How can I clean up my hijacked browser (from Yahoo)?

[linearcold]

For some reason all my browsers (Chrome, Safari and Firefox) suddenly start up with Yahoo search engine all though they are set to Google.

I guess I'm infected with some kind of malware, but I'm pretty careful not install software I don't trust. I've no idea where this malware comes from. Recently I upgraded my Macbook Pro to El Capitan and the issue appeared shortly after.

Please help! What to do?

I've read about this Yahoo-issue in several discussions and It seems like a well known problem. And what scares me is that the Yahoo-thing might be a indication of a bigger hijack.

What happen is that every time I open one of the browsers the Yahoo search engine will appear. Yahoo will only appear once I open the browser. If I open a new window it will now open with the Google search engine (as it should've in the first place). But if I restart the entire browser Yahoo will reappear. It's the same for all the browsers. Very weird.

What I've tried so far (without any luck):

Uninstalling and reinstalling Chrome and Firefox and set everything to Google. Still Yahoo pops up.

Several websites suggest to trash suspicious applications in the application folder, but I can't find any suspicious applications.

Some suggest to keep an eye on the Activity Monitor, but I'm not sure what to look after. At least I can't see anything suspicious - but again, I'm not sure what to look after.

I've thought about installing an anti-walware program, but I've read some discussions about you don't need to install protection applications on a Mac. Is that true?

Anyhow, I couldn't find any useful solutions to solve the problem, so I tried a common suggestion to install Malwarebytes Anti-Malware. Maybe this was a mistake - nonetheless it didn't solve anything. I've tried Avast as well without luck. Both programs did find a few small issues, but nothing to solve the Yahoo-problem.

Some forums recommend Hijackthis, but I've seen some warnings against this too, so I haven't tried it. Anybody got any experience with Hijackthis or similar software? I've read about MacKeeper and such, and they seem like a very bad idea.

So what to do? Please help!

 

[honestone]

Sure is a strange issue! You should install the excellent (and free) Malwarebytes Anti-Malware for Mac. You can get it from here:

https://www.malwarebytes.org/antimalware/mac/

Quite a few folks around here (including myself) have used this safe and secure product.

 

[linearcold]

Thanks, but I've already tried that without luck. Do you have another suggestion?

 

[bobbyv33]

sounds to me like your home page, not your search engine, has been changed. In safari go to the general tab in preferences and check what is your home page.

 

[Steamer Dave]

I have had the same problem for several months and cannot get rid of it. I am using Firefox. It has soured me on having anything to do with Yahoo!!

 

[Cory Cooper]

Hello,

-You could look in Macintosh HD > Library > Internet Plug-Ins and see f there is anything amiss there.
-You could create another user on the Mac, login to it, and see if the issue persists.
-Do you have any third-party extensions installed in any of the browsers that may be causing the issue?

C

 

[Steamer Dave]

I looked at the plugins and have no idea if any of them might cause such a problem. I might be able to get a hint if there was a way on a Mac to find out when these were downloaded or activated.

 

[Cory Cooper]

If you list the plug-ins by name, I can tell you if they could be the cause.

C

 

[Steamer Dave]

Here they are.

adobePDFviewer
default browser.plugin
EPPEX plugin.plugin
flashplayer plugin
flashplayer.xpt
flip4mac wmv plugin.plugin
google earth web plugin
iphotophotocast.plugin
quartz composer.webplugin
silverlight.plugin

and there are two disabled plugins.

Dave

 

[Cory Cooper]

All of those are normal.

Have you tried Safari > Preferences > Search > Search engine:? Is it set to Yahoo instead of Google?

C

 

[Steamer Dave]

I am using Firefox. Sorry for not mentioning that. I did check preferences. Yahoo was one of the options so I removed it from the list. I am still seeing a list of sites that I have visited in the past, 15 to be exact. I was able to semi eliminate yahoo several weeks ago but this screen shows up instead of the home page when I select new tab which I am sure was the way it was before the yahoo hijack.

Dave

 

[Cory Cooper]

Oops...sorry about that...you mentioned that in your first line in the original post.

Is that what you have in Firefox > Preferences:

General
When Firefox starts: Show my home page
Home Page: https://www.google.com

Search
Default Search Engine: Google
One-click search engines: Google dragged to top and Yahoo unchecked

C

 

[Steamer Dave]

Right now verizon is my home page. I do that so I can access email since Thunderbird stopped bringing in emails from Verizon. It can send mails but not receive. I have been wrestling with that since the end of October. I am currently limping alone with the native email program from apple. It is torture!

Interesting! I just brought up firefox and it gave me the normal verizon home page. I then ask for a new tab and it gave me the page I described earlier with 15 sites I have visited and a search window. It brought up what I wanted and it was from Google search. I cannot say I am unhappy with that. Just so the yahoo bit is out of my life.

