Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Safari in Lion hijacked by malware

I hope someone can help...


I have the new Lion operating system and was in Safari this morning trying to find a game for my son to play. I clicked on a site and I got a pop up window from www.theconsumerwinner.com telling me to answer a survey...only option was to click ok. I did not...I force quit Safari instead. When I restarted Safari the website and popup comes back and has basically hijacked my safari. I cannot get into any of Safari's menu options...even help.


I went into the Safari folder and deleted the history from today, but it's still there. How can I get rid of this? I love my Safari...luckily I have Firefox installed for a work program, so I'm using it for now. I want my Safari back though...


Please help.


Thank you!

MacBook Pro

Posted on Jul 27, 2011 9:30 AM

Reply
32 replies

Aug 6, 2011 10:44 AM in response to jvonrock

If you are using the new flash player, it has it's own security preference pane in your system preferences. If you are using the old FP, you have to go the adobe flash player support page to "view" the control panel that lets you do that while viewing the page on Adobe's site. The new FP, however, does this much better because you have control of it on your computer.

Aug 6, 2011 10:24 PM in response to powerbook1701

Gosh you folks are real blessing to us that panic with the unknown. trying get through 'theconsumerwinner' doorman and then finding that if I shift> click open safari.. all is well. sigh. And now my "fear of adobe gremlins" easing.


I'm so glad I found this discussion board. My wonder now is I did manage to get macprotecter into my download list but never went farther, I downloaded apples secupd. 2011- 2013 to rid it. it says "Alert this is for 10.6, I'm already lion 10.7., I don't know where to look, I did the spotlght check and theres only some pages about avoiding it n searches I made. So Am I rid of that one too. I know Im not a total loss and learning to browse these boards My Applin days are looking bright.

Aug 8, 2011 4:15 PM in response to jvonrock

Gosh you folks are real blessing to us that panic with the unknown. trying get through 'theconsumerwinner' doorman and then finding that if I shift> click open safari.. all is well... -jvonrock

So, do you still have to Shift-Launch Safari, or did one shot fix it? What is accomplished by holding the Shift key, something like safe-mode? Do any other applications use it?


I had EXACTLY the same issue with the same site (looking up video to Tighten Up- never thought THAT could end so badly!). Before trying the Shift solution, I realized that somewhere along the line I had remedied the problem. Wish I knew exactly where; I have a list of the files I was deleting, though I think the guy may be using com.apple.Safari.WebpagePreviewFetcher.sb to cause us these headaches. Anyway, that was the logic I was following.


Obviously, someone smarter than I will have to sleuth down to the proper eradication procedure. I'll post a list of the files I was deleting when the 'fix' occurred, in case someone affected would like to try & narrow it down. But for now, I have an afternoon's work to make up...

Aug 8, 2011 11:00 PM in response to gingertodd

gingertodd, the shift fix was what I Love about this thing, MAC. and the shared frustration..kinda edgey,, well the shift seems to work.? Xcept my track an mouse now an then danced to a different tune and safari seemed dazed a little at times. So I did the spotlight check ( another clue given by you roughnecks) and bingo other than copies from this board was a neat little page with a winky, yes winky blinky red outlined " pop up with the "you lucky" ( lollipop ) you know. I couldn't believe it was still ALIVE !! so I was icautious an carefully dumped it and quickly emptied the trash. fingers should be uncrossed by tomorrow. now I have to make sure macprotecter gets the same full treatment. To OZ.....

Aug 8, 2011 11:44 PM in response to L'hooq

L'hooq, Yeah ! that "theconsumerwinner" thing was a jab. I clicked a music video from google news an bam ! I've had things freeze up, stumbled into the dark side and been grabbed but this didn't let go period. During the many attempts at force quit, restart an shut down, it kept its bite. once a page behind the pop up had testimonials about how 3 weeks later 500.00 bucks showed up in their visa account" now how did they get there # to that ??? I ended up going from mini to pro. an my journey ended here.. Whew.. hey I wouldn't save souvenirs from that trip. like I told gingertodd, I found a piece alive an ticking. an trashed it. I'm told spotlight has everything waiting for me to look at. I'm not the savvy time machine guy, just too many exHD's. man can you imagine spilling that in the house ? I don't know what it was, I think they figured out how to get to the door, put their foot in it an scream. the shift let safari in the back door, like a delete we got a new door. keep applin

Aug 9, 2011 12:41 AM in response to TildeBee

THANK YOU Bee of Delaware ! hey what's this ? he interrupts, Lion has a whole knew set of ' characters " from the edit pull down, you know ? I went to leave you a symbol, icon thing ? but here's a yeah it doesn't look like a monkey, an you already know about the new characters eh ? Is there ? do You think there's a " Here's how you do/use em - 250 new things in lion " New, I was just ahead of tiger, leopard was great, snow leopard ooo this whole apple spoil ya wow ya thing is taking off. "waiting for the lion" still is a better song but I don't know all the lyrics to this one yet. I'm going to like learning around here, my first lessons, rein in the keyboard ! keep it short, sweet, sorrowful or helpful. and et doesn'tt correct my lazy typing or spelling.


again I tip my hat

Sep 3, 2011 1:24 PM in response to Badunit

Thanks, Badunit. Simple and completely effective solution. I had gone to a lyrics site and ended up with a "customersurveypanels.com" popup that seemed to completely hijack Safari. Deleted all the files and directories in ~./Library/, but it kept coming back and I kept having to Force Quit.


Thanks to others for the explanation of Flash cookies.

Sep 8, 2011 12:15 PM in response to gingertodd

I am not sure if this is relevant but I had a similar problem after installing Lion. The Lion feature that restarts programs in their last state seems to be the problem so I turned that feature off and rebooted and I was fine. I sometimes have to do that too with my iPad. I have not had a problem since.


Also, does the shift click thing get around that feature? I kinda like it for everything except Safari.

Mar 13, 2012 7:38 AM in response to gingertodd

I have started a new thread March 2012 with a similar issue trying to summarize all that is in here, as your solution of just hitting the shift key with the Safari button may have some other hidden issues not addressed. Someone reading this might just read the solution and not realize a Trojan is still sitting there on their Mac (as is discussed in the plethora of information throughout this thread).

Be aware that I summarized the info that is sitting here, but am looking for direction on the order in which to go, and to verify my understanding of the vast amount of knowledge provided here. So, if you are one that has posted on here, please view my posting and make sure I interpretted the info correctly and provide direction on what to do the second my latop powers up. At the end of my posting, I was wondering if there is a Time Capsule option here that could drop out some of the steps listed? Would it be a better option or a decent option that isn't thorough?



https://discussions.apple.com/thread/3803878

Safari in Lion hijacked by malware

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.