0

I have lkysearch malware installed in chrome. I tried multiple ways to remove it even tried uninstalling and reinstalling chrome but no luck.

Chrome does not even allow removing the suspicious "search engine"."Resetting settings" does not work either.

enter image description here

I have my launch agents which looks like

λ ls -l ~/Library/LaunchAgents/
total 40
-rw-r--r--  1 prayagupd  NA\Domain Users  625 Jan 13 17:16 com.2313585054741982361.8750939818.plist
-rw-r--r--  1 prayagupd  NA\Domain Users  494 Mar  7  2019 com.code42.menubar.plist
-rw-r--r--@ 1 prayagupd  NA\Domain Users  812 Feb 17 17:31 com.google.keystone.agent.plist
-rw-r--r--@ 1 prayagupd  NA\Domain Users  918 Feb 17 17:31 com.google.keystone.xpcservice.plist
-rw-r--r--  1 prayagupd  NA\Domain Users  524 Dec  5  2017 com.skype.skype.shareagent.plist

com.2313585054741982361.8750939818.plist looked suspicious and tried removing it and related Application Support link but does make any difference. Its content is

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>Label</key>
        <string>com.2313585054741982361.8750939818</string>
        <key>ProgramArguments</key>
        <array>
            <string>/Users/prayagupd/Library/Application Support/com.4884030244826106462/12888126840620735487</string>
            <string>D066FFCB-6A22-4C60-A8BD-42C577B51B1A</string>
            <string>FE700AF0-117A-40A9-8CDA-8EC25B44007B</string>
        </array>
        <key>RunAtLoad</key>
        <true />
        <key>StartInterval</key>
        <integer>10800</integer>
    </dict>
</plist>

And extensions I have are,

λ ls -l /Users/a1353612/Library/Application\ Support/Google/Chrome/Default/Extensions
total 0
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 aapocclcgogkmnckokdopfmhonfmgoek
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 aohghmighlieiainnegkcijnfilokake
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 apdfllckaahabafndbhieahigkjlhalf
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 blpcfgokakmgnkcojhhkbfbldkacnbeo
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 felcaaldnbdncclmgdcncolpebgiejap
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 ghbmnnjooekpmoecnnnilnnbdlolhkhi
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 nmmhkkegccagdldgiimedpiccmgmieda
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 pjkljhegncpnkpknbcohdijeoejaedia
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 pkedcjkdefgpdelpbcmbmeomcjbeemfm

It also does not make any effect after removing the Extensions folder.

Also tried updating google policies using terminal but can run delete command, as recommended at https://support.google.com/chrome/thread/9267779?hl=en

defaults write com.google.Chrome HomepageIsNewTabPage -bool false
defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"
defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL
2020-02-17 22:52:03.470 defaults[6456:41690] 
Domain (com.google.Chrome) not found.
Defaults have not been changed.

λ defaults delete com.google.Chrome DefaultSearchProviderNewTabURL
2020-02-17 22:52:16.409 defaults[6468:41815] 
Domain (com.google.Chrome) not found.
Defaults have not been changed.

λ defaults delete com.google.Chrome DefaultSearchProviderName
2020-02-17 22:52:21.361 defaults[6472:41852] 
Domain (com.google.Chrome) not found.
Defaults have not been changed.

I don't have any "paid virus remove softwares". And I see the the malware is only on chrome but not on safari.

How can I manually remove the malware from my machine?

1

Ok, so this is how I removed the malware.

1) sudo rm -rf /Library/LaunchDaemons/com.ElementarySignalSearchDaemon.plist

the content of plist was,

cat  /Library/LaunchDaemons/com.ElementarySignalSearchDaemon.plist 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>Label</key>
        <string>com.ElementarySignalSearchDaemon</string>
        <key>ProgramArguments</key>
        <array>
            <string>/Library/Application Support/com.ElementarySignalSearchDaemon/ElementarySignalSearch</string>
            <string>r</string>
        </array>
        <key>RunAtLoad</key>
        <true />
        <key>StartInterval</key>
        <integer>14400</integer>
    </dict>
</plist>

2) sudo rm -rf /Library/Application\ Support/com.ElementarySignalSearchDaemon/

3) restarting the chrome did not work, so edited the plist file and removed the occurrence of links in that file,

This is because chrome://policy had Mandatory level.

sudo vi /Library/Managed\ Preferences/prayagupd/com.google.Chrome.plist 

4) remove suspicious profiles,

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .