Can't remove Safe Finder

Hi Eric... thanks for your reply. I've already run Malwarebytes and Combocleaner and they did not remove Safe Finder. It is not in my extensions or applications. I'm not sure what files would be suspicious in the activity monitor since there is nothing that refers directly to safe finder in the processes that are running, even when it is open to that page. Any other thoughts?

Yes, I have looked at all your links. I have tried several malware programs but they have not discovered where this program is residing. It is not apparent in applications or extensions. It is not set as my homepage, but still opens when I start Safari. I'm baffled.

Hi Eric... yes I have done everything manually that was suggested. I have cleaned out the cache, deleted cookies, blocked cookies, removed all website data disabled extensions, disconnected from the internet, rebooted in safe mode, reopened Safari in safe mode, looked for suspicious files in the Library launchagent and launchdaemon. I don't know enough about files that are running when I look at the activity monitor to know what I might delete there. It is not changing my homepage, yet opens to safe finder when I start Safari. Stumped!!!

Hi Eric... thanks for sticking with me here. Yes, I have done all of those steps except the last one, but that file wasn't there so I may have already deleted it when I emptied caches in Develop. I don't know what the program is doing behind the scenes. I have Ad Block running so I'm not seeing popup ads or being redirected to crazy places, but my computer is running much slower that it used to and I've done all the recommended things to speed it up. I just don't know where the command for it to open to that site is hiding.

Hi Eric... I ran Etrecheck. Here is the report. I can't glean anything pertinent from it, but you may. Thanks for looking it over.

EtreCheck version: 5.0.6 (5A017)

Report generated: 2018-10-18 16:03:30

Download EtreCheck from https://etrecheck.com

Runtime: 5:48

Performance: Below Average

Problem: Beachballing

Description:

Mac is defaulting to Safe Finder as homepage and cant delete it

Major Issues:

Anything that appears on this list needs immediate attention.

Time Machine backup out-of-date- The last Time Machine backup is over 10 days old.

Minor Issues:

These issues do not need immediate attention but they may indicate future problems.

High battery cycle count- Your battery may be losing capacity.

Apps with heavy CPU usage- There have been numerous cases of apps with heavy CPU usage.

Unsigned files- There are unsigned software files installed. They appear to be legitimate but should be reviewed.

Low performance- EtreCheck report took over 5 minutes to run. This is unusual.

Vintage hardware- This machine may be considered vintage.

32-bit Apps- This machine has 32-bits apps that may have problems in the future.

Hardware Information:

MacBook Air (13-inch, Late 2010) - Vintage!

MacBook Air Model: MacBookAir3,2

1 1.86 GHz Intel Core 2 Duo (Duo) CPU: 2-core

4 GB RAM - Not upgradeable

BANK 0/DIMM0 - 2 GB DDR3 1067 ok

BANK 1/DIMM0 - 2 GB DDR3 1067 ok

Battery: Health = Replace Soon - Cycle count = 1620

Video Information:

NVIDIA GeForce 320M - VRAM: 256 MB

Color LCD 1440 x 900

Drives:

disk0 - APPLE SSD TS256C 251.00 GB (Solid State - TRIM: Yes)

Internal SATA 3 Gigabit Serial ATA

disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk0s2 [APFS Container] 250.79 GB

disk1 [APFS Virtual drive] 250.79 GB (Shared by 4 volumes)

disk1s1 - Macintosh HD (APFS) (Shared - 194.31 GB used)

disk1s2 - Preboot (APFS) [APFS Preboot] (Shared - 21 MB used)

disk1s3 - Recovery (APFS) [Recovery] (Shared - 516 MB used)

disk1s4 - VM (APFS) [APFS VM] (Shared - 2.15 GB used)

Mounted Volumes:

disk1s1 - Macintosh HD 250.79 GB (53.66 GB free)

APFS

Mount point: /

Encrypted

disk1s4 - VM [APFS VM] (Shared - 2.15 GB used)

APFS

Mount point: /private/var/vm

Network:

Interface en2: iPhone

Interface en0: Wi-Fi

802.11 a/b/g/n

Interface en1: Bluetooth PAN

iCloud Quota: 22.13 GB available

System Software:

macOS High Sierra 10.13.6 (17G65)

Time since boot: About 2 days

Security:

Unsigned Files:

Launchd: /Library/LaunchAgents/com.oracle.java.Java-Updater.plist

Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater -bgcheck

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/com.oracle.java.Java-Update r.plist

Executable: /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater -bgcheck

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

Executable: /Library/PrivilegedHelperTools/com.microsoft.office.licensing.helper

Details: Exact match found in the whitelist - probably OK

32-bit Applications:

35 32-bit apps

Kernel Extensions:

/Applications/zoom.us.app

[Not Loaded] ZoomAudioDevice.kext (1.1 - SDK 10.8)

/System/Library/Extensions

[Not Loaded] PACESupportFamily.kext (5.7.2)

/System/Library/Extensions/PACESupportFamily.kext/Contents/PlugIns

[Not Loaded] PACESupportLeopard.kext (5.7.2)

[Not Loaded] PACESupportPanther.kext (5.7.2)

[Not Loaded] PACESupportSnowLeopard.kext (5.7.2)

