I made a mistake and hijacked Safari. The option to change my landing page, where this appears, is greyed out. I was hoping the new OS would somehow clear out this bug but it didn't. None of the fixes suggested online sorted me out. So I can't use Safary anymore.
[Link Edited by Moderator]
iMac Line (2012 and Later)
Reset Safari: Try Clearing Your Temporary Internet Files: History and Cache. All sites should load anew (Background items, selected items, entered data, etc).
Bd could add correct details for me.
do a find search for url
there is same search app
or
terminal bd correct syntax
cd ~
find -x . -type f -exec grep -il "hacker site.com" {} \;
or
cd /
to search everything
R
Okay, that works. So does that give you an idea what might be wrong with my original user account? Or should I transfer all my settings etc. to the new one and delete the old one? How do you even do that?
Phew. I did it... and it didn't work. Relaunched Safari, opened preferences to set home page and it immediately greyed out with the hijacker's URL still in it. Sorry, you must be getting a bit tired of this by now.
I don't know how to tell you this. It didn't work. Safari was infected in safe mode as well. I deleted the login items anyway and logged on normally again, but no changes. Frankly, I'm happy to give up now and just keep using Opera.
Team Viewer was left over from when a techie set me up with Creative Cloud for remote work. Didn't even realise it was still there... Anyway, Gog I've had from well before the problem started. Even so, I did everything you suggested and still no change. I'm sorry about taking up so much time. Not using Safari probably isn't a big deal but I'll be worried what else the malware might be doing...
Morning. After full reinstall of Catalina, this in chronological order. I first opened Safari. home page tab still hijacked and greyed out. But just after I clicked on Safari to launch it, a small dialogue box flashed on the screen, too fast to see anything on it. Next I opened Mail. No unknown or suspicious mails there. I wrote a mail to a friend with a
gmail account. The moment I clicked send, Mail closed. I then made another Etrecheck (attached). I can upload the Mail crash report if you think it might be relevant. I can also add a sceen shot of the setting in Safari but I'm not sure if moderator will allow it.
Hi, didn't make a difference, I'm afraid. I don't know if moderator will allow it but I'm adding a screen shot of my Safari settings so you can see what the culprit looks like. What annoys me most is that these people have a website where they cheerfully sell their add-on. How I got it: I downloaded and installed a new audio unit demo (I enjoy fooling around with them in Garageband). Like many people I impatiently clicked through the Ts & Cs and accidentally also said yes to bundleware which promised a faster, safer browser experience. These are the bad guys. It's fairly easy to remove them from Firefox, which I did. But not from Safari, possibly because it's so integrated in the total operating system? I'm no expert.
Install & Enable JavaScript:
Installing JavaScript would install it anew. Because Web sites work via html, JavaScript allows sites to operate in a particular fashion to the server of the the Web site.
I’m not so certain Google would use JavaScript for background colors. Use this link, but enable or disable it, and see what occurs. How to disable the Java web plug-in in Safari - Apple Support
End the Downloads, if None are Responding:
Print as PDF (Portable Document Format):
When you print it as PDF, items are shown as a file as it was upon use. So, you would go to File > Print... > PDF > Save as PDF > Open: Saved File.
Disable/Enable Content Blockers:
Select to Enable content blockers by going into Safari menu > Settings for this Website... > Check/Uncheck: Enable Content Blockers
That’s the best I can think of.
That's because FAF likely leverages the command line find(1) command, and that command is forbidden from accessing the directory entries for that directory by SIP.
For example, terminal won't be allowed to ls the directory because it likely doesn't have Full Disk Access enabled in Security & Privacy -> Privacy:
$ find ./com.Apple.Safari -name com.Apple.Safari.plist -print
find: ./com.Apple.Safari: Operation not permitted
It appears the version in ~Library/Preferences may have been deprecated for some time, as at least for me I got this:
$ ls -lu ~/Library/Preferences/com.Apple.Safari.plist
-rw------- 1 <username> staff 394 May 13 12:41 /Users/<username>/Library/Preferences/com.Apple.Safari.plist
For me it shows:
-rw------- 1 <username> staff 3211 Oct 14 18:23 /Users/<username>Library/Preferences/com.Apple.Safari.plist
I tried that just before this reply. I'm using an iMac 2007 at the moment.
No, still defaults to the hijacked home page.
No profiles tab and Malware has been doing scheduled scans every day for two weeks.
I didn't know how to give full drive access. I'll redo if you can tell me how to grant it. Thanks very much!
Browser hijacker