Resolved safari search & homepage hijacked, but...

[fisherking]

i often help friends with their macs. two of them had the same issue recently (one on high sierra, one on mojave). safari's search engine has been hijacked (bing on one, yahoo on the other); we can't change that, and can't change the homepage.

we've run malwarebytes (which quarantined some errant files, ie genio). no extensions installed. no login items. did a safe boot. and searched all the launchdaemon (ETC) folders... and it's still happening.

anyone? i've been down this road before, but this is the first time i can't fix the issue...

 

[MevetS]

Look under System Preferences > Profiles. This happened to my girlfriend and after we deleted some curious profiles the issue was resolved.

 

[fisherking]

i checked that originally, and no profiles installed. these are both macs bought new by the same person now using them (but thanks for the suggestion).

 

[MevetS]

i checked that originally, and no profiles installed. these are both macs bought new by the same person now using them (but thanks for the suggestion).

Bummer. Good luck getting it solved.

 

[fisherking]

Bummer. Good luck getting it solved.

thanks. i've solved this a few times in the past, finding obvious malware files in launchdaemons, etc. or removing suspicious extensions. this time around, am stumped...

 

[fisherking]

amazingly... fixed (well, partially; still can't change the homepage).

after all the above steps... i clicked on the magnifying glass in the address bar, changed the search engine there... and it stuck. so, good enough!