Help! I've been hijacked by Bing.

[Randy B. Singer]

Heres one of the articles I read, as usual they keep referring to virus' but you know they mean malware.

Well, first, that link is to a shill site for the "cleaning" app Mac Cleanup Pro. So, it's hard to believe a single word that the site says.

There was a bit of adware (it didn't actually do anything malicious) going around about four years ago that was not what I could call uncommon, called CrossRider. CrossRider would hijack your browser settings and one of the things that users noticed immediately was that their regular search engine had been changed. See:

New Crossrider variant installs configuration profiles on Macs

There are multiple versions of CrossRider. The thing is that CrossRider is a Trojan Horse, so it isn't self-replicating or self-disseminating. When Adobe discontinued Flash, CrossRider's main vector, fake Adobe Flash downloads, disappeared, and along with them CrossRider disappeared almost overnight. I haven't heard of a single case of a CrossRider infection since. And both DetectX Swift and Virus Barrier can effectively deal with a CrossRider infection.

I guess that it's possible that "mimosatortie" found some very questionable software to download and that the download contained CrossRider. But if that were the case, I wouldn't expect that simply resetting her browser preferences would fix the problem (CrossRider was designed with some persistence). CrossRider infections were also usually characterized by the presence of a bogus Profile Preferences pane in System Preferences. Finally, of course, either DetectX Swift or Virus Barrier would have reported that she had an infection.

I'm not convinced that "mimosatortie" actually experienced any sort of adware or malware infection whatsoever.

​

 

[Rod]

Randy, I too am unconvinced that mimosatortie is infected by any form of adware or malware, my post was merely a comment on the frequency of this problem over the years.

Yes, the article I cited did contain advertisements for a product called ComboCleaner but I don't think it's fair to dismiss it out of hand considering it also goes on to provide detailed pictorial instructions on how to remove this issue manually.

Interestingly the two references I found in Apple Community Forums suggest using Malwarebytes: Safari Browser hijacked by search.yahoo.c… - Apple Community

I agree these are probably instances of Trojan Horses in particular re to Adobe Flash updates from illegitimate sites in the past but that does not explain mimosatortie's problem.

So, it was my intention to explain that simply changing search engine preferences in the browser may not be a permanent fix and if not encourage the OP to reconnect with us if that was the case.

 

[Randy B. Singer]

Randy, I too am unconvinced that mimosatortie is infected by any form of adware or malware, my post was merely a comment on the frequency of this problem over the years.

I'm sorry, Rod. I really wasn't replying to you directly, just mulling over a couple of points that were raised, and I certainly wasn't intending to castigate you. The OP's problem is, and remains, a bit of a mystery, and I was just weighing in methodically and logically, as you were.

Yes, the article I cited did contain advertisements for a product called ComboCleaner but I don't think it's fair to dismiss it out of hand considering it also goes on to provide detailed pictorial instructions on how to remove this issue manually.

Shill Web sites are all over the Web now. They can be hard to spot for just the reasons that you note. They often appear to be thoughtful and sincerely helpful, like a legitimate site.

But you can recognize a shill Web site if you look for a number of common signs.

1) The company or individual behind the site is a complete unknown in the Macintosh community.
2) The site recommends a very questionable commercial product several times as a panacea.
3) The recommended commercial software is often either a "cleaner" app or an anti-virus app.
4) The site will seem to offer a good faith manual way to do what you what, that seems ridiculously hard and/or off-putting. (I.E. it might suggest using the command-line to accomplish what you want to do.)

The presence of any one of the above should make you very suspicious. If all four exist on the same site, you can pretty much just assume that it is a shill Web site.

There are obvious shill sites. For instance there are several that are easy to find that offer "reviews" of a certain type of software. For instance accounting software. These obvious shill sites (always from an unknown publisher) rank a bunch of different brands from best down to whatever. But they quickly reveal themselves when you notice that they don't offer any data on how they did the ranking (or the discussion of how the ranking was done interestingly contains no concrete information), and it's fishy that the highest rated product is a product that no other source has rated highly at all. In fact, the number one product might be a product that you have never even heard of.

As an example, you find an interesting site that purports to have tested all available anti-virus software for the Macintosh. They don't give you any substantive information on how the ranking was achieved. The highest rated product is stunningly something like Norton Anti-Virus for the Mac. You should run away from this site screaming.

