Forum

Weird Mystery (Safari homepage always reverts)  

   RSS

0

I am running High Sierra on my iMac and suddenly, my Safari app will not retain my homepage setting and keeps returning to the Apple website. I have tried everything I can think of and have been unable to come up with a way to fix this. I even created a new admin identity and tried that without success. Upgrading to Mojave is off the table for now.

[Edited to add info to title - GM]

This topic was modified 8 months ago by Graham McKay
8 Answers
2

I ended up with a clean install of Mojave that also fixed the Safari issue. The Mojave upgrade was a task, but finally got it to work. Never figured out the Safari problem. I did rule out Malware. Thanks for the suggestions.

1

OK, you've reiterated that you've tried this under a completely different user account which seems to rule out preference files and cache files. But just want to double check that in that new user account you did NOT login to your iCloud account - because iCloud could possibly be a vector for re-populating preferences.

Otherwise the only other thing I can currently think of is based on a topic recently discussed on MGG - where there might be a management profile installed?

1

Thanks Graham:

I don’t believe I have a management profile, but I will check that out. You may be correct on the iCloud issue. I will try it again and make certain.

1

I am not coming up with any malware using MalwareBytes. Safari is not retaining my homepage, but I think there is another cause.

0

I've seen this behaviour a few times and the unscientific way I have gotten around it is by randomly changing & resetting some other settings at the same time & closing/reopening Safari a few times. I've seen some threads where people have proposed that the problem may be bad permissions on a Safari plist file which they've explicitly changed.

I'd suggest trying a Safe Mode restart which clears out cache files - as the problem might actually be a cached plist file rather than the plist itself.

Boot into Safe Mode (up to 15 minutes)

  • Shut down the computer.
  • Press the power button to start the Mac and immediately afterwards press and hold down the left Shift key until you see a progress bar or the Apple logo.
  • If your Mac has “FileVault” turned on you will be quickly presented with an initial “login” screen - which is actually just to unlock the hard drive. You will be asked to login again a bit later.
  • Your Mac will do some cleanup steps and show a progress bar. This may take up to half an hour - let it run even if the progress bar doesn't seem to move.
  • This should end up at the login screen with "Safe Mode" written in red at top right. If not, then Safe Mode didn't engage, shut down & try the procedure again.
  • Login to your account (you're still in "Safe Mode" so it may look a little different including a flickering screen, don't panic!) but don't start any apps or programs.
  • Leave the Mac like that for 5 minutes to "settle down".
  • Shutdown and restart normally. (This restart step is important - don't forget to do it!)

Note: This cleanup procedure deletes various "cache" files used by the operating system and apps. The next time they run they may have to recreate those cache files - so it is normal for the first restart of the Mac and the first launch of any app after a Safe Mode reset to take longer than normal.

0

That has not worked. I have tried creating a new identity, starting in Safe Mode, tossing my Safari prefs, repeatedly changing the home page, and nothing seems to work. I am wondering if there is no way to "fix" Safari other than upgrading the OS. Surely there are others who occasionally run into a Safari issue and because it is part of the System, cannot be deleted and downloaded again.

0

It's also worth running a MalwareBytes scan on your Mac. The home page is often a target of malware, trying to hijack you to bring you to some site that earns the malware-writer some money.

It's possible you've got some ineffective malware that keeps trying-and-failing to update the homepage, causing it to revert to its default.

0

OK, I've just spent some time with a client who has had Safari hijacked by WeKnow malware - and after spending more than an hour trying to disinfect we still can't get Safari to retain Homepage or Search engine changes.

MalwareBytes only managed a partial disinfection. I had to manually remove the installed profile.

Visually - it really does look like the changes are accepted by Safari but something immediately rewrites the preferences. (And I can see that the "bad" setting is definitely written into the Safari plist file)

I've parsed through various malware removal sites but they pretty much just reiterate everything I know already in terms of where to look - though one page does add as a last sentence that the WeKnow "developers" are very active in finding new ways to prevent disinfection.

Anybody else got a magic answer or thoughts on how to find what is "guarding" those plist settings?

How did you remove the profile if not with MWB? Did you just to into System Preferences and do it there?

Yes, via System Preferences - as most anti malware tips about this WeKnow malware do indicate.

I’m however starting to believe the idea that maybe the malware is not related to the OP issue but the malware WAS however able to change that setting via its profile, whereas the setting can’t be changed manually.

Share: