Fix browser hijack survey.eliteserverconnect.xyz

My wife's early 2011 MacBook Pro running OS X Lion 10.7.5 is suffering from a browser hijack, I think.
Whenever she opens Safari, it immediately directs to survey.eliteserverconnect.xyz and a popup appears "Congratulation! You are Todays Lucky Visitor.  Click OK to continue"  Of course, she does not click OK, but until she does, she cannot use Safari as her screen is frozen.
I have closed Safari and rebooted the MacBook Pro.  I have force-closed Safari.  I have force-closed Safari and hard shut-down and re-started the MacBook Pro.  Every time I open Safari it immediately directs to this survey.eliteserverconnect.xyz site with a popup.
Does anyone know how I can fix this?  Should I purchase some antivirus software?  I am fairly computer literate and can follow clear instructions.  I have experienced this issue before, with "MacKeeper" (or something like that), and managed to fix it, but I do not remember how.
I will continue to research this on the internet, but in the meantime any advice is welcome.
Thanks in advance,
G

The Apple link below should help.
Remove unwanted adware that displays pop-up ads and graphics on your Mac - Apple Support

Similar Messages

  • My Safari is stuck on on a webpage  "survey.tubgalley.xyz....."  It also has a pop up box with "Congratulations you are today's lucky winner, click OK to continue".  I can't close these out, and have tried force quiting Safari and shutting down.

    My Safari browser is stuck on a webpage "survey.tubgalley.xyz...." and there is a pop up with "Congratulations, you are today's lucky winner, Click OK to continue".  ( I have not of course clicked on it!).
    I have tried quitting Safari, and shutting down my computer.
    I have block pop ups enabled in preferences.
    I have Mac OS X  10.7.5
    2.5 GHz Intel Core i5
    4 GB 1333 MHz DDR3

    Helpful Links Regarding Malware Problems
    If you are having an immediate problem with ads popping up see The Safe Mac » Adware Removal Guide, AdwareMedic, or Remove unwanted adware that displays pop-up ads and graphics on your Mac - Apple Support.
    Open Safari, select Preferences from the Safari menu. Click on Extensions icon in the toolbar. Disable all Extensions. If this stops your problem, then re-enable them one by one until the problem returns. Now remove that extension as it is causing the problem.
    The following comes from user stevejobsfan0123. I have made minor changes to adapt to this presentation.
    Fix Some Browser Pop-ups That Take Over Safari.
    Common pop-ups include a message saying the government has seized your computer and you must pay to have it released (often called "Moneypak"), or a phony message saying that your computer has been infected, and you need to call a tech support number (sometimes claiming to be Apple) to get it resolved. First, understand that these pop-ups are not caused by a virus and your computer has not been affected. This "hijack" is limited to your web browser. Also understand that these messages are scams, so do not pay any money, call the listed number, or provide any personal information. This article will outline the solution to dismiss the pop-up.
    Quit Safari
    Usually, these pop-ups will not go away by either clicking "OK" or "Cancel." Furthermore, several menus in the menu bar may become disabled and show in gray, including the option to quit Safari. You will likely have to force quit Safari. To do this, press Command + option + esc, select Safari, and press Force Quit.
    Relaunch Safari
    If you relaunch Safari, the page will reopen. To prevent this from happening, hold down the 'Shift' key while opening Safari. This will prevent windows from the last time Safari was running from reopening.
    This will not work in all cases. The shift key must be held at the right time, and in some cases, even if done correctly, the window reappears. In these circumstances, after force quitting Safari, turn off Wi-Fi or disconnect Ethernet, depending on how you connect to the Internet. Then relaunch Safari normally. It will try to reload the malicious webpage, but without a connection, it won't be able to. Navigate away from that page by entering a different URL, i.e. www.apple.com, and trying to load it. Now you can reconnect to the Internet, and the page you entered will appear rather than the malicious one.
    An excellent link to read is Tom Reed's Mac Malware Guide.
    Also, visit The XLab FAQs and read Detecting and avoiding malware and spyware.
    See these Apple articles:
      Mac OS X Snow Leopard and malware detection
      OS X Lion- Protect your Mac from malware
      OS X Mountain Lion- Protect your Mac from malware
      OS X Mavericks- Protect your Mac from malware
      About file quarantine in OS X
    If you require anti-virus protection Thomas Reed recommends using ClamXAV. (Thank you to Thomas Reed for this recommendation.)
    From user Joe Bailey comes this equally useful advice:
    The facts are:
    1. There is no anti-malware software that can detect 100% of the malware out there.
    2. There is no anti-malware that can detect everything targeting the Mac.
    3. The very best way to prevent the most attacks is for you as the user to be aware that
         the most successful malware attacks rely on very sophisticated social engineering
         techniques preying on human avarice, ****, and fear.
    4. Internet popups saying the FBI, NSA, Microsoft, your ISP has detected malware on
        your computer is intended to entice you to install their malware thinking it is a
        protection against malware.
    5. Some of the anti-malware products on the market are worse than the malware
        from which they purport to protect you.
    6. Be cautious where you go on the internet.
    7. Only download anything from sites you know are safe.
    8. Avoid links you receive in email, always be suspicious even if you get something
        you think is from a friend, but you were not expecting.
    9. If there is any question in your mind, then assume it is malware.

