Searchesmia browser hijack

[JetFred]

I've been on the phone with my son for two hours trying to fix how he messed up Chrome when he was getting Minecraft shaders. He clicked something he shouldn't have and then he noticed Chrome started defaulting to Bing. He tried to reset Chrome and found that under default search, Chrome setting said something called Apps was controlling that choice. That thing shows up as an extension that can't be turned off, and the default search can't be changed.

I dropboxed him the download for Malwarebytes and it found some entries but nothing seemed to change after quarantining them. Edge and Firefox don't seem to have the problem and nothing shows up in the installed apps. The only place I see Searchesmia is in the description of the mysterious unalterable "Apps" extension, which is still there after running Malwarebytes.

A web search suggests all kinds of nonsense. Apparently Searchesmia covers a variety of virus, hijackers, and other behaviors that aren't all what he's seeing. At the moment he's trying to uninstall Chrome but hasn't reinstalled it yet to see if it's still there. There's no evidence yet that anything else on the PC is misbehaving.

Thoughts?

[Anonymous Bosch]

I've been on the phone with my son for two hours trying to fix how he messed up Chrome when he was getting Minecraft shaders. He clicked something he shouldn't have and then he noticed Chrome started defaulting to Bing. He tried to reset Chrome and found that under default search, Chrome setting said something called Apps was controlling that choice. That thing shows up as an extension that can't be turned off, and the default search can't be changed.

I dropboxed him the download for Malwarebytes and it found some entries but nothing seemed to change after quarantining them. Edge and Firefox don't seem to have the problem and nothing shows up in the installed apps. The only place I see Searchesmia is in the description of the mysterious unalterable "Apps" extension, which is still there after running Malwarebytes.

A web search suggests all kinds of nonsense. Apparently Searchesmia covers a variety of virus, hijackers, and other behaviors that aren't all what he's seeing. At the moment he's trying to uninstall Chrome but hasn't reinstalled it yet to see if it's still there. There's no evidence yet that anything else on the PC is misbehaving.

Thoughts?

I would suggest downloading and using TronScript to do a better and more thorough job of cleaning his system, as explained below:

[JetFred]

It isn't there after reinstalling Chrome, and a full custom Malwarebytes scan finds nothing, but I'll watch that video and see what I think. Thanks.

"Apps" is such a useless search term that I couldn't find anything on the web saying it looked like that for other users, so I still feel like I haven't found anyone who resolved this particular problem before.

[Carpet_pissr]

Wow, that looks amazing. But argh, no support for Win 11?

[JetFred]

So I've never heard of Sophos. Can we just download that since we just want to disinfect, and already ran Malwarebytes?

[Rumpy]

Does Chrome have a safe mode? I know that Firefox does, and lets you launch the browser without any extensions activated if you have problems in order to remove them. Might be able to do it that way.