Strange behaviour in Safari

[iantunnacliffe]

I am using a Macbook Pro 13" Early 2015 running High Sierra.

For a few weeks now Safari has been behaving very strangely. When I am on a web page with fill in forms and I select from a drop-down list the list remains in front of the web content. Sometimes I don't even have to use the drop down for it to pop up in front of the content I am looking at. I can have two or three of these things hanging around on a single page and they can block the content I am actually trying to work with. Sometimes they will go away if I select an item off the list, sometimes not.

This is now getting very annoying. Has anyone else seen this behaviour and how did you stop it?

Thanks

 

[Cory Cooper]

Hello,

Sounds like you may have some malware or a third-party extension that is causing the issue. Try downloading Malwarebytes Anti-Malware for Mac and run it. Also, delete any third-party unknown/non-needed Safari Extensions. If you aren't sure about the extensions, list them in a response, and we will let you know if they are "safe".

Let us know if that corrects the issue.

C

 

[iantunnacliffe]

I ran Malwarebytes and it found I had Genieo, something I had not previously been aware of. I have removed it and so far so good. Thanks for the quick response.

 

[Cory Cooper]

No worries. Glad it worked for you.

Genio is nasty little malware, and pretty common. Malwarebytes is a GREAT tool to have.

Be well, and let us know if you have any additional issues.

C

 

[iantunnacliffe]

Don't know if you are still watching this thread but the problem is back. Malwarebytes is now showing that I am clean but I am again getting what appears to be the content of drop-downs appearing in front of what I am doing. It has just happened at a ticket booking site for the Cricket World Cup. Not only that but the fans started going like the clappers just afterwards so I checked Activity Monitor which showed Safari at over 200% CPU. This persisted even after I closed the tabs I had been using and didn't stop until I quit Safari altogether.

 

[honestone]

OK, a couple of things you can do:

1. Do a search for Genieo. While Malwarebytes (most likely) removed the offending "pieces", there could be some remnants of it left over. Or you could have it again on your Mac. The Mac OS comes delivered with Spotlight, but I prefer the excellent freeware program EasyFind:

https://www.devontechnologies.com/products/freeware.html

2. Try using another browser to see if you have the same issues. Firefox is good, as is Google Chrome. You can get them from here:

Firefox - https://www.mozilla.org/en-US/firefox/new/

Google Chrome - https://www.google.com/chrome/?bran...gclsrc=aw.ds&dclid=CLHU8bbN9NwCFRNYfgodeF0Jng

3, Use more robust virus program. ClamXAv is excellent, and you can use it in demo mode. It is available from here:

https://www.clamxav.com/

When you run ClamXAv, make sure to first let it upgrade the virus definitiomns. Then, let it scan the "top" level of your system. That should be your entire internal drive. It will take some time for that to complete, but it is better to be "safe than sorry".

4. Make sure you are doing disk cleanup/maintenance/repairs, from a software perspective, frequently. You actually can do a good amount of disk cleanup on your own, and there are some excellent programs avaiolable (b oth free and commercial) that can help you with those tasks.

 

[Cory Cooper]

Hello,

Along with honestone's suggestions, could you give us the link to the website(s) that are having the issue? It may be a website issue, and not a Safari issue per se, if Malwarebytes is showing things are good. Also, check Safari > Preferences... > Extensions and let us know of there are any installed and active.

C

 

[iantunnacliffe]

This is happening on multiple web sites. This afternoon it has been comparethemarket.com and moneysupermarket.com

I do have other browsers installed including Firefox and Opera. I have not observed this happening with either of those two. In fact I am using Opera now to access this forum and it's behaving impeccably.

I don't see anything of Genieo in a Spotlight search.

Trying ClamXAv now.

 

[iantunnacliffe]

ClamXAv showed multiple files infected with Genieo, several of them Flash player and Installer. I have trashed them all. Let's see what happens now.

 

[Cory Cooper]

Good to hear other pieces of Genieo were found.

I personally don't have Adobe Flash installed on any of my Macs, due to the large number of issues it can cause. I use Google Chrome to browse any sites that still require Flash, as it has a sandboxed version of Flash built-in.

Let us know how it goes.

C

 

[honestone]

Glad ClamXAv found some more nefarious "stuff". Also, like Cory, I use Google Chrome without an "external" version of Flash. I have seen little, if any, ill effects with that.

Also, in the future, when you want to remove an application, use the excellent freeware program AppCleaner, available from here:

https://freemacsoft.net/appcleaner/

It does a very good job at finding most (sometimes all) files, folders, etc. associated with the application. After using it to remove all the "stuff" it finds (and of course the app itself), do a search of the app's name. That is what I do (using EasyFind), and it works out well.

 

[iantunnacliffe]

I try to keep Flash use to an absolute minimum but now and again you come across something that needs it. I didn't know that about Chrome, so I'll try it. I actually used Chrome as my main browser for a while a few years back but it was such a resource hog that I got rid of it and went back to Safari. I assume it's a bit more house trained now. So far so good on the Genieo front.

 

[iantunnacliffe]

So, it's back again. Both Malwarebytes and ClamXAv now show me "clean" but the pop-up nonsense is happening again. At first I thought that maybe I just needed to restart my Mac after getting rid of the bad files so I did that. But no, the odd behaviour is well and truly back. Latest example was while making an Amazon order yesterday. I am beginning to think that I'll have to stop using Safari again.

 

[honestone]

That sure is baffling! One thing, though, is that most of the browser-related issues reported by folks here has to do with Safari. Of course that could partially due to the number of folks using Safari compared to other browsers.

I actually encountered some strange behavior this morning on my Mac Mini. After booting up, I got a message that "spi wanted to "revise" my system configuration". Of course I selected cancel. But even after first EasyFind to get rid of files, folders, etc. associated with "spi", it was still present. So, I down loaded and ran the latest version of Malwarebytes, but it found nothing nefarious on the machine. I then started ClamXAv, let it update its Virus definitions, and did a scan. It found 4 suspicious files, including one that had to do with Genieo. After removing those files, I shut down the machine, waited a few minutes, started it up again, and so far, things are fine.

If it does appear again, I will do a fresh, clean installation of OS 10.13.6, and then "migrate/copy" needed "stuff" from my most recent SuperDuper! backup, taken last Saturday. (I am aware of as couple of items I will need to "restore" after that process, but they are not substantial).

Is it possible that you vcan do a clean, fresh installation of the Mac OS you are running, and then do a "migrate/copy" of needed "stuff" from a recent, "clean" backup?

 

[iantunnacliffe]

Yes, I have considered doing that but it seems like something of a nuclear option for what is a relatively small problem. It would be easier just to switch my default browser.

One thing that I have noticed is that when I open quite a lot of web sites in Safari I get the pop-up that says "such and such a site wants to use Adobe Flash Player. I always say no, but could this be part of my infection problem?

 

[oldscribe]

Hi,

Have you cleaned out Safarie's Caches?


Also website plugins

 

[honestone]

I guess that's possible. If you do switch browsers, Google Chrome is excellent. I rarely, if ever have issues with it, and it is fast. But you still might want to consider doing a clean, fresh installation of the Mac OS. I actually might do it anyway, even though my issue seems to be gone.

 

[honestone]

Hi,

Have you cleaned out Safarie's Caches?

That's actually a good idea.

 

[oldscribe]

Hi


Just edited my post

 

[iantunnacliffe]

I hadn't, but I have now. Let's see if that makes a difference.