0

Each time when I type some non-existing domain name in Chrome bar address, I'm redirected to Level3 Search engine.

For example when going to: http://javauto.org, I'm getting the immediate redirect to: http://searchguide.level3.com/search/?q=http%3A//javauto.org/&r=&t=0 with some ads and meaningless results.

I don't know how this got installed. I don't have any Level3 extensions and I use DuckDuckGo as my default search engine.

How can I remove this Level3 search engine from Chrome? As this is very annoying.

Level3 Search Guide in Chrome

To clarify, my default search engine is set to DuckDuckGo:

Chrome, Search, Set which search engine is used when searching from the omnibox

And Level3 doesn't exist on the main search settings list, either on Other search engines list.

Search engines, settings, DuckDuckGo

Here is my DNS configuration:

$ cat /etc/resolv.conf 
nameserver 4.2.2.1
nameserver 8.8.8.8
nameserver 8.4.4.2

I've checked the other post here, but it's not duplicate, because:

  • It talks only about Windows workarounds.
  • DNSUnlocker and Malwarebytes are Windows apps.
  • The first answer is actually one sentence question.
  • To clarify, I don't have any fishy extensions or malwares. It also happens in incognito mode.

Yes, I'm using Google DNS, but I don't know how removing it would solve the issue.

This is also not duplicate of spyware post, because I don't have any malware on my macOS. Believe it or not, I really know when I have one (already checked with launchctl and ps). So this problem has nothing to do with viruses as linked Windows post says. In this post at Apple.SE it's suggested that it's caused by using free DNS and that ISP is forcing the redirect (NXDOMAIN record). Please reopen, so I can share my solution once I find one.

