a.akamaihd.net & Safari

Question

Level 1

40 points

a.akamaihd.net & Safari

Hi all. Last night I downloaded what I thought was a Flash plugin update (prompted by a legitimate site I visited) but it installed some kind of crazy 'Mac Cleaner' programme. I went through the usual process to delete and remove that but it left a strange search engine plugin on my browsers. I've removed it from Chrome & Firefox (which was easy) run a virus cleaner but it's still messing with Safari.

I've wiped Safari but when I go to preferences it still shows that my set homepage is http://search46107304-a.akamaihd.net/h?_pg=D7634BD9-F8A9-54E1-8E63-775A46B626FA

I've tried setting a new homepage (BBC News, Google, whatever) but, no matter what I do, it defaults to the above. I have no plugins installed and I just don't know what to do to either kill the malware completely or how to fix Safari. I even reinstalled MacOS and it's still doing it.

Anyhow, anyone got any ideas?

iMac, Mac OS X (10.7)

Posted on Mar 18, 2018 1:09 AM

Reply

Answer 1

Best reply

dominic23

Level 10

83,910 points

Mar 19, 2018 11:08 AM in response to BenfromHove

Credit: thomas_r

The following procedure appears to solve the problem:

* In Safari, choose Preferences from the Safari menu.

* In the window that opens, click the General icon (if necessary)

* Enter your desired home page in the "Homepage" field, but DO NOT press return!

* At the top of the window, click any of the other icons (eg, Tabs, AutoFill, etc).

* You may see a prompt asking for confirmation for changing the home page. If so, confirm.

* Switch back to the General page and check to make sure the home page has been changed.

https://discussions.apple.com/thread/8018092

Reply

Answer 2

dominic23

Level 10

83,910 points

Mar 18, 2018 5:51 AM in response to BenfromHove

Clear the entry in Safari search bar.

Click the magnifying glass icon in the Safari search bar.

Choose Google.

Make sure that profiles not knowingly installed by you are removed.

https://support.apple.com/kb/PH25680?locale=en_US

Reply

Answer 3

dominic23

Level 10

83,910 points

Mar 18, 2018 1:53 AM in response to BenfromHove

1. Use MalwareBytes for Mac to remove malware/adware.

Install guide: https://support.malwarebytes.com/docs/DOC-1817

Uninstall Guide: https://support.malwarebytes.com/docs/DOC-1190

The installer may ask you to allow it in Security & Privacy /System Preference. Allow it.

2. Choose a search engine.

Delete all text in the Smart Search field, click the magnifying glass , then choose a search engine from the list.

https://support.apple.com/guide/safari/customize-your-search-ibrwe75c2a3c/mac

3. Set your Home Page. https://support.apple.com/guide/safari/set-your-homepage-ibrw1020/mac

4. Restart your Mac.

5. Launch Safari holding the Shift key down.

Reply

Answer 4

BenfromHove Author

Level 1

40 points

Mar 18, 2018 3:13 AM in response to dominic23

Thanks but I've already run MalwareBytes and got a clean bill of health. The trouble is that I can't change the homepage search field in Safari preferences (see the first of my two screenshots). It simply won't let me regardless of whether I click 'Set to current page' or delete the current and type or paste in a new one in. When I follow the steps and start Safari holding shift, I just get the dodgy search page (see attached).

It might be worth noting that I've tried clicking 'Uninstall' down the bottom right of the iffy browser and that gives me instructions that tell me to delete the plug-in (there isn't one showing - second screenshot) or delete the app which I can't do with Safari.

Reply

Answer 5

dominic23

Level 10

83,910 points

Mar 18, 2018 3:40 AM in response to BenfromHove

System Preferences > Profiles

Is there any Profile listed?

Is there any unknown application in Application folder?

Finder > Applications

Please run EtreCheck and post the report here.

https://etrecheck.com

Click “Free Download” button, open Downloads folder, click on it to open, and then select ”Open”.

Click on the bouncing EtreCheck icon in the Dock.

“Choose a problem” from the popup menu box, and then “Start EtreCheck” in the dialog.

Click “Share Report” button in the toolbar, select “Copy to Clipboard” .

Paste it into the reply.

Reply

Answer 6

BenfromHove Author

Level 1

40 points

Mar 18, 2018 3:55 AM in response to dominic23

Where would I find profiles in System Preferences? It doesn't come up as one of the options.

Here's the EtreCheck report:

EtreCheck version: 4.1.3 (4A188)

Report generated: 2018-03-18 10:54:18

Download EtreCheck from https://etrecheck.com

Runtime: 4:19

Performance: Good

Problem: Other problem

Major Issues: None

Minor Issues:

These issues do not need immediate attention but they may indicate future problems.

Time Machine auto backup disabled - Time Machine auto backups are disabled.

Kernel extensions blocked - There are blocked kernel extensions awaiting user approval.

Unsigned files - There is unsigned software installed. They appear to be legitimate but should be reviewed.

System modifications - There are a large number of system modifications running in the background.

32-bit Apps - This machine has 32-bits apps that may have problems in the future.

Hardware Information:

iMac (27-inch, Late 2012)

iMac Model: iMac13,2

1 2.9 GHz Intel Core i5 (i5-3470S) CPU: 4-core

8 GB RAM Upgradeable

BANK 0/DIMM0

4 GB DDR3 1600 ok

BANK 1/DIMM0

4 GB DDR3 1600 ok

BANK 0/DIMM1

Empty

BANK 1/DIMM1

Empty

Video Information:

NVIDIA GeForce GTX 660M - VRAM: 512 MB

iMac 2560 x 1440

Drives:

disk0 - APPLE SSD SM128E 121.33 GB (Solid State - TRIM: Yes)

Internal SATA 6 Gigabit Serial ATA

disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk0s2 [Core Storage Container] 120.99 GB

disk2 - M************a (Journaled HFS+) [Fusion Drive] 1.11 TB

disk0s3 - B*******X [Recovery] 134 MB

disk1 - APPLE HDD ST1000DM003 1.00 TB (Mechanical)

Internal SATA 3 Gigabit Serial ATA

disk1s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk1s2 [Core Storage Container] 999.35 GB

disk2 - M************a (Journaled HFS+) [Fusion Drive] 1.11 TB

disk1s3 - Recovery HD (Journaled HFS+) [Recovery] 650 MB

Mounted Volumes:

disk2 - M************a [Fusion Drive] 1.11 TB (355.41 GB free)

Journaled HFS+

Mount point: /

Network:

Interface en0: Ethernet

Interface en6: iPhone

Interface en1: Wi-Fi

802.11 a/b/g/n

One IPv4 address

Interface en4: Bluetooth PAN

Interface bridge0: Thunderbolt Bridge

iCloud Quota: 147.92 GB available

System Software:

macOS High Sierra 10.13.3 (17D102)

Time since boot: Less than an hour

System Load: 2.75 (1 min ago) 2.54 (5 min ago) 2.20 (15 min ago)

Security:

System	Status
Gatekeeper	Mac App Store and identified developers
System Integrity Protection	Enabled

Unsigned Files:

Launchd: /Library/LaunchDaemons/com.adobe.fpsaud.plist

Executable: /Library/Application Support/Adobe/Flash Player Install Manager/fpsaud