safari hijacked...

[fisherking]

my GF got a virus warning on her mac. we rebooted, ran malwarbytes, deleted the one file it found... but she still can't change the search engine (from google) or input a homepage.

i deleted the safari folder in her user library (i kept the bookmarks). same problem. i created a TEST account.. and it's happening there too. so the problem is global, not tied to her account.

any ideas? i looked thru the entire HD library, can't find anything obviously suspect...

 

[dianeoforegon]

Download EtreCheck. Etrecheck is a diagnostic tool recommended by Apple Support personnel. Paste the results in a reply. This is similar to Apple's System Profiler but has more info that can diagnosis issues on your Mac.

http://www.etresoft.com/etrecheck

More Info on Etrecheck
https://discussions.apple.com/docs/DOC-11591

 

[fisherking]

i've run that on my own mac, will try this... tomorrow. thanks for the idea!

 

[fisherking]

ran etrecheck. nothing suspicious. i also deleted logmein and gotomeeting files... even after rebooting, we still can't change the search engine from google, or input a homepage. there must be a way to remedy this? anyone?

 

[Weaselboy]

ran etrecheck. nothing suspicious. i also deleted logmein and gotomeeting files... even after rebooting, we still can't change the search engine from google, or input a homepage. there must be a way to remedy this? anyone?

Try holding the shift key at boot to boot to safe mode. That will stop any third party items from launching. If that fixes you likely have missed something in the Etrecheck report.

Reboot out of safe mode and run EtreCheck again and post the report here for us to look at. It is anonymized, so nothing to worry about.

 

[fisherking]

Try holding the shift key at boot to boot to safe mode. That will stop any third party items from launching. If that fixes you likely have missed something in the Etrecheck report.

Reboot out of safe mode and run EtreCheck again and post the report here for us to look at. It is anonymized, so nothing to worry about.

thanks will try that!

 

[dianeoforegon]

This is a puzzler. Have you checked permissions? What about running the full Sierra installer over her install. I doubt the combo would fix.

If you don't have the installer saved, use this link to download https://itunes.apple.com/us/app/macos-sierra/id1127487414?ls=1&mt=12

 

[fisherking]

i was able to set a homepage, by entering an address, clicking out of that preference tab, then closing safari prefs. but, even in safe boot, i can't change the search engine.

i've seen this before, and helped a friend thru it, by deleting a 'bad' extension. anyway, it's going to 'google.com', so it's NOT being hijacked. she's going to live with it for now (she's definitely not up for a reinstall right now).

thank for your help, both of you!

 

[dianeoforegon]

The reinstall is just the time to run the full installer. No new setup required.
Be sure to let us know what finally fixes this.

 

[fisherking]

i checked the hosts file, all good. but... in safari permissions, there's an entry i've NEVER seen; it shows "custom".
it's not on either of my macs. i can't delete it, or change it to 'no access', or... change it to anything.

any thoughts?

 

[dianeoforegon]

I've seen this before. I know you know the basics, but including details for others that might find this thread later.

Follow these steps to reset the permissions:

From the Finder menu bar, choose Go > Home. Your home folder opens.

Choose File > Get Info. An Info window for your home folder opens.

If the “Sharing & Permissions” section at the bottom of the window isn't open, click the triangle in that section to open it.

If the Lock button at the bottom of the window shows a closed lock lock , click the lock and enter an administrator name and password.

Click the Action menu in the bottom corner of the window, then choose “Apply to enclosed items.” Click OK to confirm the action. A progress bar appears at the top of the window.

When the progress bar completes, open the Terminal app from the Utilities folder of your Applications folder.

Paste or type this command in Terminal, then press Return:

diskutil resetUserPermissions / `id -u`

On U.S. keyboards, the ` character is just above the Tab key. After entering the diskutil command, if Terminal says that permissions reset on user home directory failed (error -69841), enter

chflags -R nouchg ~

then enter the diskutil command again.

When the process completes, quit Terminal.

 

[fisherking]

I've seen this before. I know you know the basics, but including details for others that might find this thread later.

Follow these steps to reset the permissions:

From the Finder menu bar, choose Go > Home. Your home folder opens.

Choose File > Get Info. An Info window for your home folder opens.

If the “Sharing & Permissions” section at the bottom of the window isn't open, click the triangle in that section to open it.

If the Lock button at the bottom of the window shows a closed lock lock , click the lock and enter an administrator name and password.

Click the Action menu in the bottom corner of the window, then choose “Apply to enclosed items.” Click OK to confirm the action. A progress bar appears at the top of the window.

When the progress bar completes, open the Terminal app from the Utilities folder of your Applications folder.

Paste or type this command in Terminal, then press Return:

diskutil resetUserPermissions / `id -u`

On U.S. keyboards, the ` character is just above the Tab key. After entering the diskutil command, if Terminal says that permissions reset on user home directory failed (error -69841), enter

chflags -R nouchg ~

then enter the diskutil command again.

When the process completes, quit Terminal.

you think this will then alow me to delete the custom option in safari? or?? thanks btw...

 

[dianeoforegon]

you think this will then alow me to delete the custom option in safari? or?? thanks btw...

This will reset permissions. Hopefully that will let you reset Safari.

 

[fisherking]

This will reset permissions. Hopefully that will let you reset Safari.

thanks dianeof. will try this tomorrow, and report back. otherwise will suggest the combo installer.

EDIT: no change, sigh. still can't change permissions on safari, same 'you do not have privledges' error. so, she's gonna run the (10.12.6) combo update tonite, and we'll see how that goes.

meanwhile, no popups, google is google, so... not bad overall. but frustrating not being able to change the search engine.

again, thanks. will report in finally tomorrow about what happens...

 

[Sital]

I don't have a solution to your problem, but my Safari permissions also show "Custom" and Safari is running as it usually does for me.

 

[fisherking]

the combo update fixed it. nothing bad was happening, but she feels better about it. still, scary... thanks so much, dianeof...