I have lkysearch malware installed in chrome. I tried multiple ways to remove it even tried uninstalling and reinstalling chrome but no luck.
Chrome does not even allow removing the suspicious "search engine"."Resetting settings"
does not work either.
I have my launch agents which looks like
λ ls -l ~/Library/LaunchAgents/
total 40
-rw-r--r-- 1 prayagupd NA\Domain Users 625 Jan 13 17:16 com.2313585054741982361.8750939818.plist
-rw-r--r-- 1 prayagupd NA\Domain Users 494 Mar 7 2019 com.code42.menubar.plist
-rw-r--r--@ 1 prayagupd NA\Domain Users 812 Feb 17 17:31 com.google.keystone.agent.plist
-rw-r--r--@ 1 prayagupd NA\Domain Users 918 Feb 17 17:31 com.google.keystone.xpcservice.plist
-rw-r--r-- 1 prayagupd NA\Domain Users 524 Dec 5 2017 com.skype.skype.shareagent.plist
com.2313585054741982361.8750939818.plist
looked suspicious and tried removing it and related Application Support
link but does make any difference. Its content is
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.2313585054741982361.8750939818</string>
<key>ProgramArguments</key>
<array>
<string>/Users/prayagupd/Library/Application Support/com.4884030244826106462/12888126840620735487</string>
<string>D066FFCB-6A22-4C60-A8BD-42C577B51B1A</string>
<string>FE700AF0-117A-40A9-8CDA-8EC25B44007B</string>
</array>
<key>RunAtLoad</key>
<true />
<key>StartInterval</key>
<integer>10800</integer>
</dict>
</plist>
And extensions I have are,
λ ls -l /Users/a1353612/Library/Application\ Support/Google/Chrome/Default/Extensions
total 0
drwx------@ 3 prayagupd NA\Domain Users 96 Feb 17 17:31 aapocclcgogkmnckokdopfmhonfmgoek
drwx------@ 3 prayagupd NA\Domain Users 96 Feb 17 17:31 aohghmighlieiainnegkcijnfilokake
drwx------@ 3 prayagupd NA\Domain Users 96 Feb 17 17:31 apdfllckaahabafndbhieahigkjlhalf
drwx------@ 3 prayagupd NA\Domain Users 96 Feb 17 17:31 blpcfgokakmgnkcojhhkbfbldkacnbeo
drwx------@ 3 prayagupd NA\Domain Users 96 Feb 17 17:31 felcaaldnbdncclmgdcncolpebgiejap
drwx------@ 3 prayagupd NA\Domain Users 96 Feb 17 17:31 ghbmnnjooekpmoecnnnilnnbdlolhkhi
drwx------@ 3 prayagupd NA\Domain Users 96 Feb 17 17:31 nmmhkkegccagdldgiimedpiccmgmieda
drwx------@ 3 prayagupd NA\Domain Users 96 Feb 17 17:31 pjkljhegncpnkpknbcohdijeoejaedia
drwx------@ 3 prayagupd NA\Domain Users 96 Feb 17 17:31 pkedcjkdefgpdelpbcmbmeomcjbeemfm
It also does not make any effect after removing the Extensions
folder.
Also tried updating google policies using terminal but can run delete command, as recommended at https://support.google.com/chrome/thread/9267779?hl=en
defaults write com.google.Chrome HomepageIsNewTabPage -bool false
defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"
defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"
defaults delete com.google.Chrome DefaultSearchProviderSearchURL
2020-02-17 22:52:03.470 defaults[6456:41690]
Domain (com.google.Chrome) not found.
Defaults have not been changed.
λ defaults delete com.google.Chrome DefaultSearchProviderNewTabURL
2020-02-17 22:52:16.409 defaults[6468:41815]
Domain (com.google.Chrome) not found.
Defaults have not been changed.
λ defaults delete com.google.Chrome DefaultSearchProviderName
2020-02-17 22:52:21.361 defaults[6472:41852]
Domain (com.google.Chrome) not found.
Defaults have not been changed.
I don't have any "paid virus remove softwares". And I see the the malware is only on chrome but not on safari.
How can I manually remove the malware from my machine?