Searchesmia browser hijack

For general computer discussion & help, come here

Moderators: Bakhtosh, EvilHomer3k

Post Reply
User avatar
JetFred
Posts: 4805
Joined: Fri Oct 15, 2004 11:26 am
Location: In an open field west of a white house

Searchesmia browser hijack

Post by JetFred »

I've been on the phone with my son for two hours trying to fix how he messed up Chrome when he was getting Minecraft shaders. He clicked something he shouldn't have and then he noticed Chrome started defaulting to Bing. He tried to reset Chrome and found that under default search, Chrome setting said something called Apps was controlling that choice. That thing shows up as an extension that can't be turned off, and the default search can't be changed.

I dropboxed him the download for Malwarebytes and it found some entries but nothing seemed to change after quarantining them. Edge and Firefox don't seem to have the problem and nothing shows up in the installed apps. The only place I see Searchesmia is in the description of the mysterious unalterable "Apps" extension, which is still there after running Malwarebytes.

A web search suggests all kinds of nonsense. Apparently Searchesmia covers a variety of virus, hijackers, and other behaviors that aren't all what he's seeing. At the moment he's trying to uninstall Chrome but hasn't reinstalled it yet to see if it's still there. There's no evidence yet that anything else on the PC is misbehaving.

Thoughts?
I have but one advocate.
User avatar
Anonymous Bosch
Posts: 10512
Joined: Thu Oct 14, 2004 6:09 pm
Location: Northern California [originally from the UK]

Re: Searchesmia browser hijack

Post by Anonymous Bosch »

JetFred wrote: Sat Jan 28, 2023 3:10 pm I've been on the phone with my son for two hours trying to fix how he messed up Chrome when he was getting Minecraft shaders. He clicked something he shouldn't have and then he noticed Chrome started defaulting to Bing. He tried to reset Chrome and found that under default search, Chrome setting said something called Apps was controlling that choice. That thing shows up as an extension that can't be turned off, and the default search can't be changed.

I dropboxed him the download for Malwarebytes and it found some entries but nothing seemed to change after quarantining them. Edge and Firefox don't seem to have the problem and nothing shows up in the installed apps. The only place I see Searchesmia is in the description of the mysterious unalterable "Apps" extension, which is still there after running Malwarebytes.

A web search suggests all kinds of nonsense. Apparently Searchesmia covers a variety of virus, hijackers, and other behaviors that aren't all what he's seeing. At the moment he's trying to uninstall Chrome but hasn't reinstalled it yet to see if it's still there. There's no evidence yet that anything else on the PC is misbehaving.

Thoughts?
I would suggest downloading and using TronScript to do a better and more thorough job of cleaning his system, as explained below:

"There is only one basic human right, the right to do as you damn well please. And with it comes the only basic human duty, the duty to take the consequences." — P. J. O'Rourke
User avatar
JetFred
Posts: 4805
Joined: Fri Oct 15, 2004 11:26 am
Location: In an open field west of a white house

Re: Searchesmia browser hijack

Post by JetFred »

It isn't there after reinstalling Chrome, and a full custom Malwarebytes scan finds nothing, but I'll watch that video and see what I think. Thanks.

"Apps" is such a useless search term that I couldn't find anything on the web saying it looked like that for other users, so I still feel like I haven't found anyone who resolved this particular problem before.
I have but one advocate.
User avatar
Carpet_pissr
Posts: 19980
Joined: Thu Nov 04, 2004 5:32 pm
Location: Columbia, SC

Re: Searchesmia browser hijack

Post by Carpet_pissr »

Wow, that looks amazing. But argh, no support for Win 11?
User avatar
JetFred
Posts: 4805
Joined: Fri Oct 15, 2004 11:26 am
Location: In an open field west of a white house

Re: Searchesmia browser hijack

Post by JetFred »

So I've never heard of Sophos. Can we just download that since we just want to disinfect, and already ran Malwarebytes?
I have but one advocate.
User avatar
Rumpy
Posts: 12674
Joined: Sun Mar 27, 2005 6:52 pm
Location: Sudbury, Ontario, Canada

Re: Searchesmia browser hijack

Post by Rumpy »

Does Chrome have a safe mode? I know that Firefox does, and lets you launch the browser without any extensions activated if you have problems in order to remove them. Might be able to do it that way.
PC:
Ryzen 5 3600
32GB RAM
2x1TB NVMe Drives
GTX 1660 Ti
Post Reply