Under Construction
Chumsearch hijacked my chrome browser. It may also hijack Safari and Firefox
It changed my home page and search default in chrome to Chumsearch
It also started popping up notices to upgrade Adobe Flash
Two other apps which I don't remember downloading showed up about the same time.
MacKeeper and MegaBackup - Malwarebytes removed them.
MacKeeper is a fake utility app for which an advertisement tries to scare you into downloading and/or buying it by ominously reporting that your computer has problems and needs to be repaired.
They all may have been attached to some free software I downloaded,
but I haven't figured out what it could have been.
It may have been a Fake Flash Player Update | The Mac Security Blog
See How to determine if a Flash update notification is legitimate - CNET
See How do I remove it? | discussions.apple.com
Go to /Users/<user>/Library/LaunchAgents
(In finder you can select Go to Folder in the Go menu and specify ~/Library/LaunchAgents)
[~ stands for your home directory under /Users/ ]
Remove anything recent. They may have funny names.
Do the same for /Library/LaunchAgent
The Malwarebytes anti-malware program found
~/Library/Safari/Extensions/chumsearch.safariextz
I also found the following
~/Library/Application Support/ChumSearch
You might be able to do a find cmd-F in the finder and specify
Name Contains "chumsearch" to find other places where it exists
Go to chrome preferences to remove chumsearch and restore your pages
On Startup > Set Pages [your home page if you have one or Google by default]
and Appearance > Show Home Button
In the Safari Preferences window, click the "Extensions" tab.
Find any unknown plugin, then click on the "Uninstall" button.
Security analysts reveal that the browser hijacker linked to Chumsearch.com may
appear as a toolbar, plug-in, add-on, extension and Browser Helper Object.
See:
Chumsearch.com Removal Report | enigmasoftware.com
Return to Mac
last updated 3 Feb 2017
|