A rash of newer shill sites tend to offer an answer to a very common problem or question (e.g. my Mac has just suddenly slowed way down), and they may actually offer one or two legitimate answers (though not necessarily practical ones), and shockingly, they may even offer several links to legitimate authorities to back up their suggestions. These sites are insidious, but if you look for signs 1 though 4, above, they should still be easy to identify as a shill site. It's likely that all four apply.

 

[Rod]

Excuse my ignorance Randy but what are "Shill" websites? I had not heard the term, where does it come from? I do get the gist of it though. Describing a long complex manual process might put people off or influence them to take the "easy" alternative. For me, the manual process did not look particularly difficult, a lot of the steps being more or less intuitive anyway, but that's just me. I look at it as a handy reference resource, I'd never consider purchasing ComboCleaner but I can see the psychology behind it.

 

[MacInWin]

From dictionary.com:

noun
a person who poses as a customer in order to decoy others into participating, as at a gambling house, auction, confidence game, etc.
a person who publicizes or praises something or someone for reasons of self-interest, personal profit, or friendship or loyalty.

 

[Randy B. Singer]

Excuse my ignorance Randy but what are "Shill" websites?

Historically, the term "shill" was used to refer to folks in casinos who seemed to be gambling and winning and having a really good time. In actuality, they were employed by the house and they were using house money. Their presence was solely to make things look fun and exciting and to entice rubes to gamble or gamble more.

Shill Web sites are sites that look like they are independent reviews or advice, but in actuality they have been created using a strawman webmaster, and they have really been created by some developer of some product in order to entice you to purchase their product.

Do a Google search for "reviews of Macintosh anti-virus software", for instance. Almost all of your hits will likely be shill sites. In fact, in this day and age, even many previously trusted authorities are now shills. You have to follow the money and see who is paying them now.

 

[pm-r]

Excuse my ignorance Randy but what are "Shill" websites?

If you need more besides the excellent replies already provided, more explanations here:

Google Search

PS: thanks Randy, I didn't realize what a "rube" was that you made reference to until I checked... "a country bumpkin." according to my look up source.




- Patrick
=======

 

[Randy B. Singer]

PS: thanks Randy, I didn't realize what a "rube" was that you made reference to until I checked... "a country bumpkin." according to my look up source.

That's a very literal definition. When you hear someone called a "rube", you should harken back to that old saying attributed to P. T. Barnum, "There is a sucker born every minute." A rube is an unsophisticated person who is easily tricked or taken advantage of. Or, at least that's how a con-man sees them.

 

[Rod]

Randy do you have a Carney connection somewhere? Checking the Etymology of the word Shill in Wikipedia I see it may be an abbreviation of "Shillaber" a word that originally denoted a carnival worker who pretended to be a member of the audience in an attempt to elicit interest in an attraction.

 

[Randy B. Singer]

Randy do you have a Carney connection somewhere?

No, I just read a lot.

Checking the Etymology of the word Shill in Wikipedia I see it may be an abbreviation of "Shillaber" a word that originally denoted a carnival worker who pretended to be a member of the audience in an attempt to elicit interest in an attraction.

Yep, that sounds right. I wouldn't be surprised if there were shills in Rome in pre-Biblical times. There were lots of carnival-like attractions in ancient Rome. There were even coin-operated attractions back then!

 

[Soulreaver]

Historically, the term "shill" was used to refer to folks in casinos who seemed to be gambling and winning and having a really good time. In actuality, they were employed by the house and they were using house money. Their presence was solely to make things look fun and exciting and to entice rubes to gamble or gamble more.

Shill Web sites are sites that look like they are independent reviews or advice, but in actuality they have been created using a strawman webmaster, and they have really been created by some developer of some product in order to entice you to purchase their product.

Do a Google search for "reviews of Macintosh anti-virus software", for instance. Almost all of your hits will likely be shill sites. In fact, in this day and age, even many previously trusted authorities are now shills. You have to follow the money and see who is paying them now.

It's important to be cautious and discerning when researching and selecting software products.

 

[IWT]

It's important to be cautious and discerning when researching and selecting software products.

Firstly, a warm welcome to Mac-Forums. And thank you for your post.

I'm not quite sure what your comment alludes to, but no one would disagree with it in principle

Feel free to ask questions and offer solutions as appropriate.

Ian