Level 1

7 points

Google search hijacked to yahoo

I hope someone can help with this. Yesterday I noticed any search in Google directed to Yahoo. I've tried all the suggestions online. There are no extensions in my preferences, I've cleaned out my cache, deleted all my history, I ran Malwarebytes, which found 3 PUP files and deleted them. This didn't sort the problem. I've manually searched for rogue apps or files in the library following some guidance on another page, but found nothing.

In developer mode in Safari I disabled javascript - I'm not a specialist, by this time was trying anything! - and it stopped the highjack to Yahoo and came up with an address in the browser (see below). I've searched for anything related to searchitnow but can't find it. I tried upgrading to Mojave hoping that it would solve it, but it didn't work either. There is some script being enabled when I do a Google search, I've downloaded Firefox and it isn't affected. Does anyone know if I can search for this Javascript command in terminal or something? I've spent hours on this and I'm getting nowhere.

https://goto-searchitnow.global.ssl.fastly.net/v1/hostedsearch?aid=29&data=aWlkP TY5ODYmdWlkPTE5NzU5NTcw&keyword=hom&apso…

iMac, macOS Mojave (10.14)

Posted on Sep 29, 2018 2:38 AM

35 replies

geecee55 Author

Level 1

7 points

Sep 29, 2018 7:33 AM in response to Eric Root

Hi Eric, thanks for your suggestion. I've already check for extensions in prefs and there weren't any. I'm really struggling to find a solution to this problem. I can't find what's triggering the command within a Google search. It seems to be a javascript command that's triggered when something is entered into the search box or I select the advanced search hyperlink on the Google page. I can input a web address in Safari without it being hijacked.

geecee55 Author

Level 1

7 points

Sep 30, 2018 3:37 AM in response to Eric Root

Hi Eric, thanks again for taking the time to reply and for the link. I had already come across this site but unfortunately I don't have any extensions in my Safari prefs, there are no unknown apps in my application folder and my Safari settings were already set to search with Google and my homepage is set for Google, I can't reset Safari as that option is no longer offered in Mohave although I followed someone's instructions to delete saved Safari files to try and manually reset Safari but with no success.

Every solution I look for on the web seems to offer similar fixes but none of them apply to my issue. The only thing I have discovered is that a rogue javascript command is initiated only when there is content put in Google's search box, or the advanced search link is clicked. I can put a web address into Google and it performs normally. The issue is trying to find where this command is buried. I was hoping there may be some way of searching through console to find the command and switch it off. I tried to revert Safari, through Time Machine, to the previous day before the issue, but the system wouldn't let me. Is it possible to manually unistall Safari?

Eric Root

Level 10

685,311 points

Sep 30, 2018 6:47 AM in response to geecee55

You are welcome. You can't manually uninstall Safari as it is part of the OS. To recover Safari from your backup, you need to do a full restore. Individual applications that are part of the OS can't be restored.

geecee55 Author

Level 1

7 points

Sep 30, 2018 9:22 AM in response to Eric Root

Thanks Eric, I tried creating a new account and Safari operates normally in it so I don't think a clean install would help anyway, it's something that's tied into my account. It's so frustrating that I can't find the source of this redirect and I've spent hours trying to find a solution.

Sep 30, 2018 1:56 PM in response to Eric Root

I have the same issue, only effects Safari when using Google, no malware detected using any of the options Malwarebytes, Bit Defender or Reimage. Plist prefs deleted and no extensions present

I'm pretty sure this came from what I thought was a Flash update I clicked on it and then realised it had no Adobe logo on it but sadly not before it had done it's dirty work.

Anybody have any more ideas as to how to fix this? Must be more than two of us with the problem! Is there any way of forcing a clean install of Safari?

Oct 1, 2018 4:37 AM in response to Eric Root

Have to say Malwarebytes found nothing, told me my system was fine which clearly it wasn't.

Most of the time it just tells me " Background service is off" and doesn't work so I don't hold much score by it!

Oct 2, 2018 2:30 AM in response to geecee55

Exactly the same for me - clicked a flash update which wasn't what it claimed to be. Used Malwarebytes, which removed a load of suspect files, but am left with this irritating yahoo redirect from google in safari. Have read all the same advice, tried it all, no luck. Await some genius to come along with the fix!

geecee55 Author

Level 1

7 points

Oct 3, 2018 10:26 AM in response to fionafromtaunton

AAAAAmazing!!! Thanks so much for posting again. I've run Malwarebytes several times over the past week with no luck. I read your message earlier today on my phone and was hoping that it would work for me too. First thing I did when I got home! The scan took a bit longer than previously and it found two files. A quick restart later and I have Safari back again! Thanks for sharing.

cheripie

Level 1

4 points

Dec 15, 2018 4:49 PM in response to Will Hamlyn

There's at least three of us. It seems like when I updated my High Sierra to Mojave, the trouble started. I'll try goggling something, will get a google page pop up for half a second, then something in my search bar that begins "my-search . . . . " and I default to Yahoo. I have bitdefender, but it doesn't seem to help. Making me crazy.

sagushi

Level 1

4 points

Jan 24, 2019 11:25 AM in response to Will Hamlyn

it did work! I’m struggling on this problem for an hour! Usually it suggests me to install malverawz software, which I think it might bring more virus....until I find this method.

This is helpful.

Thanks.

Eric Root

Level 10

685,311 points

Sep 29, 2018 7:20 AM in response to geecee55

Go to Safari Preferences/Extensions and turn all extensions off. Test. If okay, turn the extensions on one by one until you figure out what extension is causing the problem.

Sep 29, 2018 2:57 PM in response to geecee55

Hi there, It looks like I am struggling with the same problem. Have you fixed the issue?

geecee55 Author

Level 1

7 points

Sep 30, 2018 3:21 AM in response to jinyoung_20

Not yet, very frustrating.

Sep 30, 2018 2:00 PM in response to Will Hamlyn

Exact same thing happening to me too here! only when using Google search in safari so frustrating to know that nothing works to fix this issue

Sep 30, 2018 3:10 PM in response to Will Hamlyn

Ah that's great! I just went to system and I could see the exact same one the Mac Mechanic with a yellow waning next to it too so I deleted but oh god still not working Jesus!

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Google search hijacked to yahoo