Today, one of my friend told me that sometimes browsers on her mac change their homepage and default search engine to a strange website with prefix: "feed.helperbar". I googled this issue but the solutions are for Windows only. So, I found a way to remove this malware on Mac. I'm not sure whether this method works perfectly but at least the problem of my friend's Mac seems be fixed so far.

 

If the malware is in your Mac, it would:

• Change your default search engine to "HelperBar"
• Change your homepage to "HelperBar", too
• It affects all popular browsers in the same time, includes Chrome, Safari and Firefox
• Sometimes the browsers would restart suddenly, after they restart, the settings are changed by the malware

 

To remove the malware, you should delete these files:

• file. Yes, there's a executable file named "file" in / (root of the system)
• /var/tmp. the injector should be there

And I think (not very sure) that one of the injector is in the local TimeMachine backup, so we can disable the backup to remove it.

Then enable it back to restore our settings.

 

Related Thread: https://discussions.apple.com/thread/7564175?start=0&tstart=0