Pozdrav svima,

Od kako sam se vratio sa godisnjeg iz Hrvatske imam problem sa trazilicom. Podesena mi je kao standardna google.co.uk, ali svaki puta kad idem pretrazivati nesto izbacuje mi rezultate preko yahoo-a.
Pogledao sam postavke u Safariju i stoji i dalje da je google zadan kao jedina trazilica.
Izbaci mi na trenutak rezultate u googleu, a onda nakon par milisekundi prebaci na yahoo. Kad swipeam na prethodnu stranicu opet se ucitaju razultati u googleu i prebace nakon par milisekundi na yahoo

Zna li netko u cemu je problem i zasto mi se ovo odjednom pojavilo?

Da ti nije neko govno instaliralo kakvu Safari ekstenziju koja sve pretrage preusmjerava na Yahoo?

Riba kaže:


Ne, nemam nikakvih ekstenzija instraliranih
Sve zivo sam pretrazio i nemam pojma zasto mi to radi, a sve je pocelo od kako sam se vratio iz Hr, znaci u zadnjih 10-tak dana

Mac OS 10.12.6 je u pitanju, MacBook Pro late 2016

Mozda su korumpirani Safari preferences, zatvori Safari i obrisi file ~/Library/Preferences/com.apple.Safari.plist (~ je tvoj korisnicki folder), pokreni safari, provjeri postavke i stavi search na Google i provjeri je li problem rijesen. Mozda prije brisanja mozes pokusati samo promijneiti default search engine na nesto drugo pa natrag na Google, mozda pomogne.

Meni to ipak zvuči kao neki malware

Evo...
www.pcrisk.com/removal-guides/8835-search-yahoo-com-redirect

Ali NE KLIKAJ ONAJ GUMB i NE INSTALIRAJ MAC REMOVAL TOOL, jer je to vjerojatno samo još jedan malware!

Došao čovjek u rvacku na kratko i odmah mu se zarazio laptop

Vjerojatno treba promisliti kome ga je davao u ruke. Također, ako je korisnik administratorskih ovlasti bez passworda (to ljudi često rade iz komocije), jbg... Tko ode u Nigeriju (npr) i ševi bez kondoma, nema se što čuditi kad dobije HIV+...

Dao sam laptop jedino bratu na kratko da trazi na ebayu, ne vjerujem da je mogao nesto downloadati bez mog znanja i odobrenja jer za svaku instalaciju imam admin ovlasti sa passwordom
Onaj combo cleaner mi se takoder cini kao malware, ima nesto sto se moze skinuti sa storea?
Jer meni prema ovog stranici sto je smayoo stavio sve stoji kao da je google postavljen za default browser, nemam nikakvih ekstenzija i pod general mi i dalje stoji da je pocetna stranica google, kao i trazilica

Da, i meni zvuci kao malware ali zasto se pojavio sada? Prije nisam imao nikakvih problema.
Clean install?

Ne treba, to je preradikalna metoda. Kao da ADHD poremećaj liječiš lobotomijom.

www.2-spyware.com/remove-yahoo-redirect-virus.html

Ova stranica je isto zagađen hrpom smeća i reklamnih linkova koji su također potencijalno riskantni, ali trebaš se strpljivo probiti kroz smeće i čitati koristan tekst, sve do dna. Evo nekih dijelova koji su potencijalno korisni:

Delete Yahoo Redirect from Mac OS X system
To remove Yahoo Redirect virus from Mac, close the affected browsers first. Then go to Applications folder and drag suspicious applications to Trash. You should remove SearchConnect, Search Offer, Search provided by Yahoo and other questionable applications without a hesitation. Empty the Trash afterwards.

Dakle, kad kaže "close" the browsers, misli - QUIT. Također, aplikacija koja se zove "nešto Babylon" je isto potencijalno sumnjiva.

Malo niže na istoj stranici:

Eliminate Yahoo Redirect from Safari

Delete Search.Yahoo.com Redirect virus from Safari by removing shady extensions that were added to the default Apple's browser without your knowledge.

Some suspicious extensions that are known to be targeting this browser are called Email Access, Easy Movie Access or My Movies XP.

To finish

Remove dangerous extensions
Open Safari web browser and click on Safari in menu at the top left of the screen. Once you do this, select Preferences. Click on 'Safari' and select 'Preferences'
Here, select Extensions and look for Yahoo Redirect or other suspicious entries. Click on the Uninstall button to get rid each of them. Go to 'Extensions' and uninstall malicious add-ons

Change your homepage if it was altered by virus:
Open your Safari web browser and click on Safari in menu section. Here, select Preferences as it was displayed previously and select General.
Here, look at the Homepage field. If it was altered by Yahoo Redirect, remove unwanted link and enter the one that you want to use for your searches. Remember to include the "" before typing in the address of the page. When in 'General', delete malicious URL and enter your desired domain name

Reset Safari
Open Safari browser and click on Safari in menu section at the top left of the screen. Here, select Reset Safari.... Click on 'Safari' and select 'Reset Safari...'
Now you will see a detailed dialog window filled with reset options. All of those options are usually checked, but you can specify which of them you want to reset. Click the Reset button to complete Yahoo Redirect removal process.

