Today I installed a program that I'm familiar with and that I have used before called Filezilla using SourceForge. I've never had a problem with it before, and I only uninstalled it because I had no need for it. So I moved to install it again and thought it was strange it kept asking for key permission (so I said no). All the sudden my fireox browser disappeared I had some crapware installed I had no interest in, plus another unpleasant surprise: whenever I load firefox OR Safari Yahoo search comes up even though my default for Safari is google search. How do I fix this? I'm trying to delete the program it came from but it says that it's 'in use', but when I pull up the task manager all that shows up are finder and Microsoft Word. Any word on how I can delete the covert adware/malware?
-
Do you know the name?– RuskesCommented Feb 15, 2015 at 3:57
-
if it is running use cmd+alt+esc then kill it from there.– RuskesCommented Feb 15, 2015 at 3:58
-
Nowadays it's much, much harder to install crapware on macOS, and it's much easier to remove as well. As long as you don't install anything from a suspicious website with your password, you will be fine. It's both a blessing (for security) and a curse (for customization).– Oion AkifCommented Jun 27, 2020 at 16:37
9 Answers
So after downloading Vuze a while back, I wound up with api.mybrowserbar redirects and a bunch of stuff pointing at some thing called Spigot, deterministically finger banging my bandwidth and internet experience in general.
Sorry, this assumes some knowledge of the command line and file structures.
The solution, grep is your friend.
Open Terminal and navigate to /Users/YOUR_COMPUTER_USERNAME/Library/Application Support/Google/Chrome
YOUR_COMPUTER_USERNAME must of course be replaced with your computer username, you can retrieve it by running the whoami command in your terminal.
grep -rnw '.' -e 'spigot'
and
grep -rnw '.' -e 'api.mybrowserbar'
get in there and remove that shit.
In the most annoying case, their genius software made itself the default restart page for whenever chrome unexpectedly crashes. This little tidbit is located deep inside a sort of huge JSON blob at
/Users/YOUR_COMPUTER_USERNAME/Library/Application Support/Google/Chrome/Default/Preferences
This response IS for a Mac user, specifically, OS X 10.11(El Capitan).
That said, I set all my machines up with the exact same programs (again Mac machines only), and even version specific (browsers, etc.), see why this is relevant here-->. Of the units that reach out to the web, the Mac Pro, Mac Mini, or MacBook Pro 17, has NOT been affected. *Not going to give hardware specs as I'd be on here all day. This has only affected a MacBook Pro 15(2013 model) via Google Chrome.
Part of my job is finding and ending problems such as this, so I've done a bit of research on the issue and this is what I have come up with, I certainly hope it helps someone:
In this case, certain Chrome 'Extensions' appear to worm there way into the Extensions list. Heres a small list of extensions that install without user consent: "Amazon Shopping Assistant by Spigot", "Domain Error Assistant", "Ebay Shopping Assistant by Spigot" and "Slick Savings." In my case, I narrowing my logs down to an extension called "domain error assistant" being the first installed without user consent. The yahoo search engine appeared relentlessly even after all browser cache was deleted.
My Fix? Save bookmarks, etc. Trash ALL extensions, Remove Chrome, reinstall Chrome. Its been good for over a month now.
Good Luck!
-
Thanks! The problem I had was with Firefox and Safari, however. The problem was fixed suing the Terminal.– TamCommented Dec 30, 2015 at 7:26
I had the same problem in Safari using Mac OS, and I found the problem was caused an extension called Any Search that got installed in the browser when installing some other app. I removed it, and it solved the problem.
I had a similar issue and it was resolved once I removed the "Emoji keyboard" Chrome extension. (My problem was limited to Chrome, I think)
Go to Activity Monitor, and you'll see a list of all the tasks your computer is running. Find the program that the adware came from, select it, and click the Quit button in the top left corner of Activity Monitor's toolbar (the button with an octagon with an X in it, not the red "close window" button). That should stop the program so you can delete it.
Check your extensions for anything by Spigot and either run AdwareMedic or follow the instructions on the site that hosts AdwareMedic. Or use Apple's plagiarized article.
-
1
-
I'm aware that this thread is a little bit old, but I just faced the same problem after having installed Vuze.
What I did was delete an extension called "Quick Browse", and now everything seems to be back to normal.
I hope this helps!
I have had the same problem and I discovered a program that had piggybacked into my system called Yahoo Search Set. Uninstalling that program, restarting the computer, and then manually removing the Yahoo Search URL from my homepage setting did the trick. I have found references to another software called "Spigot" that may do the same thing. Go to "Uninstall Programs" in your control panel and look the list over. If you see either of these listed, uninstall them. If they are not there, look for any other program listed that you are not familiar with. Check those programs out by doing search on "what is" plus the program name and you should find information about whether the program is legitimate. If it is not something you want or need and not something that is part of another function like printer function software, consider uninstalling it. That is how I found and decided to uninstall Yahoo Search Set which cured my problem.
I ended up using the terminal to delete it, and whatever it is, hopefully is gone (it no longer hijacks my browsers).
EDIT: I used the commands rm -rf to delete the original file.
-
Do you know what it was called. not goldernboy per chance? Commented Feb 21, 2015 at 9:07
-
I have no idea unfortunately. I think it was part of the download itself, because once I deleted that it wasn't working anymore.– TamCommented Feb 23, 2015 at 8:42
-
This isn't a very useful answer. Yes you used the terminal, but how did you delete it? What commands did you run? If you followed another answer's recommendation, then you should have marked that as being the solution.– ghoppeCommented Oct 9, 2015 at 20:50
-
Didn't realize my answer was so unpopular haha. I believe that I googled the question and eventually found the answer. What I did was that I used the commands rm -rf to delete the undeletable file. I found it by searching the name for the file using the terminal and then using the above command to delete what I needed. I restarted the browser and there, problem solved. Does that answer your question?– TamCommented Dec 30, 2015 at 7:23