Google Automatically Switches To Bing (Mac Virus removal guide)

Why does Google automatically switch to Bing?

If Google is your default search engine, but every time you use Google it switches to Bing, your browser is probably hijacked by a browser hijacker. Browser hijacker is a type of malware installed on a computer that is designed to take control of a web browser, change browser setting, appearance, or other computer behavior without the user’s permission. It is often called a “browser redirect virus” because it redirects the browser to other, usually malicious, websites.

In most cases, browser hijackers change the home page, new tab URL and browser search engine. In addition to this, browser hijackers can display unwanted ads, collect information about the user without the user’s knowledge, be used as a backdoor for malicious file uploads via unsafe websites.

Browser hijackers can be bundled with software or a game that the user wants. In many cases, during installation the bundle will access a third-party server that delivers the most current browser hijacker or malicious browser extension. Additionally, the same installer can be utilized to deliver a much higher-severity malware.

QUICK LINKS

• Why does Google automatically switch to Bing?
• Threat Summary
• Removal

Why did my search engine change to Bing?

If Google is set as the default search engine in your browser, and when searching the web, your browser is redirected to Bing, then your browser is infected with browser hijacker malware, malicious browser extension that was installed accidentally, by mistake, or when you were misled. This extension is easy to remove, just use Browser Extension Manager. But there are also cases where malicious browser extensions change browser settings in such a way that these changes cannot be easily removed either using Browser Extension Manager or by changing the search engine and home page in browser settings. In such cases, even after setting Google as a home page or a search engine, your browser will still redirect you to Bing.

Startpage.gg redirects user searchers to Bing

Though the are other kinds of browser hijackers that can act as a spyware. Spyware is a form of malware which aims to monitor your activity, gather information about you and your browsing habits, and then transmits that information back to a remote entity. Spyware can be used to grant remote access to hackers, steal financial or personal information. Spyware can act as keylogger, which records your keystrokes to reveal passwords and other sensitive information like bank or credit card details. This makes it a high severity threat.

Attackers often use browser hijackers to redirect users to fake virus alerts that trick users to buy or install applications that are not needed, pornographic content, various diet pills, work-at-home schemes and other questionable content. Below are some examples of such sites:

In summary, browser hijackers can seriously affect your privacy, your computer’s performance and security.

Threat Summary

Examples of Browser hijackers

More examples of browser hijackers are below:

Browser hijackers can be used to distribute other malware. They install trojans, adware, keyloggers, ransomware, spyware and more. Some of the malware designed to collect user data, others install ransomware and trojans on computers, and still others add infected computers to botnets, and so on. In any case, each malicious program is a huge threat to both user privacy and computer security. Therefore, malicious programs must be removed immediately after detection; using an infected computer is very dangerous.

How Browser Hijackers can infect your computer?

Browser hijackers can infect you computers by numerous means, including through shareware, freeware, malicious websites, ad clicks and browser extensions. They can also installed on your computer through a technique known as “binding”. Binding is a process of hiding malicious programs behind the appearance of genuine ones. Typically, the links to download such programs are put out on torrents and file sharing sites, people get taken in and download them.

Another method used by attackers to install browser hijackers on Mac computers is through file sharing websites and torrents by masquerading as program installers, hacked software and key generators for commercial games and programs. Malicious ads are also used to push adware apps.

Examples of scam pages that are designed to trick you into installing malware (browser hijackers):

Sometimes it is possible to avoid the setup of any adware: run only reputable software which download from reputable sources, never install any unknown and suspicious apps, keep internet browser updated (turn on automatic updates), use good antivirus software, double check freeware before install it (do a google search, scan a downloaded file with VirusTotal), avoid malicious and unknown web pages.

How do I stop Google from automatically switching to Bing (Redirect virus removal guide)

Unfortunately, when it happens that Google automatically switches to Bing, it is not always easy to get rid of it, as there is no uninstaller to remove Bing redirect and restore normal browser settings. Therefore, in order to completely remove browser hijackers, we recommend that you follow the steps described below, and after completing them, scan your computer with a free malware removal tool. It will help you restore your favorite search engine and home page, remove browser hijackers and other malware.

