December 16, 2019

The resolution to delete Mac hijack plugin any search (TotalSearchToolbox)

Some time ago, my chrome was hijacked to the any searchsearch page, and the experience was very bad. I found a plugin calledTotalSearchToolbox in Settings> Extensions . After disabling it, the world was quiet. But within a few days, the malicious plugin resurfaced and infected Chrome, Firefox and Safari at the same time.
This time I went online for help and found that this was a notorious plugin, and it was more difficult to get rid of , and I had to manually delete related files.

1. To the path: 
/Library/LaunchDaemonsdelete:com.SearchFunctionDaemon.plist
2. Delete the /Library/Application support/com.SearchFunctionDaemonfolder
3. path: ~/Library/LaunchAgentsto delete anysearchrelated files
4. The above steps may not be completely applicable to everyone, but the principle is the same, that is, go to /Libraryand ~/Librarydelete all suspicious documents and documents such as  TotalSearchToolboxand any searchwords.
5. Synchronize to reset several major browsers and delete the corresponding malicious plugins. At this point, my Chrome and Firefox are back to normal, but Safari's homepage settings are grayed out, cannot be modified, and are still hijacked.
6. later discovered, this plug is most disgusting to describe himself disguised as a file, so there is the most crucial step, you need to enter System preferences>profileinside, delete the file. in my computer here is three TotalSearchToolbox
After deleting the description file, I reopened Safari, reset the homepage in Preferences> General, and the world was quiet all of a sudden ~
In the process of fighting with this plugin, I realized two things:
First, Mac Computer is not a panacea. In the increasingly popular world, there will be more and more viruses for mac. You cannot download and install software from unknown sources, and you cannot casually enter passwords to permit actions.
The second is that traditional cleaning and maintenance software such as CleanMyMac cannot identify and clean up with one click.

No comments:

Post a Comment