Safari randomly opening new windows

1. Click  in the menu bar and choose “Force Quit”.

In the window that opens up, select “Safari” and click “Force Quit.

2. Relaunch Safari holding the shift key down.

3. Turn off wifi and turn it back on.

Turn off Wifi. Click Wifi icon in the menu bar and select “Turn Wifi off”.

Visit another website.

You won’t have internet connection.

Turn on Wifi. Click Wifi icon in the menu bar and select “Turn Wifi on”.

Select your Network.

4. Delete Cookies

Safari > Preferences > Privacy > Cookies and other website data:

Click the “Details” button.

Remove all cookies except ones from Apple, your internet service provider and banks.

Additional steps to take:

https://support.malwarebytes.org/customer/portal/articles/2045704-what-should-i- do-if-malwarebytes-anti-malware-for-mac-didn-t-solve-my-problem-?b_id=9511

https://support.malwarebytes.org/customer/portal/articles/2049286-?b_id=9511

From your Safari menu bar click Safari > Preferences then select the Privacy tab then click: Remove All Website Data then click Remove Now then click Remove All Website Data and Remove Now one more time then quit and relaunch Safari to test.

If that doesn't help, if installed, disable anti virus software then see if the problem persists.

If nothing above helped, please copy and paste the results of the EtreCheck report in your Reply. No personal data is shared from the report.

Safari – Popup takes over

Safari – Popup takes over (2)

Popup remover – Scam Zapper

While it may not catch all malware, you can try running the below program to check for malware/adware. Based on what you have described, it is doubtful that your passwords and other information are being accesses. Etrecheck's report contains no information that can be used to access your computer.

Download this program which was written by Thomas Reed, a long time poster. The program will do the work for you which makes it easy.

Malwarebytes Anti-Malware for Mac 10.8 and later

What should I do if Malwarebytes Anti-Malware for Mac didn't solve my problem?

I was having the same issue as to OP. Thanks for the info on Malwarebytes. I installed it and it took care of the problem. Things are back to normal now.

The only hitch was that, for whatever reason, Malwarebytes determined that the MacKeeper application and supporting files was malware. I had to rescue them from the trash and move them back into the applications folder.

GrumpyOldPoop wrote:

The only hitch was that, for whatever reason, Malwarebytes determined that the MacKeeper application and supporting files was malware. I had to rescue them from the trash and move them back into the applications folder.

MacKeeper is a scam app that is often installed via fake virus alerts, which inform you that your Mac is infected with a "virus" and that prompt you to download MacKeeper to get rid of it. For example:

It's also commonly found in fake Flash Player or Safari installers, which install malware and PUPs (potentially unwanted programs) like MacKeeper.

Further, it was recently the subject of a class-action lawsuit alleging fraud, which was settled in favor of the plaintiffs:

https://yenchasoftwaresettlement.com/

Unfortunately, it's too late for you to get a refund through that settlement.

If Malwarebytes Anti-Malware for Mac didn't solve the problem for you, choose Contact Support from the Help menu within the Malwarebytes Anti-Malware app. That will help you send an e-mail to our tech support folks with information about your system that can help us determine what's going on.

Thomas Reed

Director of Mac Offerings, Malwarebytes

GrumpyOldPoop wrote:

I was having the same issue as to OP. Thanks for the info on Malwarebytes. I installed it and it took care of the problem. Things are back to normal now.

The only hitch was that, for whatever reason, Malwarebytes determined that the MacKeeper application and supporting files was malware. I had to rescue them from the trash and move them back into the applications folder.

That was a bad idea. MacKeeper is fraudulent scamware.

Sometimes when a user opens safari it is redirected to weird sites . This happens if DNS caches are poisoned . To find the address to a site , your system asks another system ( a so called domain name server or DNS ) which stores this information .if this DNS gives your computer the wrong address to some sites it is known as DNS poisoning .

The code for DNS cache poisoning is often found in URLS sent via spam mails . these emails attempt to frighten users into clicking on the supplied URL which in turn infects the system .banners ads & images both in emails & untrustworthy websites can also direct users to this code .

Once poisoned , a user's system will take to the fake websites that are spoofed to look like the real thing exposing them to risks such as spyware , key loggers or worms .

