I have moved Safe Finder to the trash and emptied the trash, but this malware has still taken over Safari homepage and greyed it out. It also took over Chrome. I don't dare open Firefox! I downloaded and ran EtreCheck but it found nothing. I have deleted the "Profiles" in System Preferences. Running Mojave 14.4 (The apparent origin of my problems) Please help! Thanks
iMac 21.5", macOS 10.14
For instructions: Install Malwarebytes for Mac Uninstall Malwarebytes for Mac
Click the “Scan Now” button. Once done, quit Malwarebytes for Mac.
Restart the computer and relaunch Safari holding the shift key down.
2. Remove unknown Login item.
System Preferences > Users & Groups > Login items
Authenticate and unlock the lock.
Highlight the unknown login item and click the “-“ button at the bottom left to remove it.
3. Homepage: Ref: https://https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac
4. Remove unknown extensions: Safari > Preferences > Extensions
https://support.apple.com/guide/safari/use-safari-extensions-sfri32508/mac
5. Reset search engine: https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac
With these hard to remove malware, repeating the process helps sometimes.
That is from my experience here.
Thank you for the feedback.
That is the best option to pursue.
Wish you all success.
Thanks! I am doing that right now! I wonder if it's naive to feel hopeful!?
I have walked through all the manual instructions on how to remove Safe Finder. I continue to get the same file quarantined by MalwareBytes sisinfo.plist. This is the 15th one today. But Safe Finder is still there --
It's NOT in my Apps and it's not in any of the extensions. It does not "show up" anywhere except the browsers... Here is the plist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>isExist</key>
<string>YES</string>
</dict>
</plist>
1. Remove unknown profiles, if any.
System Preferences > Profiles
Open System Preferences, click the “Profiles” icon ( a checkmark on a gear) .
When Profiles pane opens, select the unknown profile and click the minus button at the bottom.
2 SafeFinder will store a cookie in your bookmarks folder.
Manage cookies and website data in Safari on Mac
Please read.
Ref: https://forums.malwarebytes.com/topic/236261-how-to-remove-weknow-malware-and-others/
Safe Finder took over my computer - now can't remove it or change homepages