Ma sve ja to kuzim smayoo, ali nista od toga se kod mene ne dogada:
- pocetna stranica mi i dalje stoji google.com
-nemam nikakvih instaliranih ekstenzija u Safariju (barem mi se ne prikazuju pod extension
- ocistio sam history i cookies
- i dalje mi stoji kao zadana trazilica google

I usprkos svemu tome i dalje me prebacuje na bing nakon nekoliko milisekundi ucitanog sadrzaja na googleu koji je zadan kao pocetna trazilica.
Pretrazio sam sve zive aplikacije i nigdje ne nalazim neku sumnjivu.

Dakle, jedino sto mi jos preostaje je ili skinuti neki antimalware sa app storea ili clean instal

OK, ajde se najprije saberi, udahni 10x pa onda provjeri sve još jednom i napiši TOČNO
da li te redirecta na yahoo (kao što si napisao na početku) ili na bing (kao što si napisao sada)?

Jesi li pregledao što sve imaš u Applications folderu?

Vidis, sada kad razmislim, ovisi, jer na pocetku me bacao na yahoo, u zadnje vrijeme na bing
Da, sve sam pregledao sto imam u applicationsima i nista od toga sto imam nije tu sto nije bilo i prije, sve aplikacije su normalne (mozda je ubacen neki file samo u neki folder od Adobea jer je on jedini kojeg imam instaliranog sa vise foldera, ali Adobe imam vec vise od godinu i pol u tom obliku), nemam niti jednu instaliranu aplikaciju koju nisam i sam instalirao.
A u zadnjih par mjeseci nisam sigurno nista instalirao

Za redirect na Bing postoji na dlaku ista web stranica kao ova na koju sam već stavio link. Vrlo sam siguran da je ta stranica navlakuša da na kraju instaliraš onaj "alat za čišćenje" kojeg nude, a to je zapravo pravi malware. Ovaj yahoo/bing redirect je samo okidač - nešto što ti ide na živce pa želiš riješiti.

discussions.apple.com/thread/6497502

SAvjetuju također neke antimalware programe. To ne bi bio moj prvi izbor, ali ako bi morao, prije bi vjerovao preporuci na discussions.apple.com, nego onima ranije. Osim toga, ima i jedan "ručni postupak":

You may have installed the "Genieo/InstallMac" rootkit. The product is a fraud, and the developer knowingly distributes an uninstaller that doesn't work. I suggest the tedious procedure below to disable Genieo. This procedure may leave a few small files behind, but it will permanently deactivate the rootkit (as long as you never reinstall it.)

Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one. (nažalost, upis je još od 2014. godine, tako da vjerojatno nećeš naći da se fileovi zovu točno tako, ali probaj)

Back up all data. You must know how to restore from a backup even if the system becomes unbootable. If you don't know how to do that, or if you don't have any backups, stop here and ask for guidance.

Step 1

In the Applications folder, there may (or may not) be an application named "Genieo". Genieo may be partially installed even if this item is absent. If it's present, select it and open the Finder Info window. If it shows that the Version is less than 2.0, download and install the current version from the genieo.com website. This may seem paradoxical, since the goal is to remove it, but you'll be saving yourself some trouble as well as the risk of putting the system in an unusable state.

There should be another application in the same folder named "Uninstall Genieo". After updating Genieo, if necessary, launch "Uninstall Genieo" and follow the prompts to remove the "newspaper-style home page." Restart the computer.

This step does not completely inactivate Genieo.

Step 2

Don't take this step unless you completed Step 1, including the restart, without any error messages. If you didn't find the Genieo application, or if you couldn't complete Step 1 for any reason, stop here and ask for instructions.

Triple-click anywhere in the line below on this page to select it:

/Library/Frameworks/GenieoExtra.framework

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.

If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

A folder should open with an item named "GenieoExtra.framework" selected. Move that item to the Trash. You'll be prompted for your administrator password.

Move each of these items to the Trash in the same way:

/Library/LaunchAgents/com.genieo.completer.update.plist
/Library/LaunchAgents/com.genieo.engine.plist
/Library/LaunchAgents/com.genieoinnovation.macextension.plist
/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist
/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client
/usr/lib/libgenkit.dylib
/usr/lib/libgenkitsa.dylib
/usr/lib/libimckit.dylib
/usr/lib/libimckitsa.dylib
~/Library/Application Support/com.genieoinnovation.Installer
~/Library/LaunchAgents/com.genieo.completer.download.plist
~/Library/LaunchAgents/com.genieo.completer.update.plist

If there are other items with a name that includes "Genieo" or "genieo" alongside any of those listed above, move them as well. There's no need to restart after each one. Some of these items will be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

Restart and empty the Trash. Don't try to empty the Trash until you have restarted.

Step 3

From the Safari menu bar, select

Safari ▹ Preferences... ▹ Extensions

Uninstall any extensions you don't know you need, including ones called "Genieo" or "Omnibar," and any that have the word "Spigot" or "InstallMac" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

Your web browser(s) should now be working, and you should be able to reset the home page and search engine. If not, stop here and post your results.

Make sure you don't repeat the mistake that led you to install this software. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad has a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If youever download a file that isn't obviously what you expected, delete it immediately.

You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the Genieo developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.

Finally, be forewarned that when Genieo is mentioned on this site, the criminal perpetrator of the scam sometimes shows up under the name "Genieo support." He will tell you to download a fake "uninstaller." As he knows and intends, the uninstaller does not completely remove the malware, and is in fact malware itself.