  • I've encountered a browser hijack issue

    Note: I feel compelled to warn everyone that unless you're comfortable fixing a potential malware infection you should be careful in recreating my problem. I didn't plan to make the following URLs into actual links, but apparently the board does it automatically.
    I know OS X is apparently malware free, but I'd rather err on the side of caution.
    I was doing political research and Googled for "Queens County Democrats." This is the results URL:
    https://www.google.com/search?q=queens+county+democrats&ie=utf-8&oe=utf-8&aq=t&r ls=org.mozilla:en-US:official&client=firefox-a
    This is the full Google-redirect link to the first result.
    http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CF8QFjAA&url =http%3A%2F%2Fqueenscountydems.com%2F&ei=xFTGT6HSNuP40gGu_-2RCw&usg=AFQjCNHsAhNb A95dS1oRlmLcht9ipYaEmw
    The first time I clicked the resulting link I landed on a clickfarm. The second and subsequent times I was redirected to monkeyball.osa.pl, a known browser hijack for PCs.
    But if you directly use the URL for the site, queenscountydems.com, it works fine.
    I've reproduced this same issue on the MacBook of an employee here — I'm at a coffee shop run by friends, and they just got a new router. However, said employee tried it again at home and got the same result, which they think means it's the Democrats' site or Google. I didn't mention that it could also mean their computer could have contracted malware.
    So is it the political party's site? Google's results? The router here? Or have I discovered and been infected by a Mac browser hijack?
    Thanks in advance.

    I see the same thing here, and I'm already using the OpenDNS servers.  That won't fix it.  The problem is not related to DNS, which would cause any attempt to go to the site directly to also fail.  The problem is SEO poisoning, a technique by which a hacker can get malicious links or scripts into Google's search results.  This issue is completely on Google's end, and in no way related to the computer.  If you were to try this on ANY device, you should see the same thing (as peter_watt has indicated).
    SEO poisoning is a serious threat these days.  It's the primary method that the MacDefender trojans used to display fake anti-virus sites to unsuspecting users a year ago.

  • What is this Ask Home Page that has attached to Firefox? Is it a browser hijacker of some kind? How do I get rid of it?

    Is the Ask Home Page suppose to be attached to Firefox home page? How do I get rid of this mess? I have Windows 8, that I HATE.

    Hello,
    Yes it appears to be a browser hijacker. Please see:
    * http://malwaretips.com/blogs/remove-ask-toolbar-and-search/
    Note: If you find that after restarting Firefox the Ask homepage is still there, see the articles:
    * [[Wrong home page opens when I start Firefox - How to fix]]
    * [[How to fix preferences that won't save]]

  • How to permanently remove about:blank browser hijacker?

    I would like to know if anyone has successfully removed about:blank browser hijacker. I have been seeing about:blank show up and keep trying different ways to remove it and it seems to work temporarily but comes back. I have cleared history, cookies, cache all recommended by other users but it doesn't last. Can anyone help?

    Hi, not sure exactly what (if any) malware scans you've already run, so try working through [https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware this article.]
    Hope this will fix it.

  • How am I supposed to get help with a browser hijacker when I cannot contact no one and every single option in the knowlege base concerning this doesn't work?

