Level 1

9 points

Browser hijacker

I made a mistake and hijacked Safari. The option to change my landing page, where this appears, is greyed out. I was hoping the new OS would somehow clear out this bug but it didn't. None of the fixes suggested online sorted me out. So I can't use Safary anymore.

[Link Edited by Moderator]

iMac Line (2012 and Later)

Posted on Oct 9, 2019 8:20 AM

Similar questions

A dangerous webpage is taking over my Safari browser This just takes over Safari with this....Then when I try to back out of it it cycles through these pages... After some research, I have discovered it is called a browser hijacker. However, there seems to be no answer for how to remove it. I just suddenly started happening. I don't download apps unless they are from the Apple App Store. However, I have not downloaded any apps. When this appears the URL address changes to *** Except it's .xyz I put in the underscore so as not to create a link. When I copy from the URL the following appears.... (I replaced the "tt" with "xx" and created a space after the slashes also to prevent creating a hot link) I would appreciate anyone who can tell me how to get rid of this thing. [Edited by Moderator]
7313 1
Safari Hijack I have been looking all through the communities page for help and most of the methods I try do don't work. I have installed Malwarebytes and cleared out the malware it detected but there is still malware on my computer hijacking my Safari which redirects to Bing. I have tried mostly everything, there are no extensions on safari, I had cleared the cache multiple times, and I still don't know what app or thing I downloaded is causing this. I'm also wondering if the hijack only controls my safari and can't access anything else on my macbook.
1668 4
Safari Hijacked Hello- My Safari and other internet browsers (Chrome...) were hijacked recently. I am assuming that this is due to visiting a crap site that attached a cookie to my computer, but anyways. Currently when I open safari, rather than it going directly to google.com or my bookmarks page, it opens to this "search marquis" search engine. I know from previous experience that this is a bogus page and that I shouldn't use it- so I typically just click on the URL area and type in google.com.... But, this is becoming increasingly annoying. I have already done everything I can think of to manage (REMOVE THIS THING) this, but no luck. I have cleaned out my cookies, changed the safari preferences ( even though it was still showing google), tried the Go> Go to folder> Library, and I even tried the basic 'restart your computer' stuff. Other than taking my computer into an Apple store and paying a load of money to have them look at it, does anyone have any other ideas on how to get rid of this stupid Hijacking????
1307 2

69 replies

TheLittles

Level 10

207,173 points

Oct 10, 2019 8:56 PM in response to pvdlugt

pvdlugt Said:

”I made a mistake and hijacked Safari.”

———-

Reinstall MacOS to Get a Fixed Safari:

One thing I can think of is reinstalling the macOS. That might do the trick. Any corrupt files and folders would be fixed to their best to how that should be. Nothing would be deleted; all corrupted items would be fixed.

IMPORTANT: Back up your Mac with Time Machine prior to reinstalling the macOS, so you can restore to something, should anything go wrong.

MrHoffman

Level 10

156,923 points

Oct 11, 2019 9:52 AM in response to pvdlugt

pvdlugt wrote:

Nothing to report except Terminal had this message when it launched:

The default interactive shell is now zsh.

To update your account to use zsh, please run `chsh -s /bin/zsh`.

Is it relevant?

That’s a Catalina message specific to a shell change from bash to zsh. For the discussion here, that does not matter.

So to confirm, no profiles were shown, and the reset-permissions finished without error, and you’ve enabled full drive access and seen no profiles, and you’ve resolved the run-time corruptions and missing-files errors with MalwareBytes and the other apps, and you’ve removed Flash?

TheLittles

Level 10

207,173 points

Oct 12, 2019 7:36 PM in response to pvdlugt

pvdlugt Said:

”The moment I clicked send, Mail closed.”

———-

Check Your Login Items:

Go into: System Preferences
Click: Users & Groups
Select: [your user name]
Click: “Login Items” tab located towards the top-middle of the window.

Is there a login item enlisted in there is that looks suspicious?

I am wondering if something is opening at login: something that is causing this to occur.

MrHoffman

Level 10

156,923 points

Oct 13, 2019 3:04 PM in response to pvdlugt

Your disk appears to be failing, per EtreCheck.

Get a current backup, and then run Apple Diagnostics and see what that reports.

If this Mac is under AppleCare, check with Apple Support.

If not under AppleCare (and if Apple Diagnostics report an error) I’d replace this hard disk with an SSD.

Particularly if you plan to keep this Mac for a few more years.

Kurt Lang

Level 9

71,353 points

Oct 14, 2019 6:49 AM in response to Marek Stepanek

Very nice work indeed, Marek.

I think everyone passed on those because they are all legitimate .plist files. Now that we know the source, though, it's obvious this junk modified a standard preference file to hide itself. These just aren't the files you would first suspect.

Kurt Lang

Level 9

71,353 points

Oct 14, 2019 10:22 AM in response to Lexiepex

Following William's lead, I did a little more digging.

In Mojave, these items are in the standard user account Preferences folder at /Users/<login name>/Library/Preferences/.

com.apple.Safari.plist

com.apple.Safari.SafeBrowsing.plist

com.apple.Safari.SandboxBroker.plist

com.apple.SafariBookmarksSyncAgent.plist

com.apple.SafariCloudHistoryPushAgent.plist

The same ones Marek noted. However, I found the same named com.apple.Safari.plist file in the location William showed. That one has today's date. The one in the standard Preferences folder was last updated June 27th.

Does that mean the .plist in the old location is now orphaned and no longer used? Or does the OS look at both? The former would seem more likely.

It would also be interesting to know what version of Safari the OP is using. That is, did the new .plist location begin with Safari 13.0, and removing it from the old location worked because the OP is still running 12.xx ?

macjack

Level 10

111,302 points

Oct 9, 2019 11:47 AM in response to pvdlugt

Create fresh user account and see if Safari works as expected there.

Set up users, guests, and groups on Mac - Apple Support

BDAqua

Level 10

251,329 points

Oct 12, 2019 1:39 PM in response to pvdlugt

DElete this file & restart...

/Library/LaunchDaemons/com.apple.installer.osmessagetracing.plist

pvdlugt Author

Level 1

9 points

Oct 13, 2019 10:51 PM in response to MrHoffman

Morning. Fortunately Diagnostics says no issues (ADP 000), because I've discovered my extended warranty ended yesterday! Perhaps I should try Macjack's suggestion of moving over to a new user.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Browser hijacker