HT204416: Get the latest version of Safari for your Mac

Learn about Get the latest version of Safari for your Mac
dpifws

Q: I have had the Safari browser hacked and am unable to reset or reinstall the application. Can anyone assist me?or reinstall the app.

I have had the Safari browser hacked and am unable to reset or reinstall the application. Can anyone assist me?

Using a 27 inch iMac (aged) and Mavericks 10.9.5 and Safari is version 7.1.6

Posted on Jun 24, 2015 8:18 AM

Close

Q: I have had the Safari browser hacked and am unable to reset or reinstall the application. Can anyone assist me?or reinstall the ap ... more

  • All replies
  • Helpful answers

  • by Kurt Lang,Helpful

    Kurt Lang Kurt Lang Jun 24, 2015 9:06 AM in response to dpifws
    Level 8 (38,019 points)
    Mac OS X
    Jun 24, 2015 9:06 AM in response to dpifws

    Explain what's happening rather than just saying Safari has been "hacked".

  • by dpifws ,

    dpifws dpifws Jun 25, 2015 7:50 AM in response to dpifws
    Level 1 (0 points)
    Jun 25, 2015 7:50 AM in response to dpifws

    Okay, here is what happens. I open a new tab to access a bookmarked site, and a window opens over my browser window saying that malware has been detected and that I should call some number to get assistance. However, I cannot close that window and so far, the only solution to getting control back is to force quit the Safari program. I believe that the window is from some one trying to get money. Any assistance would be appreciated.

  • by stevejobsfan0123,Apple recommended

    stevejobsfan0123 stevejobsfan0123 Jun 25, 2015 7:51 AM in response to dpifws
    Level 8 (44,007 points)
    iPhone
    Jun 25, 2015 7:51 AM in response to dpifws

    See A Browser Pop-up has Taken Over Safari.

     

    (Note that I am affiliated with that site, and some pages contain ads).

  • by Kurt Lang,Helpful

    Kurt Lang Kurt Lang Jun 25, 2015 8:02 AM in response to dpifws
    Level 8 (38,019 points)
    Mac OS X
    Jun 25, 2015 8:02 AM in response to dpifws

    stevejobsfan0123's note is one reason for such popups appearing in Safari. If that is the case, you haven't been hacked by anyone or anything.

     

    To fully explain how these popups work on the Mac (and Windows):

     

    1) You hit a bad web site and the scary sounding popup appears.

     

    2) You click OK or whatever button is there to try and dismiss it. The popup seems to be unresponsive, or comes back after a very brief time off the screen.

     

    3) This happens because of a JavaScript action they're using. JavaScript (no relation at all to Java) is used extensively on the web. Much of what we take for granted wouldn't work if you turned it off in a web browser's preferences. Like the buttons across the top of this page. Anything on a page that changes when you move your mouse over or across it is JavaScript in action. In this case, the mouseover command.

     

    4) What these scammers use is another JavaScript action to "do on exit". In the case of these popups, you really are closing it when you click the button, but the final HTML command of the popup is a JavaScript "do on exit". And the "what to do" is to display the same popup.

     

    5) Safari, and pretty much all web browsers force you to attend to the button on a popup before it will let you do anything else. Which is why you can't get to the preferences or other tabs. So there you are, stuck in a loop of closing the popup, only to have it immediately display again. The crooks are using a simple built-in function of all web browsers to make your web browser appear to be stuck. No malware of any kind is necessary to accomplish this. Just a browser with JavaScript enabled. And it pretty much has to be on in order to use virtually any web site.

     

    The general fix is to Force Quit Safari, then hold down the Shift key and relaunch it. Holding the Shift key tells Safari not to load any of the web sites from the previous session.

     

    If that alone doesn't do it, the other possibility is that you installed adware along with something else. Most adware is simply annoying. They display tons of ads whenever you're using your browser. Recently though, some nastier adware has also been causing similar threat popups to appear. They are again harmless on their own, but won't go away until you remove the adware that's causing them to appear.

     

    You can either follow Apple's manual instructions for removing adware, or use the free automated tool, AdwareMedic.

     

    It should be noted that Apple's manual removal instructions are typically outdated. Sometimes a lot outdated. It depends on when Apple last updated their instructions page. If you would prefer to manually remove the adware on your system, you can find much more up-to-date instructions on The Safe Mac's adware removal page.