To prevent DNS poisoning user should never click on links they don't recognize & regularly scan their system for malware since poisoning could spoof web - based results .

But according to the issue posted , the user is redirected to unwanted sites & different unwanted malicious pages are displayed .

So some steps are as under please follow them .

Click on finder >go > computer > macintosh HD > library > remove the entire contents off folders caches & cookies .

Click on finder > go > computer > keep on holding option key on keyboard > library > remove entire contents of folders caches , cookies , saved application state .

1. close all applications using key board short cut : command + tab + Q .

2. type a command cat /etc/hosts in terminal ( there is space after cat & all words are small ) click on enter . restart the system from apple logo .

Once again open safari & check if new browser windows are opening , unwanted pop ups are there .

To avoid this apple has formed an article the user can follow it : https ://support.apple.com/en-us/ht202516

Also please do a factory settings once again home router and in airport express . note firewall , password should be enabled and settings should be done as automatic .

Hope so ,the above methods can help the user .

appreciate wrote:

Sometimes when a user opens safari it is redirected to weird sites . This happens if DNS caches are poisoned . To find the address to a site , your system asks another system ( a so called domain name server or DNS ) which stores this information .if this DNS gives your computer the wrong address to some sites it is known as DNS poisoning .

The code for DNS cache poisoning is often found in URLS sent via spam mails . these emails attempt to frighten users into clicking on the supplied URL which in turn infects the system .banners ads & images both in emails & untrustworthy websites can also direct users to this code .

Once poisoned , a user's system will take to the fake websites that are spoofed to look like the real thing exposing them to risks such as spyware , key loggers or worms .

To prevent DNS poisoning user should never click on links they don't recognize & regularly scan their system for malware since poisoning could spoof web - based results .

But according to the issue posted , the user is redirected to unwanted sites & different unwanted malicious pages are displayed .

So some steps are as under please follow them .

Click on finder >go > computer > macintosh HD > library > remove the entire contents off folders caches & cookies .

Click on finder > go > computer > keep on holding option key on keyboard > library > remove entire contents of folders caches , cookies , saved application state .

1. close all applications using key board short cut : command + tab + Q .

2. type a command cat /etc/hosts in terminal ( there is space after cat & all words are small ) click on enter . restart the system from apple logo .

Once again open safari & check if new browser windows are opening , unwanted pop ups are there .

To avoid this apple has formed an article the user can follow it : https ://support.apple.com/en-us/ht202516

Also please do a factory settings once again home router and in airport express . note firewall , password should be enabled and settings should be done as automatic .

Hope so ,the above methods can help the user .

Please stop.

Interesting. I've been using MacKeeper as an app for quite a few years now and have never had any issues with it. I rescued it from the trash and have been running it again with no problems.

I do think it was a fake Flash Player installation update alert that is what started the whole thing.

At any rate, as I said, after installing Malwarebytes everything seems to be back to normal. It definitely did the trick. Thanks!

post.user_wrote.label:

Interesting. I've been using MacKeeper as an app for quite a few years now and have never had any issues with it.

My grandfather was a raging alcoholic for years before cirrhosis finally killed him. That doesn't mean it was okay that he drank all those years before he finally started getting sick. My point is, just because you're not having issues doesn't mean it's smart to keep it. MacKeeper is fraudulent garbage, and has been caught up in a class-action lawsuit for fraudulent business practices. That should be reason enough not to let it anywhere near your computer. Do a search of these forums for programs like MacKeeper — you're going to see the exact things said. They're all nonsense. Macs do not need any so-called "maintenance" app that claims it will clean, boost, organize, optimize, or refresh your hard drive.

appreciate wrote:

The code for DNS cache poisoning is often found in URLS sent via spam mails .

DNS cache poisoning has absolutely nothing to do with any URLs sent in e-mails, nor with anything else that the user might do on his or her computer. DNS cache poisoning is a problem on the DNS server itself, and it affects everyone using that server. As such, all of your advice about how to handle a DNS cache poisoning problem is completely wrong. The only way to solve an issue with a poisoned DNS server is to either wait for the owner of the server (typically your internet service provider) to fix the problem or use a different DNS server.

Further, there's no reason to believe that this problem is due to DNS cache poisoning. That is a very unlikely explanation for the problem, and there are many other explanations that are far more likely.