macOS remove lkysearch virus from chrome I have lkysearch malware installed in chrome. I tried multiple ways to remove it even tried uninstalling and reinstalling chrome but no luck.

Chrome does not even allow removing the suspicious "search engine"."Resetting settings" does not work either.



I have my launch agents which looks like

λ ls -l ~/Library/LaunchAgents/
total 40
-rw-r--r--  1 prayagupd  NA\Domain Users  625 Jan 13 17:16 com.2313585054741982361.8750939818.plist
-rw-r--r--  1 prayagupd  NA\Domain Users  494 Mar  7  2019 com.code42.menubar.plist
-rw-r--r--@ 1 prayagupd  NA\Domain Users  812 Feb 17 17:31 com.google.keystone.agent.plist
-rw-r--r--@ 1 prayagupd  NA\Domain Users  918 Feb 17 17:31 com.google.keystone.xpcservice.plist
-rw-r--r--  1 prayagupd  NA\Domain Users  524 Dec  5  2017 com.skype.skype.shareagent.plist


com.2313585054741982361.8750939818.plist looked suspicious and tried removing it and related Application Support link but does make any difference. Its content is 

&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
&lt;plist version="1.0"&gt;
    &lt;dict&gt;
        &lt;key&gt;Label&lt;/key&gt;
        &lt;string&gt;com.2313585054741982361.8750939818&lt;/string&gt;
        &lt;key&gt;ProgramArguments&lt;/key&gt;
        &lt;array&gt;
            &lt;string&gt;/Users/prayagupd/Library/Application Support/com.4884030244826106462/12888126840620735487&lt;/string&gt;
            &lt;string&gt;D066FFCB-6A22-4C60-A8BD-42C577B51B1A&lt;/string&gt;
            &lt;string&gt;FE700AF0-117A-40A9-8CDA-8EC25B44007B&lt;/string&gt;
        &lt;/array&gt;
        &lt;key&gt;RunAtLoad&lt;/key&gt;
        &lt;true /&gt;
        &lt;key&gt;StartInterval&lt;/key&gt;
        &lt;integer&gt;10800&lt;/integer&gt;
    &lt;/dict&gt;
&lt;/plist&gt;


And extensions I have are, 

λ ls -l /Users/a1353612/Library/Application\ Support/Google/Chrome/Default/Extensions
total 0
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 aapocclcgogkmnckokdopfmhonfmgoek
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 aohghmighlieiainnegkcijnfilokake
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 apdfllckaahabafndbhieahigkjlhalf
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 blpcfgokakmgnkcojhhkbfbldkacnbeo
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 felcaaldnbdncclmgdcncolpebgiejap
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 ghbmnnjooekpmoecnnnilnnbdlolhkhi
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 nmmhkkegccagdldgiimedpiccmgmieda
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 pjkljhegncpnkpknbcohdijeoejaedia
drwx------@ 3 prayagupd  NA\Domain Users  96 Feb 17 17:31 pkedcjkdefgpdelpbcmbmeomcjbeemfm


It also does not make any effect after removing the Extensions folder.

Also tried updating google policies using terminal but can run delete command, as recommended at https://support.google.com/chrome/thread/9267779?hl=en

defaults write com.google.Chrome HomepageIsNewTabPage -bool false
defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"
defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL
2020-02-17 22:52:03.470 defaults[6456:41690] 
Domain (com.google.Chrome) not found.
Defaults have not been changed.

λ defaults delete com.google.Chrome DefaultSearchProviderNewTabURL
2020-02-17 22:52:16.409 defaults[6468:41815] 
Domain (com.google.Chrome) not found.
Defaults have not been changed.

λ defaults delete com.google.Chrome DefaultSearchProviderName
2020-02-17 22:52:21.361 defaults[6472:41852] 
Domain (com.google.Chrome) not found.
Defaults have not been changed.


I don't have any "paid virus remove softwares". And I see the the malware is only on chrome but not on safari.

How can I manually remove the malware from my machine?
Ok, so this is how I removed the malware.

1) sudo rm -rf /Library/LaunchDaemons/com.ElementarySignalSearchDaemon.plist 

the content of plist was, 

cat  /Library/LaunchDaemons/com.ElementarySignalSearchDaemon.plist 
&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
&lt;plist version="1.0"&gt;
    &lt;dict&gt;
        &lt;key&gt;Label&lt;/key&gt;
        &lt;string&gt;com.ElementarySignalSearchDaemon&lt;/string&gt;
        &lt;key&gt;ProgramArguments&lt;/key&gt;
        &lt;array&gt;
            &lt;string&gt;/Library/Application Support/com.ElementarySignalSearchDaemon/ElementarySignalSearch&lt;/string&gt;
            &lt;string&gt;r&lt;/string&gt;
        &lt;/array&gt;
        &lt;key&gt;RunAtLoad&lt;/key&gt;
        &lt;true /&gt;
        &lt;key&gt;StartInterval&lt;/key&gt;
        &lt;integer&gt;14400&lt;/integer&gt;
    &lt;/dict&gt;
&lt;/plist&gt;


2) sudo rm -rf /Library/Application\ Support/com.ElementarySignalSearchDaemon/

3) restarting the chrome did not work, so edited the plist file and removed the occurrence of links in that file,

This is because chrome://policy had Mandatory level.

sudo vi /Library/Managed\ Preferences/prayagupd/com.google.Chrome.plist 


4) remove suspicious profiles,