I have tried EVERYTHING to remove safe finder - followed the steps closely and have used multiple different malware/adware/virus removal sites but nothing seems to pick it up. Google chrome browser automatically open to the safe finder page and I cannot get rid of it!! HELP!
MacBook Air (2018 or later)
https://forums.malwarebytes.com/topic/236261-how-to-remove-weknow-malware-and-others/
2. If this doesn’t help, download EtreCheck: https://etrecheck.com/maspro and post the report here.
Click, “Free Download” button and then “Click to download” button,
open Downloads folder, click on it to open, and then select ”Open”.
Click on the bouncing EtreCheck icon in the Dock.
“Choose a problem” from the popup menu box, and then “Start EtreCheck” in the dialog.
Click “Share Report” button in the toolbar and select “Copy report” .
Paste the report when you reply.
Note: This is a diagnostic test. Reading the report will help us not make unnecessary suggestions.
https://forums.malwarebytes.com/topic/236261-how-to-remove-weknow-malware-and-others/
2. If this doesn’t help, download EtreCheck: https://etrecheck.com/maspro and post the report here.
Click, “Free Download” button and then “Click to download” button,
open Downloads folder, click on it to open, and then select ”Open”.
Click on the bouncing EtreCheck icon in the Dock.
“Choose a problem” from the popup menu box, and then “Start EtreCheck” in the dialog.
Click “Share Report” button in the toolbar and select “Copy report” .
Paste the report when you reply.
Note: This is a diagnostic test. Reading the report will help us not make unnecessary suggestions.
1. Use the latest release of MalwareBytes for Mac to remove malware/adware.
Install guide: https://support.malwarebytes.com/docs/DOC-1817
Uninstall Guide: https://support.malwarebytes.com/docs/DOC-1190
The installer may ask you to allow it in Security & Privacy /System Preference. Allow it.
Click the “Scan Now” button. Once done quit Malwarebytes for Mac.
Restart the computer, relaunch Safari holding the shift key down.
2. Remove unknown and third party installed extensions.
https://support.apple.com/guide/safari/use-safari-extensions-sfri32508/mac
3. Reset search engine. https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac
4. Reset Homepage. https://support.apple.com/guide/safari/set-your-homepage-ibrw1020/mac
5. Restart the computer, relaunch Safari holding the shift key down.
1. Remove unknown profiles.
System Preferences > Profiles
Open System Preferences, click the “Profiles” icon ( a checkmark on a gear) .
When Profiles pane opens, select the unknown profile and click the minus button at the bottom.
2. Reset Chrome settings to default. https://support.google.com/chrome/answer/3296214?hl=en
Full drive access: Disabled
Problem: Other problem
Major Issues:
Anything that appears on this list needs immediate attention.
No Time Machine backup - Time Machine backup not found.
Minor Issues:
These issues do not need immediate attention but they may indicate future problems.
Corrupt filesystem - This machine shut down due to a corrupt filesystem.
Unsigned files - There are unsigned software files installed. They appear to be legitimate but should be reviewed.
32-bit Apps - This machine has 32-bits apps that may have problems in the future.
Abnormal shutdown - Your machine shut down abnormally.
Limited drive access - More information may be available with Full Drive Access.
Security:
GatekeeperEnabled
System Integrity ProtectionEnabled
Unsigned Files:
Launchd: ~/Library/LaunchAgents/com.google.keystone.agent.plist
Executable: ~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
Details: Exact match found in the whitelist - probably OK
32-bit Applications:
2 32-bit apps
System Launch Agents:
[Not Loaded] 16 Apple tasks
[Loaded] 172 Apple tasks
[Running] 111 Apple tasks
System Launch Daemons:
[Not Loaded] 36 Apple tasks
[Loaded] 190 Apple tasks
[Running] 109 Apple tasks
Launch Agents:
[Running] com.rosettastone.rosettastonedaemon.plist (? fb2f5604 - installed 2018-12-01)
Launch Daemons:
[Loaded] com.adobe.fpsaud.plist (Adobe Systems, Inc. - installed 2018-04-29)
User Launch Agents:
[Loaded] com.google.keystone.agent.plist (? 0 - installed 2019-02-14)
Internet Plug-ins:
QuickTime Plugin: 7.7.3 (installed 2018-11-30)
Time Machine:
Time Machine Not Configured!
Performance:
System Load: 5.01 (1 min ago) 4.23 (5 min ago) 2.97 (15 min ago)
Nominal I/O speed: 5.19 MB/s
File system: 71.68 seconds
Write speed: 700 MB/s
Read speed: 1169 MB/s
CPU Usage:
Type Overall
System 13 %
User 24 %
Idle 63 %
Top Processes by CPU:
Process (count) CPU (Source - Location)
Other processes 81.68 % (?)
Google Chrome 48.79 % (? - /Volumes/G***********e/G***************p)
Google Chrome Helper 8.76 % (? - /Volumes/G***********e/G***************p)
EtreCheck 4.09 % (App Store)
mdworker_shared (7) 1.38 % (Apple)
Top Processes by Memory:
Process (count) RAM usage (Source - Location)
EtreCheck 438 MB (App Store)
Google Chrome 231 MB (? - /Volumes/G***********e/G***************p)
com.apple.photos.ImageConversionService (2) 114 MB (Apple)
Google Chrome Helper 112 MB (? - /Volumes/G***********e/G***************p)
Finder 94 MB (Apple)
Top Processes by Network Use:
Process Input / Output (Source - Location)
mDNSResponder 99 KB / 16 KB (Apple)
apsd 9 KB / 11 KB (Apple)
cloudd 7 KB / 1 KB (Apple)
netbiosd 1 KB / 2 KB (Apple)
SystemUIServer 0 B / 64 B (Apple)
Virtual Memory Information:
Available RAM 4.17 GB
Free RAM 1.48 GB
Used RAM 3.83 GB
Cached files 2.68 GB
Swap Used 0 B
Software Installs (past 30 days):
Install Date Name (Version)
2019-02-10 MRTConfigData (1.39)
2019-02-10 Gatekeeper Configuration Data (162)
2019-02-14 Malwarebytes for Mac
2019-02-14 "Malwarebytes for Mac Uninstaller"
2019-02-14 EtreCheck (5.1)
Diagnostics Information (past 7 days):
2019-02-14 17:57:26 Last Shutdown Cause: -60 - Corrupt filesystem
Directory /Library/Logs/DiagnosticReports is not accessible without Full Drive Access.
End of report
I’ve tried all of that and it still comes up as chromes homepage 🙁
I don't have anything that says "profiles". Trust me, i've checked extensions on both chrome and safari and i've reset them both and there is nothing out of the ordinary that I can see..
I did this after I removed google and it's components completely and re-installed with Safe Finder still there
After reading through the post, I was able to remove even more files that didn't apply and it finalllly worked! Thank you for all your help!
Safe Finder
