Content:
Since web surfing is among the fundamentals of present-day computing regardless of the operating system, the user experience becomes half-baked if the browser doesn’t work the way it should. With people increasingly relying on the Internet, such a quandary can literally brick a Mac, too. The good news is, the modern web browsers are stable enough and properly supported to minimize the risk of malfunctions. The pitfall, though, is that the adverse impact may stem from malicious software such as a piece of adware or a browser hijacker. Macs aren’t in the safe place in this context as they are being shelled by such infections non-stop.
One the nastiest threats of that kind is a potentially unwanted application (PUA) that takes over the main web navigation preferences in Safari, Google Chrome, or Mozilla Firefox and causes an incessant rerouting to Yahoo Search. At first sight, the whys and wherefores of this tactic seem unclear, but in-depth scrutiny reveals that the adware operators’ motivation is ultimately clear-cut. The following paragraphs will dot the i’s and cross the t’s so that you can grasp the gist of this annoying campaign.
The landing page, search.yahoo.com, is the tip of the iceberg in this plot. The redirect scheme is constructed in such a way that the victim may mistake the virus attack for a trivial or accidental tweak of the browser settings. Yahoo is legitimate and trustworthy, so the impression could be generally okay, except that the forwarding takes place without the user’s consent. In fact, the relatively mild damage smokescreens a multi-pronged traffic reorganization hoax. Before the browser hits the destination page, it resolves several dubious URLs that bridge the gap between the attackers and attack monetization through poor-quality advertising networks. There are several “padding” services that show in the browser’s status bar for a very short time, usually a fraction of a second. These primarily include domains from the infamous a.akamaihd.net malware family. The common URL patterns are as follows:
The analysis of this malicious mechanism is incomplete unless the core adware is added to the mix. There are four mainstream PUAs that invoke fraudulent redirects to search.yahoo.com beyond the user’s approval. These are Safe Finder, Search Mine, Search Pulse, and Any Search Manager. They override the victim’s original online navigation defaults, such as the preferred search provider and homepage, by embedding a setting of their own. The affiliated web pages are search.safefinder.com, searchmine.net, search.searchpulse.net, and search.anysearchmanager.com, respectively. The wicked logic of their functioning revolves around the exploitation of what’s called the Yahoo Hosted Search (YHS). When Safari, Chrome, or Firefox is redirected due to the hijack, the landing resource is typically a customized version of Yahoo and there is a logo of the corresponding shady service shown in the upper right-hand corner of the results page, and there is a phrase saying “Explore with Yahoo! Search” next to the search bar. These characteristics might not be too eye-catching, but they are a telltale sign of the attack.
The operators of this traffic redistribution wave didn’t reinvent the wheel as far as the infection vector is concerned. The underlying harmful application comes with software bundles that seem innocuous upon initial inspection but actually promote additional items in a surreptitious way. The fake Adobe Flash Player update popup is the central point of this large-scale propagation. It is triggered on numerous breached or known-malicious sites, stating that the visitor must download and install the latest version of Flash Player to continue enjoying the web browsing to the fullest.
The installer imposes the express option that will supposedly complete the process in no time and in a hassle-free manner. The goal is to prevent the user from exploring what else is on board and thereby to install the concomitant threat onto the Mac. This quirk confirms the relevance of the security mantra about taking the custom installation route in such situations, which allows the user to see the full structure of the package and easily uncheck whatever seems suspicious.
Mac users who have bumped into the Yahoo redirect virus issue are well aware how hard it is to fix the problem. The adware may not show up in the browser extensions list or installed application, which complicates the cleanup, to put it mildly. The foundation of this culprit’s stubborn essence is a malicious device profile it creates on the computer without the victim’s awareness. Profiles are powerful tools to instruct the Mac to behave in a particular way.
The image above shows a sketchy user profile created by the Yahoo Search virus. Its name can vary across the board, but if you take a closer look you will see that it manages certain settings in Google Chrome. Normally, this setting is blank unless you are using a company-issued Mac and your employer has added a user profile to specify what you and can’t do on the machine. So, going to Profiles under System Preferences is a reasonable starting point in the attack remediation.
Although this threat manifests itself in the web browser only, it actually leaves a footprint across the system to maintain persistence. The subsection below will help you find and remove all the components of Yahoo virus manually. Keep in mind that some of its files are a no-brainer to spot, while a few may be hidden so that the cleanup is harder to complete than in a typical software uninstall situation.
Uninstalling the harmful application is half the battle. It is a way to make sure that the symptoms won’t reappear after you implement the browser-level part of the repair. In the meanwhile, the Yahoo redirect nasty continues to affect your preferred web browser and therefore you need to revert to the correct Internet surfing settings. Read the subsection below to find out how.
Thankfully, you needn’t reinvent the wheel in terms of invalidating the adverse tweaks caused by the Yahoo virus in your browser. A tried-and-true technique is to reset the affected browser to its original defaults. On a side note, Apple has removed the “Reset Safari” button since the release of the Mac native browser’s version 9 back in 2015, so the procedure is now a bit more complex than a one-click experience (see below). Anyway, here’s a simple way to purge the most popular web browsers of the malicious influence:
Symptoms isolated to the browser are the tip of the iceberg. Yahoo redirect virus and its associated malware can gain a foothold in the Mac beyond redirect activity alone. The drawback of manual removal is that there might be hidden leftovers of the threat that will reinstall it after what seems to be a successful cleanup. This isn’t necessarily the case, but you may want to double-check if you are in the clear.
Consider scanning your Mac with Combo Cleaner, an optimization and security app with a decent track record. It’s lightweight, and it can detect all prevalent forms of Mac malware in a snap. Here’s the how-to:
1. Download and install Combo Cleaner.
By downloading any software provided on this website you consent to the provisions listed in our Privacy Policy and Terms of Use. Be advised that Combo Cleaner scan is free, but you will have to buy its full (Premium) version to enable the virus removal feature.
2. Open the Launchpad from your Mac’s Dock and click the Combo Cleaner icon to run the app. Wait for the tool to update its database of virus definitions and click the Start Combo Scan button.
3. In addition to identifying malware and privacy issues, the app will inspect your Mac for junk files, duplicates, and large files you might no longer need. Deleting these redundant objects can release a good deal of disk space.
4. Scrutinize the scan report. Hopefully, its results by the antivirus and privacy categories are blank and the verdict is “No Threats”, which means you are safe. If there are infections listed in the report, though, use the Remove Selected Items option to get rid of them.
Exposure management is changing the way we assess risk, but not everyone is out in… Read More
Introduction: Navigating the SOCaaS Revolution In today's hyperconnected digital landscape, where cyber threats evolve faster… Read More
The Middle East and Asia are fast-growing hubs for both digital innovation and cyber threats,… Read More
In Europe, digital forensics and incident response firms operate within a complex landscape shaped by… Read More
The United States is home to many of the world’s leading digital forensics and incident… Read More
Third-party vendors have transformed operations for many entities. Tasks like payroll, shipping logistics, and IT… Read More