    I have some spyware on my system that neither my malaware bytes, comodo antivirus, spybot search and destroy, and a few others I've tried, can detect. The piece of spyware is a browser hijacker that keeps hijacking my firefox homepage and nothing I can do will get rid of it.
    the problem only happens in firefox and no other browser is affected. basically my homepage gets changed to the following:
    http://www.ggle.org.uk/index.php?hp=1&OVKWID=firefox
    Yes there are numerous options about this in the support section but none of them work. I have tried everything and I do mean everything and each time I restart firefox the bloody thing comes back. I've reset the pc - works until you close down the browser and restart it. I've gone into my profiles, i.e. user/AppData/Mozilla/firefox and deleted the .js files, parent.lock files - comes back on firefox restart. I've searched the registry the best I can. I have even put an entry into the Hosts file in syst32 and that has afforded me partial success in that I now get a 404 instead of the pesky and irritating jaamla search page. I have even gone into the About:config settings and wiped the url but no matter what I do it always comes back on restart and it's only with firefox.
    This is something that firefox needs to look into and not assume that just because there are a few answers in the support section that they all work, because all of the options appear to work until firefox is restarted.
    It even comes back after a complete uninstall and wipe - I am at a loss at what to do and where to go next. Please help!

    I think the next step is to use Windows 7's auditing feature to figure out what processes are touching the file other than firefox.exe.
    This is somewhat arduous to set up, but here's what I did. I have Win 7 Pro and I don't know whether this works on other versions.
    (1) Open the Event Viewer to the Security log
    Start menu > Control Panel > System and Security category > Administrative Tools
    This should launch a folder of shortcuts. Double-click Event Viewer. If Windows objects, you may need to right-click> Run as Administrator.
    In the left pane of the Event Viewer, click Security.
    (2) Enable object auditing
    In the Administrative Tools folder, double-click Local Security Policy (or right-click > Run as Administrator).
    In the left pane, expand Local Policies and click Audit Policy.
    In the right pane, double-click Audit object access and turn on both success and failure and OK the change. (screen shot attached)
    (3) Enable auditing on prefs.js
    Right-click your prefs.js file > Properties, click the Security tab, then the Advanced button. In the Advanced Security Settings dialog, click the Audit tab, then the Continue button. (screen shot attached)
    Click the Add button and type Everyone, then click Check Names. After you click OK, you should get a dialog with numerous checkboxes. Clicking the Full Control box for each column should select everything. Then OK that. (screen shot attached)
    (4) Test
    Change a preference in Firefox that updates prefs.js (for example, you can change your home page). Then when you switch over to the Event Viewer, you can click Refresh on the right side (or choose a different category such as Application and then Security again to refresh the list), and you should find a listing in the File System task category for "a handle to the object was requested" for prefs.js, showing firefox.exe to be the active process. (screen shot attached)
    (5) Assuming the test works, exit Firefox and watch for any other process touching the file.
    When you're through, you probably want to turn this all off again, since it does use cycles in the background.

  • Vonteera Browser hijacker in about:config, how to remove?

    Hello,
    I have been infected by a Browser Hijacker, which posts ads on websites. It shows "ads by Volaro" and by doing some reading on the net, Vonteera is involved/ the cause. I have tried to clean the registry and removed several suspicious files from the respective folders in my profile, cleared the pref.js in Mozilla several times, no effect.
    In the about:config, I have noticed two Vonteera processes, namely:
    vonteera.randurls;{"tp|www.adnets|info|:srv1|do":1,"tps|www.adnetworkus|com|:srv1|analytics":1}
    vonteera.randurlsdate;1415467507208
    They keep coming back, even if I reset them. I am pretty sure they are the cause of evil.
    Any idea how to circumvent this?

    Well done.

  • Browser Hijacks on Safari and Firefox

    For the last 10 days I've been getting browser hijacks when using Safari, taking me to sites such as www.vcigar.com, or getting notices that 'Safari is unable to open the page due to too many diverts'.
    I tried downloading Firefox, but the same thing is happening.
    I've tried all of the following:
    - emptying the cache
    - re-setting Safari
    - disabling Javascript
    - running ClamXav
    - cleaning Leopard
    - re-installing the system
    None of these has identified any problem with my system or eradicated the problem, which if anything has worsened in the last few days.
    Can anyone out there offer any advice as to what to try next?
    Thanks in advance for your time.

    Mulder, thanks for your response.
    I have tried what you suggested, but nothing was found and the problem persists.
    Any page I try to go to, it attempts to divert to http://www.dropped.pl/ and then safari gives the following message:
    Safari can’t open the page.
    Too many redirects occurred trying to open “http://www.bbc.co.uk/”. This might occur if you open a page that is redirected to open another page which then is redirected to open the original page.
    This happens persistently, irrespective of page.
    Any ideas, anyone?

  • Why is the browser hijacker Vosteran listed in the search engine drop down menu?

    New download of Firefox 33.1 has a known browser hijacker listed in the drop down menu. It took me several hours to remove it's damaging files and get any browser to work correctly again. This is insane!

