Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Safefinder impossible to remove

Hi, I have tried every single recommended step to remove Safefinder but it still is there.


  • installed ComboCleaner and ran it; it found 5 elements and I deleted them - still there
  • In Safari - preferences it does not appear in extensions so cannot remove it
  • It also has not set itself as my homepage so cannot change that either


Needless to say, I have rebooted my Macbook several times, the bugger is still there. Any ideas what else I could do?


Very grateful for help!

MacBook, macOS 10.14

Posted on Mar 24, 2019 5:49 AM

Reply
Question marked as Best reply

Posted on Mar 24, 2019 6:34 AM

Please take all these steps.

It is very hard to remove this malware.

Please read step #4.


1. Use MalwareBytes for Mac to remove malware/adware.


Install guide: https://support.malwarebytes.com/docs/DOC-1817

Uninstall Guide: https://support.malwarebytes.com/docs/DOC-1190

   Click the “Scan Now” button. Once done, quit Malwarebytes for Mac.

     Restart the computer and relaunch Safari holding the shift key down.


2. Safari > Preferences > Extensions

Disable all extensions and test.


Turnoff or uninstall extensions.

Section: Manage extensions: https://support.apple.com/guide/safari/use-safari-extensions-sfri32508/mac

3. Choose a search engine.

Delete all text in the Smart Search field, click the magnifying glass, then choose a search engine from the list.

https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac


4. Set your Home Page.

Follow the suggestion given here:

 https://forums.malwarebytes.com/topic/236261-how-to-remove-weknow-malware-and-others/


5 Restart your Mac. Launch Safari holding the shift key down.


Similar questions

15 replies
Question marked as Best reply

Mar 24, 2019 6:34 AM in response to florence229

Please take all these steps.

It is very hard to remove this malware.

Please read step #4.


1. Use MalwareBytes for Mac to remove malware/adware.


Install guide: https://support.malwarebytes.com/docs/DOC-1817

Uninstall Guide: https://support.malwarebytes.com/docs/DOC-1190

   Click the “Scan Now” button. Once done, quit Malwarebytes for Mac.

     Restart the computer and relaunch Safari holding the shift key down.


2. Safari > Preferences > Extensions

Disable all extensions and test.


Turnoff or uninstall extensions.

Section: Manage extensions: https://support.apple.com/guide/safari/use-safari-extensions-sfri32508/mac

3. Choose a search engine.

Delete all text in the Smart Search field, click the magnifying glass, then choose a search engine from the list.

https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac


4. Set your Home Page.

Follow the suggestion given here:

 https://forums.malwarebytes.com/topic/236261-how-to-remove-weknow-malware-and-others/


5 Restart your Mac. Launch Safari holding the shift key down.


Mar 27, 2019 4:38 AM in response to florence229

Hi,


First of all, you should ensure that you ran a Full Scan not the Combo Scan.


To do so, launch Combo Cleaner and select Antivirus feature from the left side menu.


In case you did, the next step should be to perform a full browser reset using Privacy Scanner feature.


Safefinder is known to hide it's malicious scripts within your Bookmarks and cache files.


First, give a full disk access permissions to Combo Cleaner.


To grant full disk access for Combo Cleaner:


1. Visit System Preferences and open Security & Privacy pane.

2. Select Privacy pane and choose Full Disk Access from the list.

3. Authenticate with administrator password to grant permissions to modify settings, then click Add (+) button. 

4. Navigate applications folder and select Combo Cleaner, click Open.

5. Restart Combo Cleaner. 


To perform Browser Full Reset:


Note: full browser reset will erase bookmarks, extensions, saved password and other personal data, please make a note If you have any important bookmarks or other. 


1. Close your browser by right-clicking Dock icon and selecting Quit. (This is important step, wait until dot below Safari icon in Dock disappears.)

2. Launch Combo Cleaner and select Privacy Scanner

3. Click Start Scan,

4. Once it finishes, select Full Reset from the left list

5. Select Safari Full Reset from the right list,

6. Click Remove.

7. Restart your Mac.


If you're struggling to follow the instructions or having any other troubles while using Combo Cleaner, do not hesitate to contact Combo Cleaner support via email address: support@combocleaner.com

Apr 7, 2019 8:23 AM in response to florence229

I (indirectly (on brother's computer)) recently encountered this issue as well. Like many people recommend when dealing with it I downloaded & ran MalwareBytes several times to hopefully eradicate the issue. Also went through the Library folder clearing out any suspicious folders & files that some research showed was at least related to the SafeFinder malware such as "MacPerformance.plist" but despite all that & several restarts both browsers on the computer (Safari & Chrome) still launch with SafeFinder or in Safari's case there is a "homesweeklies.com" URL in place which I can not remove. Running macOS Mojave if it matters.


Hopefully there would be some other option available to help clear it out entirely.


Thanks.

Apr 7, 2019 11:41 AM in response to Eric Root

Seems I spoke too soon. It's back but not the same as before. Whereas before when Chrome was opened it would show that SafeFinder page but was able to use URL bar to search using Google now it is reverse, in that it opens up a Google page but using the URL bar gets search results from SafeFinder.


The real effort for right now is to eliminate it from Chrome if at all possible since that is the main browser being used. I could deal with Safari at a later point.


As far as what Dominic suggested:

Yes, installed & ran MalwareBytes several times & it quarantined & I removed what it picked up concerning it, as well as checking through & removing suspicious looking files & folders in the Library folder. At last check it reports no issues.


As far as what you suggested I did also install & run ComboCleaner which took quite a while to scan & I believe I checked those same sites in my own research for the issue as well (it was quite a few).


My brother said he got rid of some things on his own prior to telling me about it, which I would assume would be the app it left behind as well as 'Flash player' & something to do with booking.com.


I checked Safari & there are no extensions with that name or anything related to it. Went so far as to uninstall Chrome completely & reinstall.

Safefinder impossible to remove

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.