Safari and Google Chrome Hacked- Pop ups and new tabs

This can happen if adware is installed without your knowledge.

1. Use free AdwareMedic to remove adware

http://www.adwaremedic.com/index.php

Install , open, and run it by clicking “Scan for Adware” button to remove adware.

Once done, quit AdwareMedic.

or

Remove the adware manually by following the “HowTo” from Apple.

http://support.apple.com/en-us/HT203987

2. Safari > Preferences > Extensions

Turn those off and relaunch Safari.

Turn those on one by one and test.

I know this is an old thread, but I had the same problem and wanted to share my solution. I'm not sure it will work in 100% of cases, but it did for me....

The Cause : I found out that one or more "osascript" processes were running from my user account, telling Safari to open popups by injecting JavaScript into a new tab. (Thanks osascript!).

The Solution : I found the parent process, which was an App called /Library/brightwork, which I don't recall installing. I simply moved it to the Trash, restarted the computer, and the processes were no longer there, i.e. no more popups!

I believe the same thing has also targeted Chrome and Firefox.

Apart from "brightwork", there were a couple of other strangely named Applications in /Library, which I also removed, with no apparent ill-effects...

Is she using an admin account to install?

User File Ownership - Reset see post by Linc Davis

You may need to rebuild permissions on your user account. To do this,boot to your Recovery partition (holding down the Command and R keys while booting) and open Terminal from the Utilities menu. In Terminal, type: ‘resetpassword’ (without the ’s), hit return, and select the admin user. You are not going to reset your password. Click on the icon for your Macs hard drive at the top. From the drop down below it select the user account which is having issues. At the bottom of the window, you'll see an area labeled Restore Home Directory Permissions and ACLs. Click the reset button there. The process takes a few minutes. When complete, restart.

Repair User Permissions

My daughter has a MBA with a similar problem, but with Chrome. Safari is fine. I tried to do some remote help, download TeamViewer, so that I can remote into her machine, but she says that the .dmg file won't open. Seems that she can't install any software at all. The virus may have messed up her permissions settings. Anyone have any ideas?