    Hi mach37, can you delete the Vosteran search engine by highlighting it on the Search panel of the Options dialog and using the Remove button?
    ''If it comes back:'' I would suspect a bad add-on. Here's my suggested procedure for tracking down and cleaning those up:
    (1) Open the Windows '''Control Panel''', Uninstall a Program (on XP: Add/Remove Programs). After the list loads, click the "Installed on" column heading to group the infections, I mean, additions, by date. This can help in smoking out undisclosed bundle items that snuck in with some software you agreed to install. Take out as much trash as possible here.
    (2) Open Firefox's '''Add-ons page''' using either:
    * Ctrl+Shift+a
    * "3-bar" menu button (or Tools menu) > Add-ons
    In the left column, click '''Plugins'''. Set nonessential and unrecognized plugins to "Never Activate".
    In the left column, click '''Extensions'''. Then, if in doubt, disable (or Remove, if possible) unrecognized and unwanted extensions.
    Often a link will appear above at least one disabled extension to restart Firefox. You can complete your work on the tab and click one of the links as the last step.
    Any improvement?
    (3) You can search for remaining issues with the '''scanning/cleaning tools''' listed in our support article: [[Troubleshoot Firefox issues caused by malware]]. These on-demand scanners are free and take considerable time to run. If they finish quickly and especially if they require payment, you may have a serious infection. I suggest the specialized forums listed in the article in that case.
    Success?

  • How do I remove the browser hijacker istart123?

    I updated to Mozilla Firefox 35.0.1 (x86 en-US) on Jan. 27, 2015 after which a browser hijacker called istart123 infected my computer. Did this pup come with your update? I have tried removing it through the uninstall option in my Windows 8, and using the search option and endeavoring to delete it once the files were identified, as well as following various directions for removing addons to your browser and I have tried using Malewarebytes to remove it- nothing works. I am currently following numerous directions supplied via an internet search and I'm am trying another anti malware program. I also followed all the directions from my anti virus program Webroot- so far nothing works. Any suggestions?

    Separate Issue;
    Your System Details shows;
    Installed Plug-ins
    Shockwave Flash 15.0 r0
    Shockwave Flash 11.9 r900
    Shockwave Flash 14.0 r0
    Shockwave Flash 16.0 r0
    Having more than one version of a program may cause issues.
    Grab the uninstaller from here:
    '''[http://helpx.adobe.com/flash-player/kb/uninstall-flash-player-windows.html Uninstall Flash Player | Windows]'''
    Security Issue: Update your Flash Player '''v16.0.0.305<br>https://www.adobe.com/products/flashplayer/distribution3.html'''
    Shockwave Director '''v12.1.6.156 http://get.adobe.com/shockwave/'''

  • Browser Hijacker uploaded with Adobe Reader XI

    I got an alert that my Reader was outdated, clicked the link and uploaded Adobe Reader XI. I read the teeny tiny print to include AVD safegaurd - wasn't sure about that and unchecked. Maybe that was a mistake? In any case, the browser hijacker "Delta_Search" came in with Adobe reader and infected by computer. It's taken many hours and many attempts to dislodge that malware, but finally successful (using AdwCleaner). Any one else have experience with this - seems like I was victim of a trojan update alert.

    Sadly, the original update probably wasn't from Adobe, but was a trick to get you to download more software than you wanted under a trusted banner. Many have seen this.

  • How can I fix this hijack?

    Here's my problem, and I browsed through the forums to find a solution, but none have the particular problem I'm having. Yesterday, I downloaded the updated (current) FireFox, updated my addons, and added new addons. Night falls, I shut my computer off and go to work. Today I get home, start my computer, hoping to use my favorit browser, but there's a problem. When I enter a search query in any search engine, the searches alter themselves, and load unto a new engine of some kind I haven't even heard of (one being http://www.tazinga.com/, out of like two or three). I can go to the address bar, type in an address, and it loads, or copy and paste a link and it loads that way as well, but as far as clicking on a link to go there from the engine, negative. If you need more information, let me know and I can try to provide, but please, HELP! Thank you.
    == This happened ==
    Not sure how often
    == Today (7-4)

    I have a similar problem that happens when ever I do a search in Google, when I click on a link, down the lower-left is says "us-srch-system.com" you taken to a bunch of different web sites, of course they have nothing to do with your search. I've looked high and low on the net, ans so far I CAN'T believe no one else has the same Hijacker.
    All I know is this, if I disable Java Script, the problem is gone, but now-a-days who want to run a browser without Java.
    I guess what really pisses me off is, that neither Google of Mozilla have a fix, and you think these companies wold know their own products, and be able to help people with hijackers that are synonymous to their own products.

  • Browser hijacker about:blank. Firefox goes to about:home. Can we get rid of about:? And HOW?

    slows computer, affects mouse use, about:blank is a web hijacker which I have avoided for 15 years. Now, suddenly, every computer has it. I am behind a router. The only changes I have made is to update firefox. Can you provide help for removing this? When I go to your app for which sets things back to default and pull up your page, in SAFE MODE, I get "about:home" in my address bar. I don't think it's safe to even install your fix at this point. I'd appreciate hearing back from you. Thank you.I am sending this from an OLD computer whose firefox is not updated but where about:home still appears.

    hello,
    Changing the Newtab Page
    Go to about:config and search for this option "browser.newtab.url" and chande its value to a page that you want, for example, google.com
    [https://support.cdn.mozilla.net/media/uploads/images/2014-01-04-19-39-42-943359.png]
    Changing Home Page
    Still on about:config search for this other option "browser.startup.homepage" and change for a page that you want
    [https://support.cdn.mozilla.net/media/uploads/images/2014-01-04-19-39-34-b5e7d9.png]
    *[http://kb.mozillazine.org/About:config about:config]

  • Mac OSX 10.6.8 web browsing hijacked

    I seem to have contracted some sort of trojan or malware, or have some sort of DNS changer that I inadvertently installed... or somehow got on my system.
    When browsing in any browser (i have used Safari, Chrome, and Firefox), i am often redirected to a chinese advertisement site (should be too suprising, as Ilive in China).  At first, i thought it was the ISP that was redirecting, but after having experienced this issue over the past week at numerous locations, i'm pretty sure my machine has a problem that need to be figured out. 
    I have tried MacScan and DNSchanger removal tool.  I have tried dumping the cash in the terminal.  I have deleated my flash cookies and all browsing histlry/cache files.  I've tried a few other things that I thought might work as I found them on older posts for similar issues. None of these have resolved the issue. 
    The only thing i can think that may have caused it is i was recently staying at a hotel and having issue with their internet.  They sent an "IT" guy to fix it and he made some changes to the network settings (i wasn't paying close enough atention to what he was doing).... in the end, the internet never worked at that hotel and from that point forward, i've had this problem. I can't say there is cause and effect with that, but corrolation for sure. 
    The site i'm being directed to is:  nfdnserror5.wo.com.cn:8080/issueunziped/baidunf120718/index1.jsp?sf=&UserUrl=ww w.facebook.com
    I'm runing a MacBook pro 13"
    Mac OSX 10.6.8
    All my browsers are up to date. 
    Any ideas?  Am I forgetting any important details?

    Hi all,
    I am living in China and getting the same thing. Its very recent but it seems ChinaUnicom are trying to takover Google, BBC, NYT and other URL's and point you to their own web services (of course fully supported by the Chinese Government). Behaviour is very sporadic, sometimes Chrome, but mostly Firefox. I have checked host files, dns, everything and the only way to stop it is to delete all cookies and history from the browser after infection and restart. Its a total pain as I have the Google double sign in system turned on and I have to re-authenticate twice to get into my Gmail.
    I also have the greyed out DNS entries but they are legit servers - Google 8.8.8.8 and our company one. Maybe they are taking over the google 8.8.8.8 in the Great firewall of China? However once infected and I am in my office (has a tunnel throught the Chinese Firewall) I still get the re-direct and from reading this thread users returning to the USA still are infected so it can not be the GFC!
    The thing that makes me think its not DNS is, on the same system I can have it happen in Firefox but not Chrome at the same time, unless the cookies can somehow override DNS.
    I can also see that a site actually begins to load and then sometime through the page load (before it completes) the redirect happens.
    I would love to know how they are doing this but I dont want to share my cookies with the world! I am 90% convinced this is where its happening.
    Any ideas from any of the big brains out there.

  • IPad mini Safari Browser hijacked - any ideas to defend against intrusion?

    My safari session was hijacked as in I was no longer in control of where the browser was going and typing. Almost like a remote control app.  When I proceeded to iPad settings the hacker attempted to stop me from shutting down JavaScript, block cookies and eventually shutting down
    There was no Bluetooth connection open therefore no possibility of a nearby snooper and I was on a private home network.

    You may want to check this out.  We were seeing login issues prior to finding this.
    http://stackoverflow.com/questions/12506897/is-safari-on-ios-6-caching-ajax-resu lts

Maybe you are looking for