Question I'm having trouble getting rid of "Search Baron" browser hijacker ?

ComputerWontBoot

Distinguished
Dec 29, 2015
51
0
18,540
I believe I recently installed some malware on my MacBook (macOS Monterey Version 12.0.1). I was trying to download a program and I got redirected to some other software download. I idiotically downloaded it and got all the way through the installation process before realizing that I had downloaded the wrong thing (am I a boomer?) I think this was the culprit of the following:

Two weeks later, a Chrome search got redirected to a website called "Search Marquis". I checked Safari and Firefox, and both of them did the same thing. I eventually got some Antivirus free trial. It detected and removed some Malware.
Now, the Search Marquis thing is gone, but instead I'm getting bounced from Google to "searchbaron" dotcom to Bing. Safari is no longer affected though (somewhere along this process I uninstalled Firefox, so I can't speak to that).

Any search about this Hijacker will give you the same list of steps: get rid of your Chrome extensions, check Chrome's search engine settings, reset your Chrome settings, check your Macbook's log-in items, check the LaunchAgents folder and the LaunchDaemons folder and the Application Support folder and check the Activity Monitor... I've tried this all five times over. It doesn't work.

I did some deep scans with Avast. It found some more malware and I removed it. Then I tried Malwarebytes, because that's what everyone tells you to try. Again, it found some more malware and I removed it. Now it's coming up dry. I uninstalled Chrome, reinstalled... Before logging in, it worked fine. Then I logged in, and it's sending me to Search Baron again. I cleared a whole bunch of crap from my Google account - cookies, settings, history, passwords, etc. Then I signed out... Still got the Search Baron. I'm kind of at my wit's end here. Any guidance would be much appreciated. Thank you.
 

Ralston18

Titan
Moderator
This:

"I uninstalled Chrome, reinstalled... "

What is the source of the Chrome software?

Be very careful about the URL/pathname(s) to the source. Both for the browser itself and any subsequent extentions, etc..

Look for some factor common to all of the reinstalls.

You mentioned that Search Baron reappeared when you signed out and again logged in? Any other users on the Mac? Does Search Baron appear when other users login?

Compare the user login configurations, defaults, etc..

Create and test another user if necessary. Minimal configuration and no clones.

Also check the Mac's hosts file.

FYI:

https://www.hostinger.com/tutorials...rs can find the,you have root user privileges.

https://www.imore.com/how-edit-your-macs-hosts-file-and-why-you-would-want