I made a mistake and hijacked Safari. The option to change my landing page, where this appears, is greyed out. I was hoping the new OS would somehow clear out this bug but it didn't. None of the fixes suggested online sorted me out. So I can't use Safary anymore.
[Link Edited by Moderator]
iMac Line (2012 and Later)
Yes! The really annoying part is we know the issue is in the main user account. So why is it so difficult to find?
That's the $64,000 question! I don't think I've ever seen this many top ASC helpers unable to solve an issue.
Sorry, I
didn't realise I had to tick boxes in the app itself as well. Here is a full report.
Just to add that com.apple.Safari.plist was not with the others. I found it through a search. Sorry, I'm a bit flustered after all this and can't recall in which folder it turned up.
Whew, that's terrific news!!! You really had us going!
Nice work, Marek!
Kurt, I am travelling with MBP + Mojave:
there is no such thing as com.apple.Safari.plist on my mac to find with FindAnyFile2. Is this in Catalina normally there?
The Safari plist is usually:
/Users/<login name>/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.Apple.Safari.plist
Indeed, there I found it, thanks. Funny though it has the date and time of the moment that I find it.....
FAF did not find it, hmmmm
Lex
Yes, now I see: faf2 (64bit) did find this plist (about 4) in different places.
Thanks.
very helpful, thanks.
Lex
Go to Safari menu > Preferences > Extensions and check there. If there is an extension you do not recognize delete it.
If that doesn't help, download and run Malwarebytes. Malwarebytes was developed by one of our own colleagues here in ASC and is about the most proven anti-malware software for Mac. All you need is the free version. After that restart.
Thanks, but I actually started with Malware – first running through their suggested steps and then installing the app, which didn't find anything. I had no extensions installed in Safari. I'm happy with using Opera but my family is used to Safari and demanding I restore "their" browser... By the way, it also infected Firefox, but I managed to delete it there successfully.
No, the new account is just for test. Let's get it right in yours. What it means is that there is nothing wrong with the application itself but rather in the supporting folders in your user. I'll be ****** if I know where or I'd tell you. But I can give you a new default Safari. You'll lose any information you previously had in Safari Bookmarks & Passwords but you should be able to get those from the old folder if needed.
Log back into your own user.
From your Finder "Go" menu > "Go to folder" then copy & paste this file path:
~/Library/Safari
Click Go.
Drag the entire folder to your Desktop.
Restart Safari.
gog.galaxy refers to a gaming platform. Everything else is the report is pretty typical. But it would be interesting to see if GOG is the culprit by removing its launch agents and daemons.
The GOG agents are in your user account. The only one that isn't is a launch agent in the main Library folder, but points to an executable in your user account.
EtreCheck does have it white listed as a recognized item, but that doesn't mean it isn't the source of the hijack.
I was surprised you didn't find a Profile entry in the System Preferences. That's usually the case when Safari's preferences are grayed out.
There are other items related to Safari in the user account. Such as this folder:
/Users/user-name/Library/Containers/com.apple.Safari
That folder of items might be where the problem is.
Restart in Safe Mode (restart and hold down the Shift key). Put these items in the trash:
/Library/LaunchAgents/com.gog.galaxy.commservice.plist (this is the root Library folder)
The following are all in your user account:
/Users/user-name/Library/Containers/com.apple.Safari (a folder)
/Users/user-name/Library/Preferences/com.apple.Safari.plist
/Users/user-name/Library/LaunchAgents/com.gog.galaxy.commservice.plist
/Users/user-name/Library/LaunchDaemons/com.gog.galaxy.ClientService.plist
Restart the Mac and let it boot normally. Test Safari.
That, and it's never a good idea to have TeamViewer, or any remote access software always running. Unless you have a real reason for it to exist, remove TeamViewer.
Browser hijacker
