If Bing keeps coming up in web browsers on your Mac instead of Google or another preferred search engine, this could be a sign of a persistent adware attack.
|Name||Bing redirect virus (Bing.com search redirect)|
|Type||Redirect Virus / Browser Hijacker|
|Action||Annoying redirects of Safari/Chrome/Mozilla Firefox/Opera to Bing.com search engine, Showing sponsored ads, Total system slowdown|
Whereas browser customizations are geared toward enhancing the user experience, even the smallest spanner thrown in the works will dramatically diminish it. This goes for the Bing redirect nuisance that has been a hot topic in security circles for several years and won’t seem to loosen the grip around the Mac ecosystem in early 2021. It manifests itself through stubborn browser takeover that results in forwarding the victim’s searches to Bing.com. Although this oddity may seem like a rivalry-borne collision of Apple and Microsoft, such an impression is erroneous. The nuts and bolts of this activity have nothing to do with controversial interests of one technology giant in the territory of another. Instead, it’s a more intricate cybercrime game than it appears to be.
But why on earth would bad actors want to contaminate Macs and then drive traffic to Bing? The wicked part of this scheme kicks in before the legitimate search engine is resolved. What happens is, the affected browser – Safari, Google Chrome, and Mozilla Firefox – hits a series of shadowy URLs along the way. These include SearchMarquis.com, SearchBaron.com, SearchItNow.info, SearchSnow.com, and Mybrowser-Search.com. As the operators of this campaign are switching up domains, new ones may splash onto this scene. Most redirect instances at the time of this publication take off with the above-mentioned Search Marquis service. Then, the intercepted traffic travels via Search Baron, multiple auxiliary gibberish-looking URLs, and finally lands on Bing. The screen capture below illustrates the mechanics of this rerouting process.
The role of these intermediate domains is to close the gap between adware makers and dubious affiliate marketing platforms. Although they are visible in a browser’s status bar for mere moments, they fuel a model in which crooks rake in profits through unique leads. The fact that Bing is the resulting page doesn’t mean that this search engine is part of this conspiracy, and yet most victims blame their predicament on it. This plot is ruining the reputation of Microsoft’s hugely popular service, so hopefully there will soon be decisive steps to stop the hoax in its tracks. In the meanwhile, numerous Mac users are caught in this nasty rerouting loop and are looking for ways to address the problem.
Speaking of which, the Bing redirect always occurs because a piece of unwanted code infiltrates a Mac computer and turns the browsing defaults upside down. The infection isn’t that easy to purge as it leverages a malicious configuration profile and sprinkles its files across LaunchAgents, LaunchDaemons, Application Support, and possibly the /private/var/folders path. The following sections of this post will help you get rid of the invasive threat for good.
Remove Bing redirect from Mac manually
First things first, every infection instance boils down to a specific rogue app underlying it. Therefore, the starting point of the fix is to find and delete the malicious program that’s causing your Mac computer to act up. This could be easier said than done, though – some viruses are sneaky and don’t leave an obvious system footprint in an attempt to avoid detection.
The steps below will walk you through the best practices of spotting and removing Bing redirect virus from your Mac.
- In the Finder’s Go pull-down menu, click Utilities
- Select Activity Monitor
- Take a look at the running processes and try to identify the malicious one. Its name isn’t likely to have anything in common with Bing redirect, therefore you should focus on resource-intensive entries that look unfamiliar and way out of place.
- Once you spot the suspect, select it and click Stop in the upper left of the Activity Monitor screen. Follow on-screen prompts to force quit the unwanted item. Note that you may have to enter your admin password to do it
- Reopen the Go menu and click Go to Folder
- Enter the following string in the search box: /Library/LaunchAgents. Click the Go button as shown below
- Check the folder for potentially unwanted items. As is the case with malicious executables, the names of sketchy LaunchAgents may suggest no connection with Mac threats. As a general rule, look for recently created objects you don’t recognize. Send the baddies to the Trash if found
- Now you’ll need to complete the same procedure for the following directories: ~/Library/LaunchAgents, ~/Library/Application Support, and /Library/LaunchDaemons. Go to these paths in turn (see Step 6 above), inspect their contents for dubious items and folders, and eliminate them.