To remove Bing redirect (browser hijacker), follow the steps below:

1. Uninstall apps associated with Bing redirect
2. Remove browser hijacker related files and folders
3. Scan your Mac with MalwareBytes
4. Remove Bing redirect from Safari
5. Remove Bing redirect from Chrome
6. Remove Bing redirect from Mozilla Firefox

Uninstall apps associated with Bing redirect

As we said above, browser hijackers can infect Mac computers through shareware and freeware. Therefore, first of all, we recommend that you carefully review the entire list of installed apps, uninstall unknown, suspicious and unused software.

Make sure you have closed all web browsers and other apps. Click on the Finder icon. Click Applications on the left side of the Finder window. You will be shown a list of installed applications.

Uninstall browser hijacker related software from the “Applications” folder.

Carefully browse the entire list of installed applications and remove all suspicious ones. Pay special attention to apps that are unfamiliar to you or that you did not install. If in doubt, use the search engine to find more information about the application. To remove a suspicious application, right-click on it and select “Move to Trash”. Do not forget to empty the trash after you uninstall all suspicious applications.

Remove browser hijacker related files and folders

Now you need to try to find browser hijacker related files and folders, and then delete them manually. You need to look for these files in certain directories. To quickly open them, we recommend using the “Go to Folder…” command.

Click on the Finder icon. From the menu bar, select Go and click “Go to Folder…”. As a result, a small window opens that allows you to quickly open a specific directory.

Check for browser hijacker generated files in the /Library/LaunchAgents folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchAgents

This will open the contents of the “/Library/LaunchAgents” folder. Look carefully at it and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files that are created by browser hijackers, PUPs, adware and malware: macsearch.plist, com.machelper.plist, installapp.plist, etc. Most often, malware create several files with similar names.

Check for browser hijacker generated files in the /Library/Application Support folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/Application Support

This will open the contents of the “Application Support” folder. Look carefully at its contents, pay special attention to recently added/changed folder. Move all suspicious folders to the Trash.

Check for browser hijacker generated files in the “~/Library/LaunchAgents” folder

In the “Go to Folder…” window, type the following text and press Go:
~/Library/LaunchAgents

Proceed in the same way as with the “/Library/LaunchAgents” and “/Library/Application Support” folders. Look for suspicious and recently added files. Move all suspicious files to the Trash.

Check for browser hijacker generated files in the /Library/LaunchDaemons folder

In the “Go to Folder…” window, type the following text and press Go:
/Library/LaunchDaemons

Carefully browse the entire list of files and pay special attention to recently created files, as well as files that have a suspicious name. Move all suspicious files to the Trash. A few examples of files that are created by browser hijackers, PUPs, adware and malware: com.macsearch.plist, com.machelper.plist, com.installapp.plist, etc. Most often, malware create several files with similar names.

Scan your Mac with MalwareBytes

If you carefully followed the previous steps, then you should be able to remove browser hijackers and other PUPs. Of course, very often a browser hijacker hides on a computer, disguising itself as legitimate apps and files. Therefore, in some cases, it is difficult for an inexperienced user to decide whether a particular file is part of malware. Therefore, in addition to the steps described above, we recommend that you scan your Mac using a program called MalwareBytes. This tool allows you to fully scan the system and detect browser hijackers. After the scan, you can remove the found malware for free.

Visit the page linked below to download the latest version of MalwareBytes Anti Malware (MBAM) for Mac OS.

Malwarebytes Anti-malware (Mac)
20956 downloads
Author: Malwarebytes
Category: Security tools
Update: September 10, 2020

When the file download is complete, launch it and follow the prompts. Press the Scan button to scan the Mac and detect browser hijacker components. If malware is found during scanning, it will be immediately shown in the program window. Scanning may take some time, so wait. As soon as the scan is completed you will be shown its result. By default, all malicious threats are marked for deletion. It is recommended to remove all found malware. When the removal of malicious files is completed, proceed to the next part of this instruction, where you will need to remove browser hijacker related extensions from browsers and reset their settings, if necessary.

