What is a Browser Hijacker?
A Browser Hijacker is usually promoted from bundled download packages of free software. It is not malicious like a viruses or malware, but they are quite frustrating to deal with. You may have downloaded it by mistake from not reading a checkbox during a software installation process. They can also be classified as Potentially Unwanted Programs (PUPs).
How do I know if I am infected?
- Your web browser settings has been modified.
- You constantly get redirected to various sites filled with ads, banners and pop-ups.
- Your Mac may contain spyware to collect browser activities or gather sensitive personal information.
Common Browser Hijackers
- Bing Redirect
- Chill Tab
- Safe Finder
- Search Baron
- Search Marquis
- Search Mine
- Search Pulse
- Search Tools Hub
- Search With Pure
- Yahoo Redirect
Remove Browser Hijacker manually
1. Check Browser Settings and Extensions
The first time you realize there is a Browser Hijacker on your Mac is when the homepage or search engine of your web browser is suddenly modified without your permission.
Change the homepage/search engine of your browser back to those that you used to use in browser Preferences. Double-check for any suspicious Extensions.
- Go to Safari > Preferences.
- Click General.
- At the Homepage section, if the address looks suspicious, change it back to a trusted address.
The default homepage for Safari is www.apple.com/startpage/.
- Check if your search engine has been modified. Select the Search tab then check under Search Engine, you will see a list of search engines that you can change to.
- Check Safari Extensions. Click the Extensions tab on the toolbar. You will see a list of names in the box on the left.
- Click on the extension name to view details, permissions, or uninstall it in the large view box. Extensions by unauthorized developers may include adware or spyware, which injects unwanted advertisement or steals information from your saved card details.
- Open Google Chrome.
- Go to Chrome > Preferences... to open its settings.
- Scroll down the settings page to find the Search engine section.
- Click Manage search engines.
- At the very right of the list, click ⋮ to delete any search engines you do not wish to have.
- Go back to the main settings page.
- If you need to change the startup homepage address, scroll to the bottom and find section On startup.
- Under the third option named Open a specific page or set of pages, Enter the homepage address as you prefer.
- Check and manage current Chrome extensions. Go to ⋮ > More Tools > Extensions.
The switch button at the bottom right of each extension name card indicates if the extension is currently turned on for use.
- Click Details > View in Chrome Web Store of every extension to verify their sources and developer profiles.
If changes are not saved after restarting your browser, follow the next step.
2. Check Login Items
If your browser settings get modified every time you restart your browser, the browser hijacker may not only be in your browser, but somewhere in your Mac.
- Go to > System Preferences > Users & Groups.
- Select your profile on the left side, then click the Login Items tab.
- Check if there are any recently added suspicious apps you are not familiar. Click the button to disable these apps during startup.
- Restart your Mac for the changes to take effect.
If your browser setting changes were not saved, a malware may have been installed to modify your settings every time your Mac restarts.
3. Check all recently modified applications
In System Information, you can view all applications including hidden ones that run in the background.
- Go to > About This Mac.
- Select the Overview tab, then click the System Report... button.
- Scroll down to expand the Software section, and then click Applications.
- Click on the column title Last Modified to sort applications by the latest date of modification.
- Find any recently active malware, then copy its location address.
- Go to the specific folder address to remove the malware using Spotlight.
4. Check for Suspicious Auto-Launch Files
This step takes you to the system folder where files that automatically launch at are stored. Auto-launch files from authorized developers usually have a formatted name that is easy to understand, like com.PROVIDER.XXX.plist.
- Open Spotlight.
- Enter any of the following paths:
- Remove suspicous Auto-Launch files.
The LaunchAgents folders (and their paired LaunchDaemons folder for managing service processes) are locations that contain scripts to automatically manage system processes.
Remove Browser Hijackers with Antivirus One
It may take some time to go through every file and folder mentioned in all the steps listed above. Trend Micro Antivirus One can protect your Mac from all potential risks and attacks, so you can enjoy browsing online with ease. It provides real-time scanning services and eliminates browser hijackers before they even leave a trace. Download Antivirus One now!