Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Bing Redirect Virus on Mac

Just yesterday Safari started redirecting from my default browser (google) to bing. I looked at prior macfora, including how do i get rid of the bing redirect, have tried all of the suggestions, had no Genieo or any of the folders mentioned, nor do I have any extensions, and none of them were applicable (I had no and I have no extensions in Safari preferences, so there is no omnibar to remove, nor do I have any new or unusual applications, and my updates are current. Can someone inform me as to how to remove this bing redirect? Thank you!




[Re-Titled by Host]

MacBook Air (13-inch, Early 2015), macOS Sierra (10.12.6), null

Posted on Sep 29, 2018 7:01 PM

Reply
74 replies

Apr 13, 2019 9:27 AM in response to jmw_hhhs

Read this online and it works!!!! No sketchy apps needed to add more crap to your computer.


https://discussions.apple.com/thread/7476983?answerId=29849537022#29849537022




Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.


You installed one or more variants of the "InstallMac" trojan. Please take the steps below to disable it.


The criminal behind this attack tries to make the malware hard to remove by varying the names of the files it installs. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.


Back up all data before continuing.


1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:


~/Library/LaunchAgents


In the Finder, select


          Go ▹ Go to Folder...


from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return. A folder named "LaunchAgents" will open.


2. Inside the folder you just opened, there may be files with a name of any of these forms: (Note: I just removed all the plist files. They are rebuilt when the app is re-opened)


          something.AppRemoval.plist


          something.download.plist


          something.ltvbit.plist


          something.update.plist


Here something is usually a meaningless string, such as any of the following:


          Epolife


          InstallMac


          Javeview


          Kuklorest


          Manroling


          Otwexplain


These are examples, not a complete list. The string could be anything. The point is that the same string will usually appear in the name of three or four files.


Lately, the "InstallMac" attacker has been scrambling the strings "AppRemoval," "download," "ltvbit," and "update" in the names of his files. For example, you might see file names such as these, instead of the above:


          something.AppVemoral.plist


          something.dolnwoad.plist


          something.btvlit.plist


          something.uadpte.plist


You could have more than one copy of the malware, with different values of something.


Move all such items to the Trash. If there are any other files with a name that begins with something, move those to the Trash also. After you've done that, there may not be anything left in the LaunchAgents folder; in that case, you can delete the folder, but otherwise don't delete it. Other files in the folder are not necessarily malicious (though they could be, if you also installed some other kind of malware.)


Log out or restart the computer. The trojan should now be inactive.


3. This step is optional. Open the following folder as in Step 1:


~/Library/Application Support


and move to the Trash any subfolders with the name something that you found in Step 2.


Don't move the Application Support folder or anything else inside it.


4. Open the Applications folder. If there is an item named something, or "Zip Devil," or with any of the other names listed in Step 2, drag it to the Trash.


If in doubt, press the key combination option-command-4 to arrange the apps by date added. Look at the apps that have been added since you first noticed the problem. If there is one you don't recognize, drag it to the Trash.


You may get an alert that the item is locked. Confirm that you want to move it to the Trash.


Empty the Trash.


If you get an alert that the application is in use, force it to quit.


5. From the Safari menu bar, select


          Safari ▹ Preferences... ▹ Extensions


Uninstall all extensions you don't know you need. If in doubt, remove all of them. None is required for normal operation. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.


If the Preference window won't open, restart the computer in safe mode. Certain caches maintained by the system will be rebuilt.


6. Reset the home page in each of your browsers, if it was changed. In Safari, first load the home page you want, then select


          Safari ▹ Preferences... ▹ General


and click


          Set to Current Page

Nov 16, 2018 6:50 AM in response to Joanne127845

Download this program which was written by Thomas Reed, a long time poster. The program will search for malware/adware The program will do the work for you which makes it easy. There is no reason to leave it installed once troubleshooting is finished. The free version doesn't update itself. If you need it again, you can download it again.


Malwarebytes Anti-Malware for Mac 10.10 and later


Malwarebytes uninstall

Feb 12, 2019 6:48 AM in response to optomistic

  Use  the latest release of MalwareBytes for Mac to remove malware/adware.

 

     Install guide:       https://support.malwarebytes.com/docs/DOC-1817

     Uninstall Guide:  https://support.malwarebytes.com/docs/DOC-1190


     The installer may ask you to allow it in Security & Privacy  /System Preference. Allow it.

     Click the “Scan Now” button. Once done quit Malwarebytes for Mac.

May 1, 2019 3:10 AM in response to mmcdonold

Basically the instructions below are pretty wordy. I think for me, deleting the .plist files did the trick


https://discussions.apple.com/thread/7476983?answerId=29849537022#29849537022


Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

You installed one or more variants of the "InstallMac" trojan. Please take the steps below to disable it.

The criminal behind this attack tries to make the malware hard to remove by varying the names of the files it installs. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

Back up all data before continuing.