Remove Bing redirect from Safari

After completing the steps described above, now you need to carefully browse the list of installed extensions, remove those extensions that are associated with the browser hijacker. After that, check the Safari browser settings, and if they have been changed, then restore them to their original state.

Run Safari web-browser. Next, select Preferences from the Safari menu.

Click the “Extensions” tab. This will open the list of installed extensions. Look for suspicious and recently installed extensions on left panel, select it, then click the “Uninstall” button. Keep in mind that sometimes malicious extensions may be hiding under the name of well-known extensions. Therefore, in some cases, you need to remove all the extensions, and then reinstall the ones you need from their official pages.

Change your homepage:

Click “General” tab. In the Homepage field, type the the URL of the website you want to set as a homepage. To simply use the webpage you are currently viewing, click “Set to Current Page” button.

Change your search engine:

Click “Search” tab. To change search engine, click the dropdown menu next to “Search engine”. Choose the option you prefer.

Remove Bing redirect from Chrome

If your Chrome has been affected by the browser hijacker, then you need to follow some specific steps. These steps will allow you to remove malicious extensions, restore your home page and search engine, as well as other browser settings that have been changed by the virus.

Remove browser hijacker related extensions:

Run Google Chrome and click Menu button (small button in the form of three dots). Choose “More Tools”, then press Extensions.

This will open the list of installed extensions. Look for suspicious and recently installed extensions. Once found, press Remove, and then confirm the removal of the extension by pressing Remove again. Keep in mind that sometimes malicious extensions may be hiding under the name of well-known extensions. Therefore, in some cases, you need to remove all the extensions, and then reinstall the ones you need from their official pages.

Change your homepage:

Click Chrome Tools menu and choose Settings. Scroll down to the “On Startup” section. Under “On startup”, select the “Open a specific page or set of pages” option. To remove an unwanted homepage, to the right of a page, click “More Actions” (button in the form of three dots) and then Remove. Delete all pages that have been added by the browser hijacker. Click “Add a new page”, type the web address and click Add button. To simply use the webpage you are currently viewing, click “Use current pages” button.

Change your search engine:

Click Chrome Tools menu and choose Settings. Scroll down to the “Search” section. Under “Search,” click “Manage search engines”. To remove an unwanted search engine, to the right of a fake search engine, click “More Actions” (button in the form of three dots) and then “Remove from list”. Delete all unwanted search engines that have been added by the browser hijacker. In the list of search engines, select the search engine that you prefer, click “More Actions” button to the right of it and select “Make default”.

If this does not help you remove browser hijackers from Chrome, then Reset Google Chrome.

Remove Bing redirect from Firefox

If your Firefox has been hijacked by the browser hijacker, then you need to follow several steps to restore your home page and search engine. To restore your browser settings you need to remove malicious extensions, and then change the home page and search engine.

Remove browser hijacker related add-ons:

Run Firefox, click “Open Menu” button (looks like three horizontal lines) and choose “Add-ons”.

This will open the list of installed add-ons. Look for suspicious and recently installed add-ons. To delete a suspicious add-on, click the “three dots” button to the right of its name and then Remove. Keep in mind that sometimes malicious add-ons may be hiding under the name of well-known extensions. Therefore, in some cases, you need to remove all the add-ons, and then reinstall the ones you need from their official pages.

Change your homepage:

Click “Open Menu” button (looks like three horizontal lines) and choose Preferences. Click Home on the left side of the window. To change homepage, select the dropdown menu next to “Custom URLs…”, type the the URL of the website you want to set as a homepage. To simply use the webpage you are currently viewing, click “Use Current Page” button.

Change your search engine:

Click “Open Menu” button (looks like three horizontal lines) and choose Preferences. Click Search on the left side of the window. To change your search engine, under “Default Search Engine”, click the dropdown menu and choose the option you prefer.

If this does not help you remove browser hijacker from Firefox, then Reset Mozilla Firefox.

Finish words

This manual was created to help you stop Google from automatically switching to Bing. We described in detail how to remove browser hijackers from the Chrome, Safari and Firefox. We hope that this instruction helped you. If you are still having problems while trying to get rid of Bing redirect from the Safari, Chrome, and Mozilla Firefox, then ask for help here.