I understand that searchpulse is a virus.
Not good that this first appeared after I updated my Firefox desktop app on my travel computer.
How do I get rid of it?
How do I tell Mozilla about this problem?
Thanks much for any tips.
Searchpulse is a browser hijacker/adware infection, so not a true virus. You might be able to remove it by simply checking to see if you’ve accidentally installed an add-on that’s causing it. If so, just remove any that you don’t recall having installed.
If that doesn’t help, you’ll probably need help from some anti-malware software. DetectX is now freeware (at least until V2 is released) so probably start with that. A couple of others I usually recommend are ClamXAV and Malwarebytes for Mac. Both have fully operational trial modes and Malwarebytes will revert to a free mode after 14 days.
Full disclosure, I have provided uncompensated assistance to all three developers over several years, so not totally unbiased.
Once you’ve removed the extension and or other files, make sure your Home page and search engine preferences are restored to your previous default options.
3 Likes
OP back. Since the problem is on my travel computer and no travel, I’m just now getting back to attempt fix the problems.
With respect to your suggestion, I just downloaded DetectX.
I would appreciate your advice on next step on the infection and the other two.
I’ll try to upload to this reply. Not sure I remember how to do so on TidBITS Talk.
Al:
I forgot to mention… Each time on launch Firefox, I get this in the address bar:
Thanks for any suggestions. I appreciate.
That’s not what I wanted to paste on the prior post.
I wanted you to see the raw data address. Not sure how to do that.
Again, thanks for any help with this.
I’ve fixed it. Discourse has three levels of URL display. By default, it tries to show a preview, which is what you were running into. Failing that, it may show the title of the page, which isn’t always ideal either. Finally, you can always get it to show the raw URL. Here are the tricks.
For a preview, put the URL on a line by itself. If Discourse can generate a preview, it will. (It can’t always, depending on what the linked site provides.)
For a page title, put the URL on a line by itself and then prefix it with a space. That usually does it, although it may also display the raw URL.
For a guaranteed raw URL, surround the URL with angle brackets.
And if you don’t want it to be transformed into a link (especially useful if it is or is suspected to be malware), prefix it with four or more spaces, to make it a code fragment:
http://search.searchpulse.net/?_pg=CB9D3E73-BF27-5413-BC63-09BBEAA20AF8&affid=dhm_A0UML_set_bfr_H&type=h&pid=dhm
1 Like
Thanks Adam
Now if Al or some other expert will help me get rid of this searchplus link in the Firefox address box on opening.
And what to do with the DetectX findings.
Thank you
If you do a search for “searchpulse remove mac”, you’ll find a lot of articles on the subject, but most seem to be ads for automated software uninstallation tools. Since I don’t know which of these are legitimate and which may themselves be malware, I won’t recommend any of them.
For manual removal, all the articles I’ve found seem to have vague hand-waving procedures which really require experience to properly follow, but here is one that doesn’t look too tricky to follow:
A quick summary is:
-
Delete any apps that you don’t want from the Applications folder
-
Delete any rogue system profiles from System Preferences. It appears that SearchPulse uses this as the mechanism to override browser settings.
In general, most people shouldn’t have any profiles installed - they are typically used to enforce corporate security policies. If this is your personal computer and you didn’t explicitly install a profile, then there shouldn’t be any installed.
-
Clean browsers:
- Remove unwanted extensions
- Reset search engine preferences and uninstall unwanted search engines
- Reset home page, new tab, new window and related preferences
-
Some sites also recommend looking into various LaunchAgents and LaunchDaemon folders looking for plist files that auto-start it in the background (which may, in turn, reinstall it in your browsers)
1 Like
Thank you for the suggestion.
Not sure why you are waiting for me, the instructions from DetectX would seem to completely answer what the next step is. Deleting the second item listed should completely disable the infection and cleaning up the folder shown in the first and Cron job in red should prevent any more detections. Contact support@sqwarq.com for instructions on removing that last item.
The steps outlined by @Shamino are good general steps for removing all kinds of adware, but don’t actually cover any of the items that DetectX identified with this particular version of searchpulse.
I suspect that you may also have to change the Search Engine used by Firefox after removing those detections. Just open “Preferences” from the Firefox menu and click on “Search” to make certain your preferred method is identified there.
Thanks very much.
I was hesitant to just follow DetectX since I’ve had times when instructions given were modified by those in the know.
I’ll proceed.
Appreciate the help from everyone.