Jimbrie has hijacked Safari home page

PAMurillo
PAMurillo used Ask the Experts™
on
Hi Guys,
I have a client with a Mac Book Pro with OSX 10.13. We discovered his Safari home page is set to http: slash slash search dot jimbrie dot com. It added some extensions as well.
I ran the attached code to reset Safari which took care of the extensions but cannot change the home page.
mv ~/Library/Safari ~/Desktop/Safari-`date +%Y%m%d%H%M%S`; \
rm -Rf ~/Library/Caches/Apple\ -\ Safari\ -\ Safari\ Extensions\ Gallery; \
rm -Rf ~/Library/Caches/Metadata/Safari; \
rm -Rf ~/Library/Caches/com.apple.Safari; \
rm -Rf ~/Library/Caches/com.apple.WebKit.PluginProcess; \
rm -Rf ~/Library/Cookies/Cookies.binarycookies; \
rm -Rf ~/Library/Preferences/Apple\ -\ Safari\ -\ Safari\ Extensions\ Gallery; \
rm -Rf ~/Library/Preferences/com.apple.Safari.LSSharedFileList.plist; \
rm -Rf ~/Library/Preferences/com.apple.Safari.RSS.plist; \
rm -Rf ~/Library/Preferences/com.apple.Safari.plist; \
rm -Rf ~/Library/Preferences/com.apple.WebFoundation.plist; \
rm -Rf ~/Library/Preferences/com.apple.WebKit.PluginHost.plist; \
rm -Rf ~/Library/Preferences/com.apple.WebKit.PluginProcess.plist; \
rm -Rf ~/Library/PubSub/Database; \
rm -Rf ~/Library/Saved\ Application\ State/com.apple.Safari.savedState

Open in new window


I have followed several websites that tell you to go into various Library folders and manually delete suspicious files. I have found nothing suspicious in the designated library folders. I even ran Malwarebytes for Mac but no luck. In addition, I cannot find any suspicious the Applications folder that matches known malware pertaining to jimbrie dot com.

Any suggestions for changing the homepage from http: slash slash search dot jimbrie dot com ?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
You set that in your preferences.
command , (comma)

or

Safari --> Preferences

In the General tab, about 1/3 of the way down, change homepage to http://www.apple.com/startpage/  (or whatever you want it to be).
You might also check to see if there is a /Library/Safari/ folder and /Library/Preferences/com.apple.safari.* files as well. Normally, preferences just go in the users default ~/Library Folder, but you can put stuff in the root /Library folder to set initial default settings for all users.

Author

Commented:
Hi serialband,
No luck. I found every Safari folder and deleted contents of all for the User and HD. I even deleted the ~/Library/Safari.
I can enter: www.google.com but as soon as I close or change taps in Safari Preferences, it goes back to jimbrie dot com.

Another clue: I cannot change the search engine from Yahoo. When I do, it reverts back to Yahoo

Any suggestions to complete restore Safari to factory?
Amazon Web Services

Are you thinking about creating an Amazon Web Services account for your business? Not sure where to start? In this course you’ll get an overview of the history of AWS and take a tour of their user interface.

Author

Commented:
Update: I am able to change the Search Engine
Home Page still eluding me
Maybe remove the extension.
Select Safari's Preferences...
Click the Exteynsions tab
Uninstall the SearchMe Extension.

Download and Install MalwareBytes and scan your system.

Author

Commented:
I removed all extensions previously and scanned with Malwarebytes - it comes up with nothing.
If we could go back in time, I'd reset Safari to Factory. I have tried multiple ways to do it manually (Developer Tab), clear Cache etc.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial