El Capitan, safari preferences

I can't see any reason why you couldn't open Safari's preferences while using Bing as your search engine.

Did you try a re-boot?

Also, try booting in Safe Mode (Hold Shift key on boot)

You may have installed one or more variants of the "InstallMac" trojan. Please take the steps below to disable it.

The criminal behind this attack tries to make the malware hard to remove by varying the names of the files it installs. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

Back up all data before continuing.

1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:

~/Library/LaunchAgents

In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return. A folder named "LaunchAgents" will open.

2. Inside the folder you just opened, there may be files with a name of any of these forms:

something.AppRemoval.plist

something.download.plist

something.ltvbit.plist

something.update.plist

Here something is usually a meaningless string, such as any of the following:

Epolife

InstallMac

Javeview

Kuklorest

Manroling

Otwexplain

These are examples, not a complete list. The string could be anything. The point is that the same string will usually appear in the name of three or four files.

Lately, the "InstallMac" attacker has been scrambling the strings "AppRemoval," "download," "ltvbit," and "update" in the names of his files. For example, you might see file names such as these, instead of the above:

something.AppVemoral.plist

something.dolnwoad.plist

something.btvlit.plist

something.uadpte.plist

You could have more than one copy of the malware, with different values of something.

Move all such items to the Trash. If there are any other files with a name that begins with something, move those to the Trash also. After you've done that, there may not be anything left in the LaunchAgents folder; in that case, you can delete the folder, but otherwise don't delete it. Other files in the folder are not necessarily malicious (though they could be, if you also installed some other kind of malware.)

Log out or restart the computer. The trojan should now be inactive.

3. This step is optional. Open the following folder as in Step 1:

~/Library/Application Support

and move to the Trash any subfolders with the name something that you found in Step 2.

Don't move the Application Support folder or anything else inside it.

4. Open the Applications folder. If there is an item named something, or "Zip Devil," or with any of the other names listed in Step 2, drag it to the Trash.

If in doubt, press the key combination option-command-4 to arrange the apps by date added. Look at the apps that have been added since you first noticed the problem. If there is one you don't recognize, drag it to the Trash.

You may get an alert that the item is locked. Confirm that you want to move it to the Trash.

Empty the Trash.

If you get an alert that the application is in use, force it to quit.

5. From the Safari menu bar, select

Safari ▹ Preferences... ▹ Extensions

Uninstall all extensions you don't know you need. If in doubt, remove all of them. None is required for normal operation. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.

If the Preference window won't open, restart the computer in safe mode. Certain caches maintained by the system will be rebuilt.

6. Reset the home page in each of your browsers, if it was changed. In Safari, first load the home page you want, then select

Safari ▹ Preferences... ▹ General

and click

Set to Current Page

Well Linc, I did all the above. Found Epolife and deleted, did same in Applications as well as libraries, deleted. Rebooted in Safemode and still same thing happening. I cannot get Preferences window or even options in Safari to work, and automatically defaults to Bing as search engine - can't change because can't open presences window. Just goes blank page on Safari.

I cannot delete these two folders and don't know if I should - Javeview and the one in purple just below it. I have the password, enter it when it asks for it, and states I don't have authority. I have full permissions to change everything on computer and yet it says I still can't do it. I feel I am losing my marbles here 😕

Okay Linc, I managed to delete them from rubbish completely. With everything else in bin.

Safe Mode started, went into Safari (preferences there, but when click on, absolutely nothing happens).

So still stuck with Bing and home page not wanted....aghhhhhh

Try Malwarebytes Anti-Malware

https://www.malwarebytes.org/antimalware/mac/

I've heard they make the problem worse Malcolm...???

belindafromsaint helena wrote:

I've heard they make the problem worse Malcolm...???

You heard incorrectly. Malwarebytes is a perfectly safe program, and it was developed by a trusted and respected contributor here. I've used it on my own computer and suffered no ill effects from doing it. There are people who don't think such programs are necessary to remove malware, and it's a valid opinion. There are two ways of taking care of it, however, there's nothing wrong with using Malwarebytes if you don't want to remove the malware manually.

First, never use any kind of "anti-virus" or "anti-malware" software on a Mac. That's how you cause problems, not how you solve them.

Please back up all data before proceeding.

Triple-click anywhere in the line below on this page to select it:

~/Library/Safari/Extensions

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.* A folder should open with an item selected. Quit the application if it's running. Move the selected item to the Desktop, leaving the window open. Relaunch the application and test. If there's no change, quit again and put the item you moved back where it was, overwriting the one that may have been created in its place. Otherwise, delete the item you moved. If possible, restore it from a backup that predates the problem.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

Hi Linc, Thank you for your kindness and clarity in this. I did what you said - it came up with folder with four

extensions as below. I restarted and still had Preferences in Safari - but when I click on it nothing happens. Bing still default and Apple home page default - and can't change because can't get into Safari -Preferences. I appreciate your clarity so much. Given disability it is hard to understand, but you make it easy. Thank you. I have left this box on desktop but could prob delete. Just wanted to show you first. Thank you Linc.

