Safari browser homepage hijacked by HomeSweekLies.com.

[MacRepairShop]

I've deleted over 100 plists and Safari caches in the user Library, but after restart, they just keep coming back.

 

I suspect that the main system files in the root directories are infected, and malwarebytes won't work because it's not compatible with Mojave

 

 

 

 

 

[1PW]

Hello @MacRepairShop and :

Thank you for the valuable attachments.

1.) I am supposing you saw the several hijack removals at:

https://duckduckgo.com/?t=ffab&q=Safari+hijacker+HomeSweekLies.com&ia=web

2.) As far as Mojave root directory malware goes, I'm not certain if chkrootkit 0.58b is helpful/effective on the MacMini7,1.

3.) Also, rkhunter 1.4.6 still runs under macOS 14.5 Sonoma and might be interesting to try. Perhaps these two are a “Hail Mary”.

4.) Have you found any other AV apps that still run under macOS 10.14.6 Mojave?

5.) It appears as if that 2014 Mac Mini's macOS could possibly be upgraded to as far as Monterey 12.7.5 opening app compatibilities somewhat. (The current Malwarebytes 5 For Mac Trial/Premium would then be compatible.)

Please reply to this topic when you're able.

HTH

cc: @alvarnell

Edited Saturday at 11:35 AM by 1PW

[treed]

Please stop deleting files without a specific plan, that's not going to solve the problem and if you delete the wrong things you could lose data or cause other problems.

From what I see, the home page has been set and the controls are grayed out for changing it. That's an indicator that the Safari home page has been set to be "managed" in this regard, as if it were being managed by an employer. This is most likely something that would have been caused by installing some kind of unwanted software.

First, I'd recommend installing a previous version of Malwarebytes for Mac, which should run on Mojave:

https://support.malwarebytes.com/hc/en-us/articles/360038479294-Install-Malwarebytes-for-Mac-v4

Remove anything it detects.

Next, there is probably going to be some additional cleanup needed, to fix things that Malwarebytes (and other antivirus software) cannot simply remove. There are some potential solutions here:

Finally, I'd note that this kind of behavior from adware is very legacy. We don't see this kind of thing with newer systems because of some changes Apple has made to prevent the kind of changes the above guide mentions. Adware can no longer install profiles to put Safari into a managed state... this can only be done on modern macOS if your computer is actually under management by someone like an employer.

If you can upgrade to a more recent version of macOS, you would be safer from these kinds of things. It's far from a guarantee that you won't get infected, but it's always a good idea to be running the latest system, with all the most up-to-date security fixes. This may not be possible for you - I also have a system I'm keeping on Mojave, because it's the last system that can run some of my older 32-bit apps. If you're not able to upgrade, you'll want to avoid installing new software as much as possible, and limit that to only software from very reputable sources.