- Use the Go menu in your Finder again and click Applications
- Scrutinize the list of installed apps to try and locate the malicious one. This could also be a shot in the dark because the culprit isn’t going to be named Bing redirect or similar. Your goal is to spot a recently added fishy-looking program you didn’t wittingly install. Send it to the Trash immediately
- Click the Apple menu icon and pick System Preferences. You can as well click the gear symbol in the Dock if it’s there
- Head to Users & Groups and click Login Items. Click the padlock icon at the bottom left to enable changes – this will require your admin password. Find the app that shouldn’t be started automatically at boot time, select it, and click the ‘minus’ symbol
- When on the System Preferences screen, select Profiles. In most cases, the list will show up blank unless it’s a company-issued Mac and your employer has added a configuration profile to manage specific areas of the system. Anyway, if you see a profile that shouldn’t be there (e.g. AdminPrefs or TechSignalSearch), select it and click the ‘minus’ symbol to eradicate it
So much for the manual removal workflow. Keep in mind that most Mac threats stretch their grip over to web browsers. If this is the case, your online activities will continue to be affected and you’ll need to additionally tackle the browser side of the attack. Here’s how you do it.
Bing removal in a web browser on Mac
The steps below will help you regain control of the browsing preferences hijacked by Bing redirect. Be advised that you may be logged out of sites and lose your web customizations as a result of this procedure. The silver lining, though, is that the malware won’t be meddling with your online sessions anymore.
Troubleshoot Safari malfunctioning
- Open Safari, expand the Safari pull-down menu, and pick Preferences
- Click Advanced and check the ‘Show Develop menu in menu bar’ box
- You’ll see the Develop menu added at the top of the screen. Click it and select Empty Caches on the list
- Expand the History entry in the Safari menu and select Clear History
- It’s best to pick all history in the follow-up screen to obliterate all malicious cookies and website data generated by the malware. Then, click Clear History
- Return to the Safari Preferences, select the Privacy section, and click the Manage Website Data button
- Click Remove All on the subsequent screen
- Finish the procedure by restarting Safari
Restore Google Chrome defaults
- Open Google Chrome, click the Customize and control Google Chrome (⁝) symbol in the upper right, and choose Settings
- Click Reset settings
- The browser will display an extra dialog so that you can familiarize yourself with the logic of the cleanup before proceeding. Go ahead and click the Reset settings button as illustrated below
- Restart Google Chrome
Fix the problem in Mozilla Firefox
- Open Firefox, click its menu icon (three horizontal lines), select Help, and click Troubleshooting Information
- Click Refresh Firefox and confirm the action
- Restart Mozilla Firefox
Remove Bing redirect using Combo Cleaner
Manual removal of Mac malware could be a bumpy road because you run the risk of missing small fragments of the infection, in which case all the efforts may be futile down the line. The automatic tool called Combo Cleaner eliminates this pitfall by leveraging effective detection algorithms to identify every single malicious file on your Mac. This way, Bing virus removal is a matter of a few clicks and a couple of minutes’ wait. Use the following steps to give it a go.
Download and install Combo Cleaner app.
The free scanner will let you know if your Mac is infected. To remove viruses, you will have to buy the Premium version of Combo Cleaner.
- Run the tool, let it perform the virus and malware definitions update, and click Start Combo Scan
- The app is equipped with a competitive mix of security, privacy, and optimization features. Therefore, not only does it spot prevalent Mac malware but it also finds tracking cookies and unneeded files that take a lot of disk space and should be deleted
- If Combo Cleaner detects threats on your Mac, it will provide a report containing the number of these infections and the categories they fall into. At this point, all you need to do is click the Remove Selected Items button
- Having uninstalled malware from your Mac, you should redefine your web browser preferences manually if they have been previously modified by the infection without your consent.