If there is no option for you to change the homepage on your Safari, most likely your browser might have been hijacked.

Download Antivirus One App and Scan Using the Adware Cleaner Feature

Antivirus One is a professional anti-virus tool (developed by Trend Micro) that protects your device from all potential risks and attacks, so you can enjoy online browsing with ease. It provides automatic real-time scanning services and will eliminate browser hijackers before they even leave a trace. Download Antivirus One.

Remove Suspicious Profile Configurations
  1. Open System Preferences.
  2. Click Profiles.


  3. Click the - (minus) sign to remove suspicious profiles.

    Remove Suspicious Profile

  4. Restart your Mac.

If issue still persists, proceed to the next step.

Remove Suspicious Login Items

If your browser settings get modified every time you restart your browser, the browser hijacker may not only be in your browser, but somewhere deeper in your Mac. Check what programs are automatically opened at System Login to verify if the Browser Hijacker dwells in your Mac.

  1. Open System Preferences.
  2. Click Users & Groups.

    Users & Groups

  3. Click Login Items to view the list of programs that automatically open when you log in.
  4. Click the -sign to remove any items you do not want to start at login.

    Login Items

If your browser setting changes were not saved after restarting your Mac, there is a good chance that a malware was installed to be opened at login, to modify your settings every time your Mac restarts.

The Password section allows you to change user login password and manage user list.

Remove Unknown and Suspicious Extensions from your browser

The first time you realize there is a Browser Hijacker on your Mac is when the homepage or search engine of your web browser is suddenly modified without your permission.

Change the homepage/search engine of your browser back to those that you used to use in browser Preferences. Doublecheck for any suspicious Extensions.

Check Safari Extensions
Check Google Chrome Extensions

If changes are not saved after restarting your browser, consider doing the next steps.

Check if Safari Preferences File has been changed

Go to the specific folder address to remove the malware.

To check recently modified applications:

  1. Open the Finder.
  2. Click Go, then click Go to Folder.

    Go to Folder

  3. In the open field, type ~/Library/Preferences.
  4. Look for malicious plist files with Safari name like
  5. You may check if these files contain the malicious URL link by doing the following:
    1. Launch the Terminal app from Applications, then click Utilities or search for it via Spotlight.
    2. In the Terminal window, enter defaults read ~/Library/Preferences and then press RETURN.
    3. Check if the plist contains this link below: States/US/07670277/2B7B8995-02E3-5AAC-B4F1-68DA6ACCFD6A

    4. Once confirmed, you may now delete
      and other plist with the name
    5. Empty trash and restart Mac.
Comments (0)
Add a comment