Web browser hijacked! [UPDATE]

"Chariotoflove" (chariotoflove) 09/29/2018 at 16:00 • Filed to: computer std

0

37

Update: Thanks to everyone who chi med in with suggestions. You guys are the best. I i nstalled Malwarebytes at the recommendation of token_liberal and Galileo Humpkins and ran a scan. The scan found an adware file in my Application Support Lib rary called “YahooEngine.xml”, as well as four other adware files. I deleted them. We’ll see if that fixed the problem. It was an intermittent problem , so I’ll have to wait a while to know , but I’m optimistic. These things mostly come as part of software install packages, I believe. So, the lesson learned is to be especially persnickety about what I install or let my girls install.

Gang, I have a problem that’s been ongoing for a while now, and I turn to you to help me fix it. My browser of choice is Safari. For a while now, my homepage on my home computer has been spontaneously changing itself to Yahoo search.

A quick search of the internet a while back told me that certain extensions can be surreptitiously installed without your knowledge (not sure how that happened) that will do this. I looked and, sure enough, there was one in my extensions folder. So I deleted it, and my homepage went back to normal. Except that it periodically switches again, and I can’t find the reason. My only guess is that there are some files in my system library that still need to be deleted, but I can’t find the answer with web searches.

So, any guesses?

farscythe - makin da cawfee! > Chariotoflove 09/28/2018 at 00:09

2

i dont have that problem

i use Ccleaner to wipe everything after running avast anti virus whenever i encounter wierdness tho

(Ccleaner will also delete all your conveniently saved passwords tho so bare that in mind)

Chariotoflove > farscythe - makin da cawfee! 09/28/2018 at 00:10

1

Noted, thanks.

ttyymmnn > Chariotoflove 09/28/2018 at 00:12

1

Not sure about this specific thing, but do you run your computer daily under an admin login? If so, I would suggest otherwise. Working daily with a non-admin login helps keep things from being installed without your knowledge. 

smobgirl > Chariotoflove 09/28/2018 at 00:12

1

I had this issue on my work computer and I fixed it myself so I know it wasn’t too hard, but I can’t for the life of me remember what I fixed and I don’t have a computer here to check . I know I had to go in and uninstall a lot of shit (it looked like just one file initially and there were several more somewhere else, but where...? )

Hopefully someone else will actually answer and not just ramble at you.

lone_liberal > Chariotoflove 09/28/2018 at 00:17

1

I’d run a scan using Malwarebytes.

facw > Chariotoflove 09/28/2018 at 00:26

1

I assume you are on Mac right? I see a lot of people recommending Windows tools...

In any event, I don’t know enough about Mac to make a recommendation. If you are somehow on Windows, run, don’t walk, to a browser that is actually updated and supported (Safari for Windows was discontinued in 2010).

Maxima Speed > Chariotoflove 09/28/2018 at 00:37

1

Just tagging this so I can check tomorrow. Mac user here as well. I feel like I know he answer but I’ll have to be in front of the computer to remember it.

SilentButNotReallyDeadly...killed by G/O Media > Chariotoflove 09/28/2018 at 01:28

1

I recall this being a thing on Safari once but then I solved that issue. Then Apple decided to no longer support the version of the operating system I was running and the iMac couldn’t be upgraded to a newer operating system...so it was retired to a cupboard and we went with a Dell laptop.

Which is a long and convolluted way of saying I'm useless to you too.

pip bip - choose Corrour > Chariotoflove 09/28/2018 at 05:03

0

i have no idea.

You can tell a Finn but you can't tell him much > Chariotoflove 09/28/2018 at 09:04

1

Not a Mac user, but if you’ve already uninstalled the rogue extension, maybe try clearing your browser history, cookies, cache, etc.  I assume Safari gives you the option to nuke everything back to the stone age like most other browsers do.

Chariotoflove > facw 09/28/2018 at 12:49

0

Yes, Mac, although this problem happens on Windows browsers too.

Chariotoflove > ttyymmnn 09/28/2018 at 12:52

0

I keep software installs admin password restricted, but this is the home computer the wife and kid use. Wife may possibly have installed something or allowed the kid to. It’s harder to monitor unless I forbid my wife admin access, which has other collateral  consequences...

Chariotoflove > Maxima Speed 09/28/2018 at 12:52

0

Waiting for anything that will help.

Chariotoflove > lone_liberal 09/28/2018 at 12:52

0

I’ll check it out.

