Source Reference: https://helpcenter.trendmicro.com/en-us/article/tmka-20846 on April 17, 2021
- Go to Chrome > Preferences... to open the Chrome settings window.
- Scroll down the settings page to find the Search engine section.
- Click Manage search engines.
- At the very right of the list, click ⋮ to delete any search engines you do not wish to have.
- Go back to the main settings page.
- If you need to change the startup homepage address, scroll to the bottom and find section On startup.
- Under the third option named Open a specific page or set of pages, Enter the homepage address as you prefer.
- Check and manage current Chrome extensions. Go to ⋮ > More Tools > Extensions.
The switch button at the bottom right of each extension name card indicates if the extension is currently turned on for use.
- Click Details > View in Chrome Web Store of every extension to verify their sources and developer profiles.
If changes are not saved after restarting your browser, follow the next step.
Check System Login Items
If your browser settings get modified every time you restart your browser, the browser hijacker may not only be in your browser, but somewhere in your Mac.
- Go to System Preferences > Users & Groups.
- Click Login Items to view the list of programs that automatically open when you log in.
- Click the - sign to remove any items you do not want to start at login.
If your browser setting changes were not saved, a malware may have been installed to modify your settings every time your Mac restarts.
Check all recently modified applications
In System Information, you can view all applications including hidden ones that run in the background.
- Go to
> About This Mac.
- Click Overview, and then click System Report.
- Scroll down to expand the Software section, and then click Applications.
- Click on the column title Last Modified to sort applications by the latest date of modification.
- Find any recently active malware, then copy its location address.
- Go to the specific folder address to remove the malware using Spotlight.
Check for Suspicious Auto-Launch Files
This step takes you to the system folder where files that automatically launch at are stored. Auto-launch files from authorized developers usually have a formatted name that is easy to understand, like com.PROVIDER.XXX.plist.
- Open Spotlight.
- Enter any of the following paths:
/Library/LaunchAgents//Library/LaunchDaemons/~/Library/LaunchAgents/
- Remove suspicous Auto-Launch files.
The LaunchAgents folders (and their paired LaunchDaemons folder for managing service processes) are locations that contain scripts to automatically manage system processes.
Comments
0 comments
Article is closed for comments.