kenorb
  • 24,736
  • 27
  • 129
  • 199
  • go to _Settings_ -> _Manage Search Engines_ (in the search sector) and tell me what you see in the _Default search settings_ – Jimmy_A Jun 02 '17 at 13:24
  • @D.A It's DuckDuckGo – kenorb Jun 02 '17 at 13:25
  • Click on the manage search engines... Can you see there the searchguide.level3? – Jimmy_A Jun 02 '17 at 13:26
  • @D.A No, it's not even on the list. – kenorb Jun 02 '17 at 13:27
  • what about in the other search engines in the same pop up – Jimmy_A Jun 02 '17 at 13:28
  • I've posted the screenshot. It's not on _Other search engines_ list either. – kenorb Jun 02 '17 at 13:29
  • 1
    "Searchguide.level3.com (aka Searchguide Level 3) is a DNS modifying browser hijacker application which intercept web traffic and causes certain browser redirects to other websites. " – DavidPostill Jun 02 '17 at 13:29
  • ok, have a look at http://www.thewindowsclub.com/remove-searchguide-browser-hijacker. as well as the question that you were marked as duplicate – Jimmy_A Jun 02 '17 at 13:30
  • [Fully Delete Searchguide.level3.com From Your Browsers (Working Solution)](http://www.cleaningpcmalware.com/fully-delete-searchguide-level3-com-from-your-browsers-working-solution) – DavidPostill Jun 02 '17 at 13:30
  • I'm using macOS Sierra, is removing Google DNS the only solution? – kenorb Jun 02 '17 at 13:32
  • http://subharanjan.com/get-rid-searchguide-level3-com-hack-solved/ – Jimmy_A Jun 02 '17 at 13:33
  • @DavidPostill Answer from other question doesn't make sense. Accepted answer is actually another question, other talks about Malware, I'm using Mac. – kenorb Jun 02 '17 at 13:34
  • malwarebytes also comes in MacOS – Jimmy_A Jun 02 '17 at 13:35
  • @kenorb It's malware. See also [How can I remove malicious spyware, malware, adware, viruses, trojans or rootkits from my PC?](//superuser.com/q/100360)?s=3|0.0000 – DavidPostill Jun 02 '17 at 13:35
  • @DavidPostill You posted the link to Windows, I'm using Mac and I don't have any malwares. – kenorb Jun 02 '17 at 13:37
  • @kenorb It is malware, ergo you have malware. – DavidPostill Jun 02 '17 at 13:39
  • Yes you do. Since searchguide.level3 is a malware, and you got it. you have a malware. Try using an antimalware. As i said, malwarebytes comes in macOs as well and it's very effective – Jimmy_A Jun 02 '17 at 13:39
  • @kenorb [Remove Searchguide Level 3 from Mac OS X system](http://www.2-spyware.com/remove-searchguide-level-3-virus.html#h-mac-os-x) – DavidPostill Jun 02 '17 at 13:40
  • @D.A I don't have malware. I'm asking for direct solution, not general links how to remove Windows viruses. This is very specific question about very specific problem with level3, it's not duplicate to Windows threat. – kenorb Jun 02 '17 at 13:41
  • What makes you think that you don't have malware? And both me and @DavidPostill listed you links for mac as well – Jimmy_A Jun 02 '17 at 13:43
  • Because I would know. I'll find out about it further more. I don't have any Babylon apps as suggested in the link. I see no help from here, so I'll have to investigate my-self, but at the end it won't be helpful for others, because I won't have anywhere to share the solution. I've checked all the posted links, posts, but they're basically useless. Marking the question about Mac issue by the one from Windows as duplicate is basically wrong. – kenorb Jun 02 '17 at 13:52
  • You can always answer your own question and help others. But I still insist that you should make a malware scan – Jimmy_A Jun 02 '17 at 13:59
  • I'd love to, but I can't answer my own question which is marked as duplicate to some general Windows post about viruses. – kenorb Jun 02 '17 at 14:04
  • 1
    then you can do it here. https://apple.stackexchange.com/questions/240000/non-existing-urls-redirect-to-searchguide-level-3-in-safari. this is a community for mac users and lovers. either post it there, or ask your question to be transferred to that community – Jimmy_A Jun 02 '17 at 14:09
  • Yes, it makes more sense that 'it happens because of faulty, free DNS servers' and ISP force-insert thing (NXDOMAIN). – kenorb Jun 02 '17 at 14:12
  • 1
    Yes, it was DNS configuration. No any malware. The 4.2.2.1 is basically owned by Level3, and they can do whatever they want, simple as that. Posted [the answer here](https://apple.stackexchange.com/a/285617/22781). This duplicate link will only confuse people to look for malware which doesn't exist. This is why questions shouldn't be closed by a single person without understanding the context. – kenorb Jun 02 '17 at 15:05
  • I’ve voted to reopen this question. But, (1) While it doesn’t *explain* your particular situation, and is not *specific* to Mac, [ChrisF’s answer](https://superuser.com/q/100360/150988#111296) (the 4th-oldest one, and 6th-highest ranked) to [the malware question](https://superuser.com/q/100360/150988) describes your problem and how to fix it in an OS-agnostic way. (2) Kārlis K.’s response to the [Browsers redirect to level3.com if domain does not exist](https://superuser.com/q/1168481/150988) question, which you disparaged (and, apparently, downvoted and flagged),  … (Cont’d) – Scott - Слава Україні Jun 17 '17 at 21:11
  • (Cont’d) …  did, in fact (a) help the OP of that question to solve his problem, (b) *identify* your problem, and (c) it could have easily been edited into a proper answer, rather than being demoted to a comment, if anybody had cared to do so.  (3) While I agree that some of the links provided by D.A and David Postill seem a little dubious, I don’t see any [recommendation that you remove Google DNS](https://superuser.com/q/1215389/150988#comment1774704_1215389).  … (Cont’d) – Scott - Слава Україні Jun 17 '17 at 21:12
  • (Cont’d) …  (4) If you believe that you are immune to malware because you have a Mac, you might want to think again.  I’m sorry, but I laughed when I read your statements that you “would know” if you had any malware, and you knew that you didn’t have any because you had checked with `ps`. … (Cont’d) – Scott - Слава Україні Jun 17 '17 at 21:12
  • (Cont’d) …  (5) So, did you configure your machine to use 4.2.2. as a DNS Server?  (Your question says “I don’t know how this got installed.”, and [neither](https://superuser.com/q/1168481/150988#1215414) of your [answers](https://apple.stackexchange.com/a/285617) explains how *your machine* got configured that way.)  If you didn’t do it, how can you explain it?  Are you sure that your ISP imposed it on you?  If you can’t explain it, how can you rule out the possibility that it was done by malware? – Scott - Слава Україні Jun 17 '17 at 21:12
  • @Scott I'm not saying that I'm immune to malware because I've Mac, just I've just enough knowledge and experience to know how malware/viruses works and how to deal with them, it's like explaining IT support how to fix the computers or sysadmin how to use Linux. In the past on Windows I was hacking into trojan botnets which one got onto my PC unexpected. Never had antivirus (unless company policy says so), and never had unexpected virus which I was not aware of. Playing with viruses is fun for me, but it's laugh for me to say that I may have one if I don't. – kenorb Jun 18 '17 at 17:51
  • @Scott Thanks for the edit in other post. If this question won't be reopen, I'll remove this post anyway, since it's pointing to the wrong post. As it basically relates to people who are using DNS from Level3 and people here claims that they've malware. Level3 sounds like a professional company and they don't deal with malware at all. – kenorb Jun 18 '17 at 17:55

0 Answers0