Safari Browser hijacked by search.yahoo.com SafeFinder

  Note: Malwarebytes for Mac will remove malware installed on your Mac.

           But these malware being very invasive, will change user settings.

           A user has to reset those settings.

Go step by step and test.

   1. Remove unknown profiles if present.

      System Preferences > Profiles

      Open System Preferences,  select “General and click  the “Profiles” icon ( a checkmark on a gear) .

      When Profiles pane opens, select the unknown profile and click the minus button at the bottom.

      Section: Remove a configuration profile from your Mac

      Profiles: https://support.apple.com/guide/mac-help/configuration-profiles-standardize-settings-mh35561/mac

  2. Remove unknown extensions:  Safari > Preferences > Extensions

      https://support.apple.com/guide/safari/use-safari-extensions-sfri32508/mac

   3. Check for adware.

       Run the latest release of Malwarebytes for Mac to remove malware/adware, if installed on your Mac.

       For instructions: Install Malwarebytes for Mac v4      Uninstall Malwarebytes for Mac

       Click the “Scan Now” button. Once done, quit Malwarebytes for Mac.

       Restart the computer and relaunch Safari holding the shift key down.

       Scan for Malware again.

       Additional steps  if necessary.

  4. Reset search engine:    https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac

  5. Reset  Homepage.   https://support.apple.com/guide/safari/set-your-homepage-ibrw1020/mac

6 Remove unknown Login items;

https://support.apple.com/guide/mac-help/open-items-automatically-when-you-log-in-mh15189/mac

7. Restart your Mac. Relaunch Safari holding the Shift key down. 

If Safari's home page is stuck

In some cases, after being changed by adware or malware, Safari's home page can become stuck. You will be able to edit the Homepage field in Safari's preferences, but the change will not stick. This appears to be a bug, and there is an odd workaround. Try this:

1. In Safari, choose Preferences from the Safari menu.

2. In the window that opens, click the General icon (if necessary)

3. Enter your desired home page in the "Homepage" field, but DO NOT press return!

4. At the top of the window, click any of the other icons (eg, Tabs, AutoFill, etc).

5. You may see a prompt asking for confirmation for changing the home page. If so, confirm.

6. Switch back to the General page and check to make sure the home page has been changed.

Credit: thomas_r

https://forums.malwarebytes.com/topic/236261-how-to-remove-weknow-malware-and-others/

Hi there,

I posted the same question as you around 3 weeks ago. I can't find my own question now – I'd wanted to post how I resolved it, but your question came up and so I guess my answer will help you perhaps.

The Malwarebytes people instantly wrote to me but I thought it a bit worrying; not sure I'd trust them. Then I mentioned them to someone who works in computers and he said he does trust them, and that runs the free version occasionally himself. Anyway, I did run the free version myself – very easy to do for me on my desktop – and it sorted the problem instantly. I can now use google again. I'm not sure what'll happen in a few days when my 14 day free period with Malwarebytes comes to a close but I took a screen grab of the offending software list, and where it resides, so if it does come out of quarantine in the future I now know what I have to throw away. There were about a dozen items with me.

Hope that helps. DG, Twickenham. London.