Chariotoflove > pip bip - choose Corrour 09/28/2018 at 12:53

0

Noted.

ttyymmnn > Chariotoflove 09/28/2018 at 13:17

0

Give her the admin password, she’ll just have to enter it if she (or kiddos) needs to install something. It also keeps background stuff from installing. 

Chariotoflove > ttyymmnn 09/28/2018 at 13:18

1

She has it. That’s the thing. 

WilliamsSW > Chariotoflove 09/28/2018 at 19:17

1

Me either. I’m old and technology confuses me. 

Nom De Plume > Chariotoflove 09/28/2018 at 19:20

0

Simple answer is back everything up.  Then reinstall the OS.  In the adult world this is called a good excuse to clean your computer off.

Spanfeller is a twat > Chariotoflove 09/28/2018 at 19:21

1

It might be a longshot, but Safari is synced with icloud, if any other  of your Apple devices was setup using icloud and it had Yahoo as the default page, maybe it was synced to your computer

Galileo Humpkins (aka MC Clap Yo Handz) > Chariotoflove 09/28/2018 at 19:21

1

Going to second the Malwarebytes scan in safe mode . What OS are you running? Depending on OS version, networking might be disabled so you might need to put Malwarebytes on a flash drive before booting into safe mode or using a different computer.

then try to install/ruin Malwarebytes. If you’re not sure you’re in Safe Mode go to System Information>Software (left menu selection) and you should see “Boot Mode: Safe”

Chariotoflove > Spanfeller is a twat 09/28/2018 at 19:26

0

That’s a good thought, but none of the others Yahoo.

Spanfeller is a twat > Chariotoflove 09/28/2018 at 19:28

0

Hmm, well, that sucks. You could try to uninstall Safari? (does apple let you do that now?)

Chariotoflove > Galileo Humpkins (aka MC Clap Yo Handz) 09/28/2018 at 19:28

1

I’ m running High Sierra. I’m not sure if Malwarebytes will do it, but it’s worth a try.

Chariotoflove > Spanfeller is a twat 09/28/2018 at 19:32

1

I don’t know. I have this suspicion there will still be some .plist file or something lurking  in my Library folder that needs to be removed.  What’s really mysterious is that I reset the homepage, and it stays for a week or two.  Then, I open the browser, and it’s switched.  It’s so hard to track down intermittent things like that.

Spanfeller is a twat > Chariotoflove 09/28/2018 at 19:36

1

Have you tried looking for it with Finder? (if you press Alt when searching, you can find even hidden folders?) Otherwise I think I’m not techy enough to know. Sorry :/ 

Chariotoflove > Spanfeller is a twat 09/28/2018 at 20:06

0

That would work if I knew what to search for.

Spanfeller is a twat > Chariotoflove 09/28/2018 at 20:09

0

Type in common extensions  and Finder will look far and wide, then organize by date/size

Galileo Humpkins (aka MC Clap Yo Handz) > Chariotoflove 09/28/2018 at 23:23

1

There’s always the chance it won’t but I’d think it would. If I remember correctly, High Sierra Safe Mode does not disable networking.

cbell04 > Chariotoflove 09/28/2018 at 23:23

0

Are are you running McAfee? Because that is a known thing with McAfee basically they have some back door deal that makes them claim Yahoo is safer so after a while it reverts to Yahoo typically after a scan or an update. I get it once every couple weeks. Google it referencing McAfee and you’ll see others.havinf the same issue. Sure some other antivirus with “safe search” internet stuff might do the same.

Chariotoflove > cbell04 09/28/2018 at 23:30

1

I am not running McAfee, but I’ll check anyway.  It may be a clue to what’s going on.

Chariotoflove > WilliamsSW 09/29/2018 at 15:52

1

Go take your nap now, Old Man.

WilliamsSW > Chariotoflove 09/29/2018 at 16:32

1

Me IRL:

Galileo Humpkins (aka MC Clap Yo Handz) > Chariotoflove 09/29/2018 at 20:41

1

Make sure you restart after removing any adware/viruses or just apps. Just to be sure. I don’t remember if Malwarebytes asks you to or not.

Chariotoflove > Galileo Humpkins (aka MC Clap Yo Handz) 09/29/2018 at 23:59

1

It does, and I did.

Galileo Humpkins (aka MC Clap Yo Handz) > Chariotoflove 09/30/2018 at 00:02

1

Good deal, glad it worked.

Chariotoflove > Galileo Humpkins (aka MC Clap Yo Handz) 09/30/2018 at 00:04

0

We’ll see.  If I get a couple or three weeks down the road with no problem, then I’ll consider it a victory.  Still, it was good to do the screen anyway.