Forum

Shroomcourt anyone?  

   RSS

0

A friend's iMac was performing really badly - and I found some malware on it called Shroomcourt.  It came along with an app called PDFtoDOC.  I've removed all the things I can find in Applications, library/application support and library/launchd and ~ library/application support and ~library/launchd and performance is now much much better.  However it has hijacked Safari by setting search.shroomcourt.com as the home page and I can't change it!  The 'use current page' button doesn't have any effect and overtyping it doesn't work.  There was a Shroomcourt extension but I have removed that.

Any ideas how I can reset the safari home page?

Cheers, Andy

3 Answers
1

I've found that MalwareBytes for Mac works very well removing adware.  You can use the free version and unload it when you are done.  It is used a lot in the http://discussions.apple.com forums

And when you are finished checking (and cleaning) uninstall MalwareBytes

Tried that. MalwareBytes found something but not that.

You should give feedback to the MalwareBytes guys.  They are fairly responsive to adding new adware removal to the product.

1

Some thoughts....

1) You don't explicitly mention if the Mac was rebooted after cleaning up launch items & extensions. This is generally necessary unless you have done a manual force quit of the nasty background processes after cleaning up (including any related apps hiding in the Application Support folder).

2) Test if you can fix the Safari settings when the Mac is booted in Safe Mode - which should prevent any 3rd party extensions & background processes from launching automatically. If that works but things revert when you reboot normally then you know there is still an infection hiding somewhere.

3) These types of malware can hide under many different names - treat anything in the ~/Library/LaunchAgents, /Library/LaunchAgents, and /Library/LaunchDaemons folders as suspicious - if unsure move the items out to the desktop and progressively move back in and reboot to observe.

4) It may also help to launch Safari while holding down the Shift key to tell it to not try to open anything from previous session. The "anything" could be something that reloads javascript, or likewise, infection vectors.

Thanks for the suggestions Graham

I did a few reboots but I didn't look in the launchdaemons folder - I shall do that next time I am able to have a look

Cheers

Thanks for the suggestions Graham

I did a few reboots but I didn't look in the launchdaemons folder - I shall do that next time I am able to have a look

Cheers

0

https://support.apple.com/guide/safari/change-your-homepage-ibrw1020/mac

"The 'use current page' button doesn't have any effect and overtyping it doesn't work."

Share: