macOS remove lkysearch virus from chrome

Question

I have lkysearch malware installed in chrome. I tried multiple ways to remove it even tried uninstalling and reinstalling chrome but no luck.

Chrome does not even allow removing the suspicious "search engine"."Resetting settings" does not work either.

I have my launch agents which looks like

λ ls -l ~/Library/LaunchAgents/
total 40
-rw-r--r--  1 prayagupd  NA\Domain Users  625 Jan 13 17:16 com.2313585054741982361.8750939818.plist
-rw-r--r--  1 prayagupd  NA\Domain Users  494 Mar  7  2019 com.code42.menubar.plist
-rw-r--r--@ 1 prayagupd  NA\Domain Users  812 Feb 17 17:31 com.google.keystone.agent.plist
-rw-r--r--@ 1 prayagupd  NA\Domain Users  918 Feb 17 17:31 com.google.keystone.xpcservice.plist
-rw-r--r--  1 prayagupd  NA\Domain Users  524 Dec  5  2017 com.skype.skype.shareagent.plist

com.2313585054741982361.8750939818.plist looked suspicious and tried removing it and related Application Support link but does make any difference. Its content is

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>Label</key>
        <string>com.2313585054741982361.8750939818</string>
        <key>ProgramArguments</key>
        <array>
            <string>/Users/prayagupd/Library/Application Support/com.4884030244826106462/12888126840620735487</string>
            <string>D066FFCB-6A22-4C60-A8BD-42C577B51B1A</string>
            <string>FE700AF0-117A-40A9-8CDA-8EC25B44007B</string>
        </array>
        <key>RunAtLoad</key>
        <true />
        <key>StartInterval</key>
        <integer>10800</integer>
    </dict>
</plist>

And extensions I have are,

λ ls -l /Users/a1353612/Library/Application\ Support/Google/Chrome/Default/Extensions
total 0
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 aapocclcgogkmnckokdopfmhonfmgoek
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 aohghmighlieiainnegkcijnfilokake
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 apdfllckaahabafndbhieahigkjlhalf
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 blpcfgokakmgnkcojhhkbfbldkacnbeo
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 felcaaldnbdncclmgdcncolpebgiejap
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 ghbmnnjooekpmoecnnnilnnbdlolhkhi
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 nmmhkkegccagdldgiimedpiccmgmieda
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 pjkljhegncpnkpknbcohdijeoejaedia
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 pkedcjkdefgpdelpbcmbmeomcjbeemfm

It also does not make any effect after removing the Extensions folder.

Also tried updating google policies using terminal but can run delete command, as recommended at https://support.google.com/chrome/thread/9267779?hl=en

defaults write com.google.Chrome HomepageIsNewTabPage -bool false
defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"
defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL
2020-02-17 22:52:03.470 defaults[6456:41690] 
Domain (com.google.Chrome) not found.
Defaults have not been changed.

λ defaults delete com.google.Chrome DefaultSearchProviderNewTabURL
2020-02-17 22:52:16.409 defaults[6468:41815] 
Domain (com.google.Chrome) not found.
Defaults have not been changed.

λ defaults delete com.google.Chrome DefaultSearchProviderName
2020-02-17 22:52:21.361 defaults[6472:41852] 
Domain (com.google.Chrome) not found.
Defaults have not been changed.

I don't have any "paid virus remove softwares". And I see the the malware is only on chrome but not on safari.

How can I manually remove the malware from my machine?

Answer 1

Ok, so this is how I removed the malware.

1) sudo rm -rf /Library/LaunchDaemons/com.ElementarySignalSearchDaemon.plist

the content of plist was,

cat  /Library/LaunchDaemons/com.ElementarySignalSearchDaemon.plist 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>Label</key>
        <string>com.ElementarySignalSearchDaemon</string>
        <key>ProgramArguments</key>
        <array>
            <string>/Library/Application Support/com.ElementarySignalSearchDaemon/ElementarySignalSearch</string>
            <string>r</string>
        </array>
        <key>RunAtLoad</key>
        <true />
        <key>StartInterval</key>
        <integer>14400</integer>
    </dict>
</plist>

2) sudo rm -rf /Library/Application\ Support/com.ElementarySignalSearchDaemon/

3) restarting the chrome did not work, so edited the plist file and removed the occurrence of links in that file,

This is because chrome://policy had Mandatory level.

sudo vi /Library/Managed\ Preferences/prayagupd/com.google.Chrome.plist 

4) remove suspicious profiles,