any profiles added to the pane at the bottom next to Accessibility?

How to remove a configuration profile? https://support.apple.com/kb/PH25680?locale=en_US

User uploaded file

2.Remove Adware/Malware installed on your Mac without your knowledge.


Please take all these steps.


1. Use MalwareBytes for Mac to remove malware/adware.


Install guide: https://support.malwarebytes.com/docs/DOC-1817

Uninstall Guide: https://support.malwarebytes.com/docs/DOC-1190


The installer may ask you to allow it in Security & Privacy /System Preference. Allow it.


2. Choose a search engine.

Delete all text in the Smart Search field, click the magnifying glass , then choose a search engine from the list.

https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac


3. Set your Home Page. https://support.apple.com/guide/safari/set-your-homepage-ibrw1020/mac

4. Restart your Mac.

5. Launch Safari holding the Shift key down.

Oct 29, 2018 10:15 PM in response to geecee55

I was stumped by this issue as well but after searching and searching every possible solution, I finally found a website that gave me 4 options to remove the infected malware/adware. This is the website:


https://www.pcrisk.com/removal-guides/11494-searchanysearchcom-redirect-mac#a2


Scroll down to the middle of the page until you see this:


What is search.anysearch.net?


Steps #1 & 2 were the saviors for me. I hope this helps whoever comes upon this issue in the future.

Dec 17, 2018 1:32 AM in response to geecee55

I too clicked on a malware flash upgrade and in spite of rapidly cancelling some of it installed. The google redirect to yahoo I found in Safari's extensions, called Searchit.

I deleted it and now it's not redirecting. Malwarebytes also found some associated adware files

Overall though it's the Boaz “Virus” Search Tool. Lot's of entries in google.


Sep 29, 2018 6:31 AM in response to dominic23

Thanks for taking the time to reply. I followed all of your advice and restarted my Mac. On first opening Safari, my first search worked and I gave a little cheer, the second however was redirected to the Yahoo page again. I downloaded Avast for Mac as I saw a review that said it was very good at finding malware. The scan ran for a couple of hours and found and quarantined 14 suspect files, which I deleted. This still did not delete the Google hijacking. If I put a website in the Safari address line it will connect properly, but anything in the search box triggers the redirect. It's getting very frustrating as I just can't figure out where it is hiding!

Sep 29, 2018 7:33 AM in response to Eric Root

Hi Eric, thanks for your suggestion. I've already check for extensions in prefs and there weren't any. I'm really struggling to find a solution to this problem. I can't find what's triggering the command within a Google search. It seems to be a javascript command that's triggered when something is entered into the search box or I select the advanced search hyperlink on the Google page. I can input a web address in Safari without it being hijacked.

Sep 30, 2018 3:37 AM in response to Eric Root

Hi Eric, thanks again for taking the time to reply and for the link. I had already come across this site but unfortunately I don't have any extensions in my Safari prefs, there are no unknown apps in my application folder and my Safari settings were already set to search with Google and my homepage is set for Google, I can't reset Safari as that option is no longer offered in Mohave although I followed someone's instructions to delete saved Safari files to try and manually reset Safari but with no success.


Every solution I look for on the web seems to offer similar fixes but none of them apply to my issue. The only thing I have discovered is that a rogue javascript command is initiated only when there is content put in Google's search box, or the advanced search link is clicked. I can put a web address into Google and it performs normally. The issue is trying to find where this command is buried. I was hoping there may be some way of searching through console to find the command and switch it off. I tried to revert Safari, through Time Machine, to the previous day before the issue, but the system wouldn't let me. Is it possible to manually unistall Safari?

Sep 30, 2018 11:02 AM in response to geecee55

As a bit of an update, still not eradicated the offending file, but I found that changing my search from Google to Bing within Safari prefs stops the hijack to Yahoo. I then tried deleting everything on my Mac that includes Google in any shape or form in case some rogue file had found it's way in there, but this had not effect. I've narrowed it down to something in my account that only affects Safari when searching with Google!

At least I can now use Safari again. I will keep pursuing the issue and update if I ever get to the bottom of it and get Google back again.

Sep 30, 2018 11:19 AM in response to geecee55

It may not help, but try downloading this program which was written by Thomas Reed, a long time poster. The program will search for malware/adware The program will do the work for you which makes it easy. There is no reason to leave it installed once troubleshooting is finished. The free version doesn't update itself. If you need it again, you can download it again.


Malwarebytes Anti-Malware for Mac 10.10 and later


Malwarebytes uninstall

Sep 30, 2018 1:56 PM in response to Eric Root

I have the same issue, only effects Safari when using Google, no malware detected using any of the options Malwarebytes, Bit Defender or Reimage. Plist prefs deleted and no extensions present


I'm pretty sure this came from what I thought was a Flash update I clicked on it and then realised it had no Adobe logo on it but sadly not before it had done it's dirty work.


Anybody have any more ideas as to how to fix this? Must be more than two of us with the problem! Is there any way of forcing a clean install of Safari?

Sep 30, 2018 2:43 PM in response to jinyoung_20

Through a bit of trial and error I've fixed it, look at your login items under system prefs/users groups


I found one in there called Mac Mechanic had a little yellow warning triangle next to it. I do vaguely remember that popping up when I ran the fake Flash update, didn't install it but it presumably installed itself as part of the fake install.


Removed it, restarted the Mac and hey presto no more Google redirects!

Google search hijacked to yahoo

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.