1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

Go ▹ Go to Folder...from the Menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return. A folder named "LaunchAgents" will open.


2. Inside the folder you just opened, there may be files with a name of any of these forms: (I deleted all my plist files and it worked! )

something.AppRemoval.plist

something.download.plist

something.ltvbit.plist

something.update.plist

Here something is usually a meaningless string, such as any of the following:

Epolife

InstallMac

Javeview

Kuklorest

Manroling

Otwexplain

These are examples, not a complete list. The string could be anything. The point is that the same string will usually appear in the name of three or four files.

Lately, the "InstallMac" attacker has been scrambling the strings "AppRemoval," "download," "ltvbit," and "update" in the names of his files. For example, you might see file names such as these, instead of the above:

something.AppVemoral.plist

something.dolnwoad.plist

something.btvlit.plist

something.uadpte.plist

You could have more than one copy of the malware, with different values of something.



Move all such items to the Trash. 


If there are any other files with a name that begins with something, move those to the Trash also. After you've done that, there may not be anything left in the LaunchAgents folder; in that case, you can delete the folder, but otherwise don't delete it. Other files in the folder are not necessarily malicious (though they could be, if you also installed some other kind of malware.)


Log out or restart the computer. The trojan should now be inactive.


3. This step is optional. 

Open the following folder as in Step 1:

~/Library/Application Support

and move to the Trash any subfolders with the name something that you found in Step 2.

Don't move the Application Support folder or anything else inside it.


4. Open the Applications folder. If there is an item named something, or "Zip Devil," or with any of the other names listed in Step 2, drag it to the Trash.

If in doubt, press the key combination option-command-4 to arrange the apps by date added. Look at the apps that have been added since you first noticed the problem. If there is one you don't recognize, drag it to the Trash.

You may get an alert that the item is locked. Confirm that you want to move it to the Trash.

Empty the Trash.

If you get an alert that the application is in use, force it to quit.


5. From the Safari menu bar, select

Safari ▹ Preferences... ▹ Extensions

Uninstall all extensions you don't know you need. If in doubt, remove all of them. None is required for normal operation. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.

If the Preference window won't open, restart the computer in safe mode. Certain caches maintained by the system will be rebuilt.


6. Reset the home page in each of your browsers, if it was changed. In Safari, first load the home page you want, then select

Safari ▹ Preferences... ▹ General

and click

Set to Current Page


May 6, 2019 5:53 PM in response to jmw_hhhs

The same thing happened to me and after manually trying to remove the redirect virus without success I finally called apple support who advised me to download Malwarebytes. I installed it and after a scan it found a few problems which it resolved after a restart of my computer. I inquired about it and Malwarebytes is apparently the only apple recommended software. Good luck!

May 22, 2019 3:23 PM in response to jmw_hhhs

Thank you, Eric Root!!!

I echo others' posts - Malwarebytes was fast and efficient, and very quickly cleared the problem.


Spent way too much time trying to remove Bing redirect and Mac Cleanup before finding your post.

Reading other blogs and e-magazine "best of antivirus software" articles, had tried manually going through to remove "questionable" files, extentions etc, then tried Avast - waited for long download, and long search, and it did remove some 'problem files' but Bing redirect still persisted!!! Hours of frustration. Then found your post - wish I had looked to the Apple community earlier.


Thank you thank you for your post, complete with the helpful links!!! Well done.

May 31, 2019 5:39 PM in response to jmw_hhhs

I spent days trying to find a manual solution without having to install anti-virus. Save yourself the time and get malwarebytes for free, you will have the issue resolved in minutes. Malwarebytes is great for adware/malware removal, apparently not so good at stopping your computer from getting infected in the first place, but excellent at removing these nasties.

Aug 12, 2019 4:32 AM in response to jmw_hhhs

Ok so I got this virus literally like an hour ago and i was stressing about it for so long.

i figured out through many websites and replies that you need to open finder and go to the menu at the top of your screen. next to 'view' there should be a 'go' button. press on that and search for ~library/launchpad or something similar and there will be files that come up. move all of them to the trash and empty it. then restart your mac and it should be gone.

Aug 16, 2019 4:23 AM in response to jmw_hhhs

After days of trying every online DYI suggestion, I finally downloaded the free Avast Security app from Apple app store - not the paid version. I was not optimistic but the bing redirect was finally removed when I did the Mac Scan on the Avast app, and then as prompted clicked the button to resolve the issues it found. The Bing redirect is finally gone. This was a week ago and it hasn't reappeared.

Aug 29, 2019 2:26 PM in response to batfile9722

Thank you so much for this! It’s this manual solution that worked for me! Going to launchagent and removing the plist files! The Malwarebytes software did find issues but deleting those wasn’t resolving it.


Christ that redirect was driving me insane!!!! It was only affecting chrome but that’s my most used browser.


So Happy it’s gone!!! Thank you!!!

Bing Redirect Virus on Mac

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.