  • by Limnos,

    Limnos Limnos Jun 25, 2015 8:39 AM in response to Kurt Lang
    Level 9 (54,628 points)
    Mac OS X
    Jun 25, 2015 8:39 AM in response to Kurt Lang

    I almost never use Safari. I do use TenFourFox which is a port of Firefox for my old (13 years!) computer. I have popups blocked in preferences but it doesn't stop all of them.  I run AdblockPlus extension.  That said, I can't recall ever having encountered a persistent popup. Oh, I do occasionally get blank windows popping up which I presume are something I don't want to see, but I can close them.  I don't know what extensions are available for Safari but you might want to use a different browser with different (more?) security features even if they are third party extensions. I used to run NoScript which filters Javascript but it turned out to be such a nuisance having to constantly disable it on sites to get them to work (as Kurt Lang mentions).  You would have to sort through all the scripts and it wasn't clear which ones were essential and which ones were simply feeding things I don't use such as Twitter and Facebook.

  • by dpifws ,

    dpifws dpifws Jun 25, 2015 10:59 AM in response to Kurt Lang
    Level 1 (0 points)
    Jun 25, 2015 10:59 AM in response to Kurt Lang

    I have run the Adware Medic and deleted the suspicious files that it found. However, it has not solved the Safari problem. I have attempted to work through the manual system but have managed to just confuse myself. I cannot find any info on Safari in the library (I think I have identified the library as the one under the top directory (the hard drive) since there is no library under the user any longer. I don't know if you can help me any further or not or have the time, but I really appreciate the assistance you have given so far.

  • by Kurt Lang,

    Kurt Lang Kurt Lang Jun 25, 2015 11:21 AM in response to dpifws
    Level 8 (38,019 points)
    Mac OS X
    Jun 25, 2015 11:21 AM in response to dpifws

    Adware Medic finds a lot of stuff, but the miscreants who write this junk change the names and locations of the files they install. Then Thomas Reed (the author of Adware Medic) has to find samples of the new variants and add them to the app.

     

    Here's another one to try. Open Safari's preferences and click on the Extensions heading. Click on all extensions one at a time and uncheck the box "Enable xxx" (the x's being the name of the extension) for each one so they are all disabled. Close the preferences and use the browser as normal. If the ads are now gone, then one of the extensions you disabled is causing them. Turn them on one at a time and test. When the problem returns, you found the culprit. Disable it again and click the Uninstall button. Check all of them as there may be more than one causing the problem.

  • by thomas_r.,Apple recommended

    thomas_r. thomas_r. Jun 25, 2015 11:44 AM in response to dpifws
    Level 7 (30,944 points)
    Mac OS X
    Jun 25, 2015 11:44 AM in response to dpifws

    AdwareMedic's function is not to deal with these scam pop-ups. It may help if you have adware installed that is causing the pop-ups to appear repeatedly, but it does not help to dismiss the pop-ups, and it doesn't help with pop-ups appearing repeatedly because you keep visiting a hacked or malicious website.

     

    For more information on how to get rid of these pop-ups, see:

     

    Tech support scam pop-ups

     

    (Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com.)

  • by dpifws ,

    dpifws dpifws Jun 25, 2015 12:24 PM in response to Kurt Lang
    Level 1 (0 points)
    Jun 25, 2015 12:24 PM in response to Kurt Lang

    Thanks Kurt. I finally solved it by renaming the Safari folder and rebuilding it with the contents of the old folder, one at a tme and restart. Seemed to work okay for me.

  • by db24401,

    db24401 db24401 Jun 25, 2015 12:47 PM in response to dpifws
    Level 3 (884 points)
    Desktops
    Jun 25, 2015 12:47 PM in response to dpifws

    here is how to access the User/Library folder --

     

    https://support.apple.com/kb/PH18928?locale=en_US&viewlocale=en_US

  • by Kurt Lang,

    Kurt Lang Kurt Lang Jun 25, 2015 5:51 PM in response to dpifws
    Level 8 (38,019 points)
    Mac OS X
    Jun 25, 2015 5:51 PM in response to dpifws

    That's a different approach. But hey! Whatever works.