How JustAnswer Works:
  • Ask an Expert
    Experts are full of valuable knowledge and are ready to help with any question. Credentials confirmed by a Fortune 500 verification firm.
  • Get a Professional Answer
    Via email, text message, or notification as you wait on our site.
    Ask follow up questions if you need to.
  • 100% Satisfaction Guarantee
    Rate the answer you receive.
Ask John T. F. Your Own Question
John T. F.
John T. F., Mac Druid
Category: Mac
Satisfied Customers: 3058
Experience:  20+ years in the computer/Mac industry
60674955
Type Your Mac Question Here...
John T. F. is online now
A new question is answered every 9 seconds

I have started having problems with Safari. It looks like I

Customer Question

I have started having problems with Safari. It looks like I have something called "bank worm heuikorg". Safari hangs up & will not close any tabs. The phone number to supposed call to get Apple to respond is 1-***-***-****. I'm not sure what to do or trust the number. Can you help? Thanks!
Submitted: 1 year ago.
Category: Mac
Expert:  Michelle replied 1 year ago.

Hi, and welcome to JustAnswer! My name is ***** ***** I am excited to get started with you.

From what you are describing, you are experiencing a ransomware scam. Here is what you will need to do to get rid of it.

1. Click on the apple logo in the upper left corner and choose Force Quit

2. Select Safari from the list and choose force quit

3. Next, Press and hold down the SHIFT key while opening safari. The shift key needs to be held down until safari opens. This allows safari to open up in safe mode

4. When safari opens, click on Safari at the top menu bar and choose Clear History and Website Data. If you are running an earlier version of Mac OS X, it will say reset safari

Expert:  Michelle replied 1 year ago.

If you are still unable to launch safari using the above instructions, I can remote into your mac and resolve the issue for you

Customer: replied 1 year ago.
Sorry, it's the same answer I got from Apple and it hasn't worked. I DO NOT want you to get into my computer. Your company "says" it has an A+ rating with BBB but you do not show the logo and I have made an inquiry and your company does not come up! If you are really on the up and up, perhaps you can help me figure out the next thing that Apple recommends:
"navigate to the following folder: ~/library/saved application state/." They further state "if you are not sure how to find this folder, see Locating files from paths (/locating-files-from-paths/). Inside that folder, find the folder named: com.apple.Safari.savedState. Drag that to the trash, then go to the following: ~Library/Safari/ and drag the "LastSession.plist" file to the trash. I don't know where to find the above, so I could certainly use your help in figuring out where this stuff is so I can fix it myself. Thank you!
Expert:  Michelle replied 1 year ago.

I totally understand. I can surly walk you through step by step. Lets first start with locating the library folder.

1. Click on Finder and click on Go at top menu bar and choose Go To Folder. Paste or type this inside ~/Library

Expert:  Michelle replied 1 year ago.

2. After the you enter ~/Library and choose Go, another window will open. Make sure safari is closed first. Within the Library folder, click on Saved application state

3. Located com.apple.Safari.savedState folder and drag it into the trash

4. Next, go back to the preference folder and click on Safari. Within the Safari folder, drag the LastSession.plist file into the trash

5. Lastly, Go back and click on the Preferences folder. Within the preference folder, locate and delete com.apple.Safari.plist.

6. Restart your Mac

Customer: replied 1 year ago.
Well, I cannot find the "com.apple.Safari.plist". Which preferences files should it be in? I have in my trash now: "com.
Customer: replied 1 year ago.
Sorry--hit the wrong button. In my trash are now: com.apple.Safari.savedState, Safari desktop picture.png, and Last Session.plist. Now the popups seem to keep coming back to "add nytimes" and some other stuff. It now takes longer for the popups and I don't get the one that says to call a certain number anymore. Got any more ideas? Thanks!
Expert:  Michelle replied 1 year ago.

It appears the ransomware scam issue is resolved. By default, push notifications are enabled. To disable it,

  1. Open Safari and choose “Safari” menu and choose “Preferences”
  2. Click on the “Notifications” tab
  3. Uncheck the box at the bottom of this screen for “Allow websites to ask for permission to send push notifications” to disable the popup requests in Safari. Or select NY times from the list and choose remove
Customer: replied 1 year ago.
IT IS NOT FIXED! It now takes a little longer for the messages to appear, and for awhile I could actually shut down Safari by using the quit. After I ended up still having messages, I ran disk utilities, but now I can't shut down Safari without forcing it to quit. Here are the current messages (I think they have changed a little bit).
From "http://gus.2pk1.becarefulalert-malware-callnow.com"
above that
Add "www.nytimes.com" to Shared Links?
above that
Add "ax.phobos.apple.com.edgesuite.net" to Shared Links?
above that
Add "www.apple.com" to Shared Links?
Expert:  Michelle replied 1 year ago.

It would be much easier if I could provide remote support into your mac. I understand that you are very uncomfortable with that option. I would like to opt out and allow other experts with a fresh set of eyes to better assist you.

Expert:  John T. F. replied 1 year ago.

Can you tell me the exact version of OS X you are currently running, please?

Click the Apple logo in the menu bar at the top left of the screen

Select "About This Mac"

In the window that opens, look for the "Version" information. Please let me know what it says.

Thanks,

John