You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

virus?

Whenever I'm searching on Safari, instead of the search going to google it'll go to bing, yahoo, or Safe Finder. I've gone ahead and set my search engine as Google on my safari preferences but my searches will go anywhere but google.


Is Safe Finder a virus for Mac Books, and if so how do I get rid of it?!?!?1

MacBook Air 13", macOS 10.14

Posted on Jan 2, 2020 11:33 PM

Reply
Question marked as Top-ranking reply

Posted on Jan 3, 2020 3:57 AM

 1. Check for adware.


     Run the latest release of Malwarebytes for Mac to remove malware/adware, if installed on your Mac.

     For instructions:  Install Malwarebytes for Mac          Uninstall Malwarebytes for Mac

     Click the “Scan Now” button. Once done, quit Malwarebytes for Mac.

     Restart the computer and relaunch Safari holding the shift key down.

     Remove unknown profiles (1), unknown login items(@) unknown extensions(3), reset search engine (4)

     and reset Homepage (5 & 6)  listed under Additional steps.


2. Additional steps to take, if necessary.

  1. Remove unknown profiles.

      System Preferences > Profiles

      Open System Preferences, click the “Profiles” icon ( a checkmark on a gear) .

      When Profiles pane opens, select the unknown profile and click the minus button at the bottom.

  2. Remove unknown Login item.

       System Preferences > Users & Groups > Login items

       Authenticate and unlock the lock.

       Highlight the unknown login item and click the “-“ button at the bottom left to remove it.   

  3. Remove unknown extensions:  Safari > Preferences > Extensions

      https://support.apple.com/guide/safari/use-safari-extensions-sfri32508/mac

  4. Reset search engine:    https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac


      Change Home Page

  5. Reset  Homepage.   https://support.apple.com/guide/safari/set-your-homepage-ibrw1020/mac  


      Section: Home page


If Safari's home page is stuck

In some cases, after being changed by adware or malware, Safari's home page can become stuck. You will be able to edit the Homepage field in Safari's preferences, but the change will not stick. This appears to be a bug, and there is an odd workaround. Try this:

  1. In Safari, choose Preferences from the Safari menu.
  2. In the window that opens, click the General icon (if necessary)
  3. Enter your desired home page in the "Homepage" field, but DO NOT press return!
  4. At the top of the window, click any of the other icons (eg, Tabs, AutoFill, etc).
  5. You may see a prompt asking for confirmation for changing the home page. If so, confirm.
  6. Switch back to the General page and check to make sure the home page has been changed.

  Ref: https://forums.malwarebytes.com/topic/236261-how-to-remove-weknow-malware-and-others/


   7. Shutdown the computer from  menu. Start your Mac using the Power button.

2 replies
Question marked as Top-ranking reply

Jan 3, 2020 3:57 AM in response to 1879

 1. Check for adware.


     Run the latest release of Malwarebytes for Mac to remove malware/adware, if installed on your Mac.

     For instructions:  Install Malwarebytes for Mac          Uninstall Malwarebytes for Mac

     Click the “Scan Now” button. Once done, quit Malwarebytes for Mac.

     Restart the computer and relaunch Safari holding the shift key down.

     Remove unknown profiles (1), unknown login items(@) unknown extensions(3), reset search engine (4)

     and reset Homepage (5 & 6)  listed under Additional steps.


2. Additional steps to take, if necessary.

  1. Remove unknown profiles.

      System Preferences > Profiles

      Open System Preferences, click the “Profiles” icon ( a checkmark on a gear) .

      When Profiles pane opens, select the unknown profile and click the minus button at the bottom.

  2. Remove unknown Login item.

       System Preferences > Users & Groups > Login items

       Authenticate and unlock the lock.

       Highlight the unknown login item and click the “-“ button at the bottom left to remove it.   

  3. Remove unknown extensions:  Safari > Preferences > Extensions

      https://support.apple.com/guide/safari/use-safari-extensions-sfri32508/mac

  4. Reset search engine:    https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac


      Change Home Page

  5. Reset  Homepage.   https://support.apple.com/guide/safari/set-your-homepage-ibrw1020/mac  


      Section: Home page


If Safari's home page is stuck

In some cases, after being changed by adware or malware, Safari's home page can become stuck. You will be able to edit the Homepage field in Safari's preferences, but the change will not stick. This appears to be a bug, and there is an odd workaround. Try this:

  1. In Safari, choose Preferences from the Safari menu.
  2. In the window that opens, click the General icon (if necessary)
  3. Enter your desired home page in the "Homepage" field, but DO NOT press return!
  4. At the top of the window, click any of the other icons (eg, Tabs, AutoFill, etc).
  5. You may see a prompt asking for confirmation for changing the home page. If so, confirm.
  6. Switch back to the General page and check to make sure the home page has been changed.

  Ref: https://forums.malwarebytes.com/topic/236261-how-to-remove-weknow-malware-and-others/


   7. Shutdown the computer from  menu. Start your Mac using the Power button.

Jan 31, 2020 12:51 AM in response to dominic23

  • Look for unknown installers in your Download folder. These are files with extension ".dmg". Note the time of download in the "Info" dialog, as this is close to the time of infection. Delete the unknown files.
  • Check the folder "/Library/Application Support" which contains many folders. Sort by date and note and perhaps delete suspicious folders which match the date/time of infection.
  • Check the folder "/Library/LaunchDaemons" which contains many files with extension ".plist". Sort by date and note and perhaps delete suspicious folders which match the date/time of infection.
  • Check the folder "/Applications". Sort by date and note and perhaps delete suspicious applications which match the date/time of infection.


virus?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.