I doubt that any of those extensions is causing the problem.

Reveal the item below as before:

~/Library/Preferences/com.apple.Safari.plist

Quit Safari if it's running. Move the selected item to the Desktop, leaving the window open. Relaunch the application and test. If there's no change, quit again and put the item you moved back where it was, overwriting the one that may have been created in its place. Otherwise, delete the item you moved. If possible, restore it from a backup that predates the problem.

Well sadly I am stuffed.

Didn't work!

I have two external drives I back up too. As I've being doing family photos given health is not good for daughters, I save all photos, docs etc on one and the other external drive time machine it weekly.

Have done both religiously, until Friday night when went to save photos, docs etc then do a time machine on external drive before starting the process you described as above.

First external drive - said was full, wouldn't back up. No way was I going to risk photo losing after such hard work. Hubby not knowing Apples and unwell too became agitated, saying "use the other external drive then", so I had no choice but to back of the photos for my daughters that date back over 100 years, and hence my time machine lost. So cross with myself. Yet, I lost no photos in doing everything, but was so fearful I would lose those precious documents and wanting to fix computer I went and did the worst stupid thing. Ahhh...my fault, and partly my illness, and not thinking clearly.

Far out. Went on computer to time machine as have SSD and know it backs up but only for about five hours. Could kick myself.

So am up you know what creek without a paddle, but have silly Bing, and a bug and can't get rid of it. Grrrrr....could kick myself!

Thank you for your wonderful patience and guidance, I wasn't going to use antivirus or malware as aware haha that it can cause problems. So not into that. But....now what do I do? Help? Could cry...

Just went to Facebook and got this: We have just changed routers (i.e. today) and internet and passwords all okay. Safari looks different though and is Version 9.1(11601.5.17.1).

So tired of this.....

Didn't work!

What didn't work? You've brought up another issue, which is probably unrelated.

Sorry I went through your last process of deletion timed by you (Mar 28, 2016 4:15 PM) and found more epi whatever that one is and more jave? from memory and deleted them.

Restarted entire process of your advise from woe to go again, started in safe mode, no change.

What then happened I went into Facebook and it wouldn't accept my user name - guessing this was to do with router change hubby did earlier that day - Facebook now works fine.

I then turned off computer completely, restarted in safe mode, and still safari - preferences - (shows, but when click nothing happens) meaning still couldn't change home page or bing. Then I don't know what I did, but was on another irrelevant site completely to do with health issues on Safari and noticed a little drop down stating change browser - so quickly unchecked bing and checked google.

Now I have at least google as search engine.

It also gave me option to have last page used when closing down the computer as the one that will open first.

But I still cannot open preferences at all in Safari.

As I stated above, I went into panic mode Sat night as have all family snaps, health is terminal with biography for my daughters which I am still working on. I have two external drives (both I TB).

For clarity External Drive 1 - I have weekly time machine back ups only (did partition partly to store some docs no longer wanted on computer) months ago, and worked fine.

External Drive 2 - is where I back up photos, docs, music etc weekly on a Friday too, or more frequently if I have done a major photo biog change.

On Saturday, reading your comments, do back up first....I did initially go to External Drive 2 to back photos etc - and it said it was full and wouldn't do it. So reformatted that, and restarted, still full and wouldn't take all photos and docs.

In panic, and with hubby (unwell and Microsoft person) grumpy at me, I was more worried about my docs and back up photos so used External Drive 1 which meant that I inadvertently lost my Time Machine Back-Ups. And yes, it was a stupid stupid thing to do.

I cannot go back to Sunday week when it happened, this bug, as no time machine back ups available. I could kick myself.

So looks like I'm kind of stuck in no man's land of not having preferences, and the bug is obviously still here somewhere. Every now and again I will check through your list as above unless you update it and delete any oddities. Interesting was that last night epolite ? was still there and Jave ? even though deleted twice already. I guess if I was too check now they would still be there.

I don't like using maladware as have heard it causes more problems than worth. So don't use it. But for now will a) reformat External Drive 1 if I can. Want half fat? to use on both microsoft and apple, and the other journaled for time machine backup. Once I work out if I can do that, then I will do that and do a new time machine which will be wrong, as bug in system anyway, but best to have I guess than not.

External Drive 2 - will continue to back up photos/docs but not big enough. Trying to explain to hubby the importance of Time Machine when he is entrenched in microsoft is like talking to a brick wall. He doesn't understand it, even after what has happened. Need to buy a 2 tb or more for docs etc. Our new router can do back ups, but using both microsoft (him) and me (Apple), maybe it will have room to back up my photo biog for my girls which is extremely precious to me given my health.

I've confused you. I'm sorry. This is part of my health condition.

Thank you for all your help. I love the way you explain things so easily and have appreciated your input and help - because it has helped, but sadly still can't get to safari - preferences.

Thanks

Belinda