Google search hijacked to yahoo

I hope someone can help with this. Yesterday I noticed any search in Google directed to Yahoo. I've tried all the suggestions online. There are no extensions in my preferences, I've cleaned out my cache, deleted all my history, I ran Malwarebytes, which found 3 PUP files and deleted them. This didn't sort the problem. I've manually searched for rogue apps or files in the library following some guidance on another page, but found nothing.

In developer mode in Safari I disabled javascript - I'm not a specialist, by this time was trying anything! - and it stopped the highjack to Yahoo and came up with an address in the browser (see below). I've searched for anything related to searchitnow but can't find it. I tried upgrading to Mojave hoping that it would solve it, but it didn't work either. There is some script being enabled when I do a Google search, I've downloaded Firefox and it isn't affected. Does anyone know if I can search for this Javascript command in terminal or something? I've spent hours on this and I'm getting nowhere.

https://goto-searchitnow.global.ssl.fastly.net/v1/hostedsearch?aid=29&data=aWlkP TY5ODYmdWlkPTE5NzU5NTcw&keyword=hom&apso…

iMac, macOS Mojave (10.14)

Posted on Sep 29, 2018 2:38 AM

35 replies

geecee55 Author

Level 1

7 points

Oct 1, 2018 5:24 AM in response to Will Hamlyn

It was the same for me Will. I theran Avast for Mac and it took hours but found more threats. But didn’t resolve the Google search hijack.

dominic23

Level 10

84,018 points

Oct 2, 2018 11:11 AM in response to geecee55

Launch Safari.

Clear the entry in the Search bar.

Click the magnifying glass icon in the search bar.

Choose Google from the dropdown.

If this helps, relaunch Safari holding the shift key down.

geecee55 Author

Level 1

7 points

Oct 2, 2018 9:57 AM in response to fionafromtaunton

I think it was a Flash download that was my downfall too. I realised a split second too late that it didn't look like the normal Flash update. I'm hoping someone will find a way to remove the offending command. Switching my search to Bing in Safari prefs stopped the hijack so I can use Safari again and get my passwords and bookmarks back. I just wish I could find the rogue file! I've been through all the processes in activity monitor and nothing 'seems' out of place. I have some Adobe stuff running. I'm actually beginning to wondering whether the rogue file is hiding in an Adobe process as it was pretending to be a Flash download.

Jan 28, 2019 12:41 PM in response to geecee55

I had this same malware infecting Firefox. In that case it seems to have had a pretty easy fix, just using the "Refresh Firefox" feature (which is Mozilla's general dummy fix for any problem, it pretty much just wipes out any add-ons you've got and preference changes you've made). I'm definitely going to invest in some antivirus software though, now.

Here's the link to Mozilla support, hope some find this useful:

https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings

This site seemed pretty useful generally:

https://malwaretips.com/blogs/remove-searchitnow-mac/

Eric Root

Level 10

685,311 points

Sep 30, 2018 5:46 PM in response to jinyoung_20

Please use the manual method or Malwarebytes. Do not download any other programs.

Mac Mechanic uninstall

Mac Mechanic uninstall (2)

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Google search hijacked to yahoo