Thanks

Dave

 

[wauserfriendly]

For some reason all my browsers (Chrome, Safari and Firefox) suddenly start up with Yahoo search engine all though they are set to Google.
So what to do? Please help!

The problem is that Yahoo pays developers to bring in new customers. Some developers write code to do so without your permission. Yahoo pretends it is not their fault.

I'm going to tell you a controversial approach. it has worked for me. If you try to contact support at Yahoo, you will get the usual runaround.

But as you search in Yahoo, you will find the legal department. They have to respond to subpoenas and police immediately. I wrote them. I explained that their agents made changes to my computer without my permission. And they were in violation of laws including theft of services, breaking & entering, Computer Fraud, computer trespass, etc. I explained that these could be prosecuted as Terrorism under the USA Patriot Act which allows for prosecution, detention, and long term imprisonment without trials, lawyers or civil liberties. (True, but it has not been used this way.) I also said that I could also start a class action suit, and that no computer user could be on a jury without having experienced this hijacking.

I received a PHONE CALL from Yahoo within an hour at 11pm on a weekend. They offered to lead me through the entire clean up process over the phone and did so. I've not done this since, but I've held it in my back pocket. Perhaps if a few others would do this, Yahoo would either check the code of their developers or stop paying for any "referrals."

 

[honestone]

Really weird that folks would have this issue. For both of my browsers, Google Chrome and Opera, and on both of my Macs, my home page is here, ie, www.mac-help.com. Never had an issue. And I actually visit www.yahoo.com many times each day. And my default search engine is Google.

 

[wauserfriendly]

The issue was not the choice of the home page or going to Yahoo. It had to do with Yahoo paying programmers to hijack browsers so that the homepage is set to yahoo.com and cannot be changed.

Typically it occurs when installing some sort of add on or other application.

 

[honestone]

Well, in that case, one needs to do a complete removal of the browser and all its "pieces". The best way to start that process would be to download, install, and execute the excellent free program AllCleaner, available from here:

https://freemacsoft.net/appcleaner/

That will get most (maybe all?) the "stuff" associated with the application (along, of course, with the app itself). To complete the process, one can do a search of their hard drive, using the app's name as the search term. Spotlight is OK for that, but I prefer the excellent freeware program EasyFind, available from here:

https://www.devontechnologies.com/products/freeware.html

 

[wauserfriendly]

Well, in that case, one needs to do a complete removal of the browser and all its "pieces". The best way to start that process would be to download, install, and execute the excellent free program AllCleaner, available from here:

https://freemacsoft.net/appcleaner/

That will get most (maybe all?) the "stuff" associated with the application (along, of course, with the app itself). To complete the process, one can do a search of their hard drive, using the app's name as the search term. Spotlight is OK for that, but I prefer the excellent freeware program EasyFind, available from here:

https://www.devontechnologies.com/products/freeware.html

I've had appcleaner installed but never think to use it. It should look around for the orphan files and remove them automatically. Thanks for the recommendation of Easyfind. If I could buy back the hours I've spent searching...

And by the way, I think getting the Yahoo legal department calling me back within an hour on a weekend was far more fun than running a cleaning program. They are responsible for the mess in bribing app developers (allegedly) to get more people to go to their website.

Did you happen to notice that Edison, a well-regarded mail program just admitted to the Wall Street Journal that their staff read people's email?

But we trust Edison and Facebook and Yahoo and Google. Even though Google dropped the "Don't be evil" clause from their code of conduct. I wish I were making this up.

In the last few years, software has become more difficult to use and less reliable. Things I could do a few years ago, take multiple steps. Apple is removing some great features from the OS. And when for a while it appeared different programs could learn to play well together......putting them on the same computer has all the sweet harmony that we hear in Congress.

 

[honestone]

Yeah, it's getting more and more difficult to trust software.

By the way, we are neighbors! I see where your zip code, 98109, encompasses the Space Needle, Capitol Hill, and Queen Anne. My zip code is 98032, and I am located in Kent.

 

[wauserfriendly]

Yeah, it's getting more and more difficult to trust software.

By the way, we are neighbors! I see where your zip code, 98109, encompasses the Space Needle, Capitol Hill, and Queen Anne. My zip code is 98032, and I am located in Kent.

I'm where the Seattle Center, Downtown, Denny Triangle and South Lake Union intersect. Put that in your Venn Diagram. Keep a stack of Venn Diagrams to help you park with the conflicting rules. That, and of course a compass, Seattle, being the only place in the country with parking signs that say, "No parking East (or other direction) of here." If we had more sun, we could use a sun dial.

I used to be just East of the Winco in Kent. I would say I used to live there, but I prefer to think of it as doing time. I did like Winco and the cost of gas out there and some of the shopping. Seattle proper (as opposed to Seattle-improper) does not have some of the big stores that are in the burbs, which sometimes are the only place to find things. But I don't like that sort of shopping too much. Takes too much time to put on the armor and gird one's loins.