Chrome browser hijacked by "Search Encrypt" on MBP running OSX 10.10

[PastorJGP]

My wife's  MacBook Pro (Mid 2012) running Yosemite (10.10.5) had its Chrome browser hijacked by "Search Encrypt" 3 days ago.  I spent the evening following online recommendations:

1) removing the offending extension or app - NONE FOUND

2) within Chrome "Restore settings to their original defaults" - DIDN'T WORK

3) Remove Chrome and various files & pref's from Library;  

    3A) Downloaded and ran Malwarebytes - Didn't find anything

    3B)  and then download and do fresh install of Chrome.  - This worked - UNTIL she re-synced bookmarks, etc from her Google account.  Chrome was immediately re-hijacked as before.

4)  For now, I've re-deleted Chrome,  and she's using Safari, though it is greatly impeding her normal work flow in her school classroom.

 

SO...  I need help!  I assume that Search Encrypt has hidden something in what's synced to her Google account, and it may be synced into her Android phone also, though she hasn't mentioned any problems there yet.  

 

Any recommendations would be appreciated!

 

[Massimiliano]

Try to follow step step this post.

 

[PastorJGP]

Thanks MAXBAR!, I'll try that when I can later today.

[alvarnell]

Actually, it looks like you've done almost everything listed in How to remove WeKnow malware (and others) and it's seems clear it's related to re-syncing which almost always means that the  issue is coming from another computer/device with the same account. My guess would be the same as yours, the Android.

Still worth making sure you've done everything covered in that other article, but the phone could still be the culprit without showing the same systems since the OS and browsers are different.

[PastorJGP]

Thanks for the input, Alvarnell.  I haven't gotten to do anything on my wife's MBP yet, except to recheck that there was no Profiles icon in System Preferences, hence no malicious profiles.  

Since google stores everything from Chrome sync in its cloud, I doubt that somehow finding and deleting something on the Android will save the day.  But I would welcome any recommendations about how to isolate whatever might be coming back in a sync from Google.  My wife would be very disappointed if we have to delete all her bookmarks.

Anybody out there have ideas on this??

 

[alvarnell]

Here are some thoughts on that topic from the Windows Forum: 

 

[PastorJGP]

Ok, Alvarnell, that looks promising.  It may be a bit, but I'll re-post after trying that.  Thanks!