Bing Redirect

[rcharris]

Hi Folks,

I have a problem that Malware Bytes can't seem to find.  I've been using the same MacBook Pro (OS X Yosemite 10.10.5) for nearly 10 years, and I have had no more than 2 or 3 problems with malware and things of that nature.  I use Chrome as my browser for most things, and Google is my default search engine.  Over the last few weeks, when searching in Google, my browser will redirect me to Bing on occasion.  So, for example, let's say that I google "how to change a tire on a car." The search results will come up in Google, and I can click on one of the results, lets say How2FixCars.com.  Typically, when I do a search, a new tab doesn't open up, but what happens now (occasionally) is that a new tab will open up, taking me to How2FixCars.com; meanwhile, the old tab with the Google results will switch to Bing (with the same search terms).  Once in Bing, something even more annoying happens -- if I click on a result, say TireFix.com, it doesn't take me to TireFix.com; instead, it will take me to some semi-related site, selling something like cars, car wax, or whatever.  The really odd thing is that it doesn't always happen.  I'd estimate that I get redirected to Bing maybe 1 in every 5-to-10 searches -- very strange.  It's obviously annoying, but I am concerned that whatever is on my computer might be doing something even more sinister than redirecting my searches.  I would really appreciate some help.  Thanks so much.

-- RCH

[alvarnell]

Go through this article which is pinned at the top of the forum and perform those checks, paying particular attention to those involving Chrome. 

https://forums.malwarebytes.com/topic/236261-how-to-remove-weknow-malware-and-others/

Edited April 26, 2019 by alvarnell

[rcharris]

Went through the steps one by one, and also tried several other things from other sites.  I never found a malicious profile.  I never found anything suspicious running via the Activity Monitor.  I did find a recent download on Adobe Flash, which I deleted, but only seemed to make the problem worse.  I tried resetting my Chrome settings back to default, but this process just "hung" -- stuck and never completed.  So, finally, I deleted Chrome and reinstalled.  This seems to be working, but as I said, the redirect has never been consistent.  I should know in a day or two if it is truly gone for good.  I will let you know ASAP.  Thanks.  

[rcharris]

It's back.  It probably never went away.  Suggestions?  

[treed]

Thanks for the information you sent me privately! I'm posting a response here, in case it can help others.

Your system looks pretty clean, but I notice that you have an extension installed in Chrome called VideoDownloader Professional. Some investigation shows that this is the likely culprit. It has been fingered as adware on some forums, and looks like it has been removed from the Chrome web store. Try disabling that, and if it fixes the problem, it should probably be removed.

If you can verify that this extension was causing the problem, let me know. I'd love to get a copy of the extension itself. I've found what I suspect is the same version, but I'm not 100% sure.

[rcharris]

So far, so good.  On my Mac, the redirect didn't always happen with every search, but it did happen about 90% of the time if you clicked on the links under "People also ask." I have tried multiple searches and clicked on the links under "People also ask," and I am NOT experiencing the redirect and/or having new tabs open with unwanted sites.  So, thank you, Treed.  If you don't hear from me in a few days, you know that you solved the mystery.  :-)

 

[trutane]

I believe the Movie Finder Chrome extension contains malware that performs redirects to bing and yahoo. It alters Chrome's search behavior and search results are bad too, providing top results that are links to ads. I don't even recall ever installing the MF extension in my Chrome, so it may have come along with some other app or possibly via an email attachment.

After uninstalling Movie Finder from my Chrome extensions and restarting Chrome, the redirect issue went away. Malwarebytes (free version, with the latest update) was NOT able to detect & remove this malware prior to removing the extension.

 

Btw, the Movie Finder authors misspelled "tittles" in their description - not a good sign! I have submitted a "report abuse" report for this app in the Chrome webstore.

[adas]

Hi @trutane,

Please provide us (if possible) link of chrome extension. There are more than three "Movie Finder" extension on chrome web store.

Also, if you have copy of the extension, please attach us here.