[Not Loaded] PACESupportTiger.kext (5.7.2)

Startup Items:

PACESupport Path: /Library/StartupItems/PACESupport

System Launch Agents:

System Launch Daemons:

Launch Agents:

Launch Daemons:

User Launch Agents:

User Login Items:

PhotoStreamAgent (App Store - installed 2038-01-18)

(/Applications/iPhoto.app/Contents/Library/LoginItems/PhotoStreamAgent.app)

Internet Plug-ins:

Flip4Mac WMV Plugin: 2.4.0.11 (installed 2012-01-03)

FlashPlayer-10.6: 31.0.0.122 (installed 2018-10-15)

QuickTime Plugin: 7.7.3 (installed 2018-07-19)

Flash Player: 31.0.0.122 (installed 2018-10-15)

iPhotoPhotocast: 7.0 (installed 2012-04-12)

nplastpass: 1.75.9 (installed 2011-10-12)

Google Earth Web Plug-in: 7.1 (installed 2013-07-12)

JavaAppletPlugin: Java 8 Update 144 build 01 (installed 2017-08-27)

User Internet Plug-ins:

ZoomUsPlugIn: 4.1.11049.1024 (installed 2017-12-10)

Safari Extensions:

3rd Party Preference Panes:

Flash Player (installed 2018-09-21)

Flip4Mac WMV (installed 2011-06-30)

Java (installed 2017-08-27)

Rapport (installed 2010-12-06)

Time Machine:

Skip System Files: No

Mobile backups:

Auto backup: Yes

Volumes being backed up:

Macintosh HD: Disk size: 250.79 GB - Disk used: 197.13 GB

Destinations:

E***************** [Local] (Last used)

Total size: 999.86 GB

Total number of backups: 3

Oldest backup: 2016-01-13 14:40:03

Last backup: 2016-01-13 16:26:51

Performance:

System Load: 3.88 (1 min ago) 2.77 (5 min ago) 2.60 (15 min ago)

Nominal I/O speed: 0.34 MB/s

File system: 51.35 seconds

Write speed: 80 MB/s

Read speed: 159 MB/s

CPU Usage:

Top Processes by CPU:

Top Processes by Memory:

Top Processes by Network Use:

Virtual Memory Information:

Software Installs (past 30 days):

Diagnostics Information (past 7 days):

2018-10-18 13:27:42 com.apple.WebKit.WebContent CPU (11 times)

/System/Library/StagedFrameworks/Safari/WebKit.framework/Versions/A/XPCServices/ com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent

2018-10-16 21:37:09 iTunes.app Crash

/Applications/iTunes.app

2018-10-16 20:18:40 mds_stores Crash

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata .framework/Versions/A/Support/mds_stores

2018-10-15 22:45:27 WindowServer CPU

/System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/Resources/Window Server

2018-10-15 21:51:16 Combo Cleaner.app CPU

/Applications/Combo Cleaner.app

2018-10-15 21:48:32 cloudd Crash

/System/Library/PrivateFrameworks/CloudKitDaemon.framework/Support/cloudd

End of report

Hey Eric... so when the search engine opens, down at the bottom there is an uninstall button that send you uninstall it as an extension, but it's not in my extensions. There is also a contact button that allows you to send them a message. Do you think that is legit where I could actually ask them how to get rid of it, or just part of the malware that will do something horrible to my computer.

Hi Rozaly.... yes, I've tried everything suggested in those guides and run several clean-up programs. The program doesn't show up in my applications, extensions, login items, or homepage, and I've tried safe boots and looking for pertinent files in the Library. It still opens every time I open Safari. My ad blocker stops any annoying ads or pop-ups, but it's slowing my machine down. Stumped!

Hi Eric... I believe that I have solved the mystery of the hidden Safe Finder. I'd just about given up and was getting ready to make an appointment with Apple, but I was cleaning out my Bookmarks and found the url for Safe Finder at the end of my Favorites, even though it wasn't showing up in the favorites bar. Somehow my computer was set to bypass my Homepage settings and go to that bookmarked page. I deleted the url from my favorites and checked Safari's General Preferences and all was set to my normal preferences—for new windows and new tabs to open to my homepage which was set at Google. I reset Safari and rebooted my computer. When I opened Safari it opened to the last url in my Bookmark Favorites (?) but it also opened a tab for every one of my bookmarked urls (120)(??). I didn't think to check the Preferences again, but deleted all of my Bookmarks and rebooted. This time Safari opened to an empty page. Okay so that was better, but I wanted to see if I could add Bookmarks. I added a few and rebooted. Once again when I opened Safari, it opened to the last url I'd bookmarked and opened a tab for each bookmark. Grrrrr.... I looked around the activity monitor and Library to see if I could find anything that looked like it would command an override of my preferences and was about to drop the computer into the toilet and flush, but I looked again at my General Preferences and saw that the Open New Windows setting was now set to open with tabs for favorites!! The setting had been changed! That was a little too Halloweeny for me! I changed it back to open to my Homepage, reset Safari, rebooted and opened Safari in safe mode. It opened to my Homepage and the General Preference settings were correct. I closed it and reopened it and all was well. I rebooted my computer and reopened Safari and all was normal. I am hoping that is the end of this issue for me!! I thank you again for your time and expertise!!!