Taverno Infection / Browser Hijack

[gpsugar1]

Hi Guys,

I seem to have picked up this "Taverno" malware. it randomly redirects my browser to a Taverno search engine page, designed to look like Google. I have run Malwarebytes, and it doesn't pick it up. I have also a full virus scan with Avast, and it doesn't pick it up either. 

I have no idea what to do. What do you guys recommend? 

Thanks so much,

-G

[treed]

Take a system snapshot taken with Malwarebytes Anti-Malware for Mac. To do so, open Malwarebytes Anti-Malware for Mac and choose Take System Snapshot from the Scanner menu. Then, in the window that opens, select all the text (Edit → Select All) and copy it.

 

You can then either paste that into a reply to this message, or if you'd prefer not to post it publicly, send me a direct message with the system snapshot text instead.

[gpsugar1]

Thanks so much Thomas! Really appreciate your fast reply. I will DM you the details of the system snapshot now.

[treed]

I don't see anything I can immediately identify as malicious, but I notice that you've got quite a few Chrome extensions installed. Does this problem only affect Chrome, and not Safari or Firefox? If so, one of your Chrome extensions is probably the culprit.

For info on how to troubleshoot this, see:

https://support.malwarebytes.org/customer/portal/articles/2045724-?b_id=9511

Let me know what you find.

[gpsugar1]

OK. I'll do that and let you know...thanks again!

 

[gpsugar1]

Hey Thomas,

Just to follow up here, and in case anyone has a similar issue- the issue was only on Chrome, which is my preferred browser. I followed the instructions on the link you provided to trouble shoot this. When I opening my Chrome extensions and disabled them one by one, I noticed an extension called "Chrome Antivirus". I never downloaded anything of the sort. So that was a fake extension and that's what kept redirecting my browser. 

Seems like everything is working fine now! Thanks again for your help

-Gregg

 

[treed]

Gregg,

Thanks for the info! Looks like that has been removed from the Chrome store at this point, but I found a copy elsewhere and will work on getting it added to the signatures.

[westie]

Hey guys, I was having the exact same problem. I did a google search that brought me right here to this page, and you guys solved a weeks long headache for me just like that. I figured it justified my registering so I could post a thank you! 

[treed]

I'm glad we could help!