Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

7 points

Google search hijacked to yahoo

I hope someone can help with this. Yesterday I noticed any search in Google directed to Yahoo. I've tried all the suggestions online. There are no extensions in my preferences, I've cleaned out my cache, deleted all my history, I ran Malwarebytes, which found 3 PUP files and deleted them. This didn't sort the problem. I've manually searched for rogue apps or files in the library following some guidance on another page, but found nothing.

In developer mode in Safari I disabled javascript - I'm not a specialist, by this time was trying anything! - and it stopped the highjack to Yahoo and came up with an address in the browser (see below). I've searched for anything related to searchitnow but can't find it. I tried upgrading to Mojave hoping that it would solve it, but it didn't work either. There is some script being enabled when I do a Google search, I've downloaded Firefox and it isn't affected. Does anyone know if I can search for this Javascript command in terminal or something? I've spent hours on this and I'm getting nowhere.

https://goto-searchitnow.global.ssl.fastly.net/v1/hostedsearch?aid=29&data=aWlkP TY5ODYmdWlkPTE5NzU5NTcw&keyword=hom&apso…

iMac, macOS Mojave (10.14)

Posted on Sep 29, 2018 2:38 AM

Best reply

dominic23

Level 10

83,916 points

Posted on Sep 29, 2018 4:16 AM

1. Remove any Profile you have not installed knowingly.

Profiles

System Preferences > Profiles

Launch System Preferences. Do you see any profiles added to the pane at the bottom next to Accessibility?

How to remove a configuration profile? https://support.apple.com/kb/PH25680?locale=en_US

2.Remove Adware/Malware installed on your Mac without your knowledge.

Please take all these steps.

1. Use MalwareBytes for Mac to remove malware/adware.

Install guide: https://support.malwarebytes.com/docs/DOC-1817

Uninstall Guide: https://support.malwarebytes.com/docs/DOC-1190

The installer may ask you to allow it in Security & Privacy /System Preference. Allow it.

2. Choose a search engine.

Delete all text in the Smart Search field, click the magnifying glass , then choose a search engine from the list.

https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac

3. Set your Home Page. https://support.apple.com/guide/safari/set-your-homepage-ibrw1020/mac

4. Restart your Mac.

5. Launch Safari holding the Shift key down.

View in context

35 replies

geecee55 Author

Level 1

7 points

Oct 1, 2018 5:36 AM in response to Will Hamlyn

I’m not sure a clean install will work as I created a new account on my Mac and Safari works fine. It’s obviously linked into your account somewhere rather than just Safari. If you switch off java script via the developer menu, it stops the link to Yahoo happening and instead shows the java script command that’s forcing the search to the Yahoo page. If there is some way of searching for this command I think we could finally get to the bottom of it.

Oct 1, 2018 8:14 AM in response to geecee55

Yes I tried the same thing. Removing it as a login item seems to have worked for me at least. I did try and search for any residual files but to no avail. I guess they are pretty well hidden but hopefully will remain dormant. Sadly I don't know enough about the deep level files to track them down.

Oct 2, 2018 2:30 AM in response to geecee55

Exactly the same for me - clicked a flash update which wasn't what it claimed to be. Used Malwarebytes, which removed a load of suspect files, but am left with this irritating yahoo redirect from google in safari. Have read all the same advice, tried it all, no luck. Await some genius to come along with the fix!

geecee55 Author

Level 1

7 points

Oct 2, 2018 9:57 AM in response to fionafromtaunton

I think it was a Flash download that was my downfall too. I realised a split second too late that it didn't look like the normal Flash update. I'm hoping someone will find a way to remove the offending command. Switching my search to Bing in Safari prefs stopped the hijack so I can use Safari again and get my passwords and bookmarks back. I just wish I could find the rogue file! I've been through all the processes in activity monitor and nothing 'seems' out of place. I have some Adobe stuff running. I'm actually beginning to wondering whether the rogue file is hiding in an Adobe process as it was pretending to be a Flash download.

Oct 3, 2018 1:33 AM in response to dominic23

Thanks Dominic - unfortunately, this wasn't working for any of us. However, good news! Malwarebytes has picked it up this morning (it didn't previously) and I have my Google search back in Safari. Phew

geecee55 Author

Level 1

7 points

Oct 3, 2018 10:26 AM in response to fionafromtaunton

AAAAAmazing!!! Thanks so much for posting again. I've run Malwarebytes several times over the past week with no luck. I read your message earlier today on my phone and was hoping that it would work for me too. First thing I did when I got home! The scan took a bit longer than previously and it found two files. A quick restart later and I have Safari back again! Thanks for sharing.

cheripie

Level 1

4 points

Dec 15, 2018 4:49 PM in response to Will Hamlyn

There's at least three of us. It seems like when I updated my High Sierra to Mojave, the trouble started. I'll try goggling something, will get a google page pop up for half a second, then something in my search bar that begins "my-search . . . . " and I default to Yahoo. I have bitdefender, but it doesn't seem to help. Making me crazy.

sagushi

Level 1

4 points

Jan 24, 2019 11:25 AM in response to Will Hamlyn

it did work! I’m struggling on this problem for an hour! Usually it suggests me to install malverawz software, which I think it might bring more virus....until I find this method.

This is helpful.

Thanks.

Jan 28, 2019 12:41 PM in response to geecee55

I had this same malware infecting Firefox. In that case it seems to have had a pretty easy fix, just using the "Refresh Firefox" feature (which is Mozilla's general dummy fix for any problem, it pretty much just wipes out any add-ons you've got and preference changes you've made). I'm definitely going to invest in some antivirus software though, now.

Here's the link to Mozilla support, hope some find this useful:

https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings

This site seemed pretty useful generally:

https://malwaretips.com/blogs/remove-searchitnow-mac/

aja_59

Level 1

4 points

Feb 22, 2019 1:03 AM in response to Will Hamlyn

Sorry to drag this thread back up, but I'm having this same Yahoo issue. I found the same Mac icons in my user groups, but I cannot seem to delete them. Please can you tell me how you did this? Each time I try to remove them it returns me back to my main systems pref menu saying there "There was an error in Users & Groups preferences." I'm at a loss now and very frustrated!

Thanks, any help would be great.

Sorted - just re-started everything and tried to delete again and it's worked! No more Yahoo direct!

dominic23

Level 10

83,916 points

Oct 2, 2018 11:11 AM in response to geecee55

Launch Safari.

Clear the entry in the Search bar.

Click the magnifying glass icon in the search bar.

Choose Google from the dropdown.

If this helps, relaunch Safari holding the shift key down.

Oct 3, 2018 1:35 AM in response to geecee55

Exactly what happened to me. Anyway, good news - try running malware bytes again - i did this morning, and it found a couple of dodgy files, which it hadn't before. Got my google search back.

trivanks

Level 1

9 points

Feb 22, 2019 12:11 PM in response to geecee55

Follow this threads i have given the answer there hope you like this task is so easy to perform for the your browser visit Redirecting to yahoo search - Apple Community

Eric Root

Level 10

684,039 points

Sep 29, 2018 7:20 AM in response to geecee55

Go to Safari Preferences/Extensions and turn all extensions off. Test. If okay, turn the extensions on one by one until you figure out what extension is causing the problem.

Sep 29, 2018 2:57 PM in response to geecee55

Hi there, It looks like I am struggling with the same problem. Have you fixed the issue?

Google search hijacked to yahoo