safari closes by itself overnight

Safari > Preferences > Extensions

Turn those off and relaunch Safari.

Turn those on one by one and test.

You may have installed the "Genieo" or "InstallMac" ad-injection malware. Follow the instructions on this Apple Support page to remove it.

Back up all data before proceeding.

Malware is always changing to get around the defenses against it. In addition to the files listed in the support article, you may also have to remove the following in the same way:

~/Library/LaunchAgents/com.Installer.completer.download.plist

~/Library/LaunchAgents/com.Installer.completer.ltvbit.plist

~/Library/LaunchAgents/com.Installer.completer.update.plist

~/Library/Application Support/IM.Installer/Completer.app

One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.

After removing the malware, remember to reset your home page in all the web browsers affected, if it was changed.

If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, then you may have one of the other kinds of adware covered by the support article. Follow the rest of the instructions in the article.

If you find Apple's instructions too hard to follow, ask for an alternative that doesn't require you to trust a black-box application without knowing what it does.

Make sure you don't repeat the mistake that led you to install the malware. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad would probably have included a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If you ever download a file that isn't obviously what you expected, delete it immediately.

In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

Still in System Preferences, open the App Store or Software Update pane and check the box marked

Install system data files and security updates (OS X 10.10 or later)

or

Download updates automatically (OS X 10.9 or earlier)

if it's not already checked.

I'm sure this is what is happening to my MBP. I downloaded and installed some things I probably shouldn't have. My Safari search info was all changed. I was able to manually change it back to the way it was but now I have the issue described here with Safari closing during the night. I looked for all of the listed ad malware on the Apple Support page link, but found none. Also, my cc info was stolen during this time. not sure if that is related or coincidence.

Any other suggestions?

Have you tried what is posted above?

Yes. None of the listed ad malware is on my computer. I'm wondering if I have something new and not listed...although the page that Linc posted a link to says that is was updated this month, so...

You can download this program which was written by Thomas Reed, a long time poster. The program will do the work for you which makes it easy.

Malwarebytes Anti-Malware for Mac 10.7 and later

chrisp69 wrote:

although the page that Linc posted a link to says that is was updated this month, so...

That page was horribly outdated and incomplete even at the time it was last updated.

No "anti-malware" or "anti-virus" product should ever be used on a Mac, for any reason. If the steps suggested in this thread didn't solve your problem, then it's not the same problem the original poster had, and you should start your own thread to address it, or else contact Apple Support.

Thanks Linc. I'm not as concerned with the safari closing as much as the coincidence of my cc info being comprised. Do you think it's possible that the software I downloaded and installed on my Mac contained some kind of spyware capable of doing this?

chrisp69 wrote:

Do you think it's possible that the software I downloaded and installed on my Mac contained some kind of spyware capable of doing this?

The most likely scenario is that this was purely coincidence, but anything is possible. There's currently no malware in wide distribution that behaves this way, but it's always possible you ran into something brand new. What did you download, and from where?

There is so little chance that your computer is infected with password-stealing malware that trying to check for it would be a waste of time. If you want to check anyway, you need the services of a consultant in forensic computing. Running any kind of commercial "anti-malware" software is worse than doing nothing. All such software is useless.

In almost every case, this kind of incident has one of the following causes:

1. An account number was stolen by someone to whom you knowingly disclosed it.
2. The service provider had an internal security breach that it either doesn't know about or is trying to blame on its customers.
3. You set a weak account password that someone was able to guess, or you chose weak security questions, or you used the same password for more than one account.
4. You fell for a phishing scam and the password was stolen.

Change the password to a random string of at least 10 characters, and never use that password for anything else. Any password that you can remember is too weak. If there are security questions on the account, the answers should also be random strings, and you have to make sure you don't lose them.