I installed the AnySearch extension from Apple's Safari Browser extension Gallery and found it handy. Then Malwarebytes performed a scan and it auto-deleted the extension listing it as a "threat". That's strange as this is an old extension, is installed directly from Apple's site, and I find it quite helpful.

The only reference to similar-named malware I found is Anysearch virus.

So I wonder: Is the extension from the extension gallery malware or is Malwarebytes marking it wrongly?


You can easily download the extension from the gallery directly and extract it.

$ curl -sO https://safari-extensions.apple.com/extensions/com.matt-swain.anysearch-6M853ET88Q/anysearch.safariextz
$ xar -x -f anysearch.safariextz
$ ls -l AnySearch.safariextension/
total 88
-rw-r--r--  1 pse  staff  2182 Feb 28 15:23 Info.plist
-rw-r--r--  1 pse  staff  1988 Feb 28 15:23 Settings.plist
-rw-r--r--  1 pse  staff   190 Feb 28 15:23 global.html
-rw-r--r--  1 pse  staff  2651 Feb 28 15:23 global.js
-rw-r--r--  1 pse  staff  9707 Feb 28 15:23 icon-128.png
-rw-r--r--  1 pse  staff  4424 Feb 28 15:23 icon-64.png
-rw-r--r--  1 pse  staff   387 Feb 28 15:23 toolbar.png
-rw-r--r--  1 pse  staff   708 Feb 28 15:23 toolbar@2x.png

From looking at global.html and global.js there doesn't seem to be anything fishy going on.

| improve this answer | |

yes, it's a malware.

it will hijack chrome or firefox search engine, also when install browser plugin in , it will generates a application named SearchFunction which has root right, could delete file / open firewall / call itself by taskgated. Simply to say it has hook preventing user deleting itself.

    0    125 taskgated        3 /Users/yourname/Library/Application Support/com.SearchFunction
    0    125 taskgated        3 /Users/yourname/Library/Application Support/com.SearchFunction
    0    125 taskgated        3 /Users/yourname/Library/Application Support/com.SearchFunction/SearchFunction
| improve this answer | |
  • As we seem to have proven in this thread, there are two different programs under that name. Did you get yours from the official extension gallery? – LаngLаngС May 3 at 16:58
  • Searchfunction maybe bind with host program, when install host program will also install searchfunction automatically. com.SearchFunction is a folder SearchFunction the main program of this malware. – user613826 May 4 at 16:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .