Chrome Browser Malware Removal - Please help!

[mzhang59]

Hello Malwarebytes community,

A while ago I accidentally executed a .dmg file that installed some malware onto my macbook pro that has since severely interfered with Google chrome functionality. (I was trying to download an audio file from a site, and I sadly fell into the trap of "click here to download your file" since I wasn't paying very close attention.)

Here are the symptoms:

• Google Chrome will work fine for a bit, but then will restart and enter a clearly hijacked version of Chrome. Under this version, all my searches redirect to Bing. When I try to address this under settings, the Google Chrome settings page has been tinkered with and I cannot access any of the actual settings such as extensions or homepage settings.
• Even when Google Chrome is fully closed, every so often (~10-15 minutes) a Chrome window will open and brings me to a spam website.

Here is what I have tried so far:

• Using Malwarebytes. A full scan showed no detectable problems
• Uninstalling Chrome completely and reinstalling. I've done this at least 10 times.
• Followed the guide on Resetting Chrome by Malwarebytes.

After following these above steps, I've been able to get Chrome to a point where the Bing redirects seem to have stopped. However, the second symptom persists where Chrome continuously pops up and opens a spam site.

Any help would be greatly appreciated. Thanks in advance!

[alvarnell]

See the "Nuke Chrome" section of the pinned article at the top of this forum 

They are somewhat different than other guidance you appear to have followed and Mac oriented.

[treed]

11 hours ago, mzhang59 said:

Even when Google Chrome is fully closed, every so often (~10-15 minutes) a Chrome window will open and brings me to a spam website.

This is concerning, as this is something acting entirely outside of Chrome.

I would like to get more information about your system. Please follow the instructions at the following link to download our support tool, run it, and send me the resulting MWB_Info.zip file via a direct message here. You can send me a direct message by clicking my name or avatar at left and then clicking the Message button.

https://support.malwarebytes.com/hc/en-us/articles/360038519834-Upload-logs-to-your-ticket-using-the-Malwarebytes-Support-Tool-for-Mac

Once I have that information, I can investigate to see what's going on.

[mzhang59]

@alvarnell, thank you for that suggestion. I tried the "nuke chrome" section and deleted all files I could find relevant to Chrome, but unfortunately the problem persists.

 

@treed, I direct messaged you with the .zip file. Thanks for your help!

[treed]

I got the data you sent over, and you definitely have three files that are related to adware and that will periodically launch Chrome. Those three files were included with the data, so I was able to test them here and confirm that they are all detected by Malwarebytes. I can also confirm that the version of the Malwarebytes database you have installed is the latest one.

I notice that the scan history shows that the last scan was done in March. If you've done a scan more recently, that may suggest that the Malwarebytes software on your machine is not functioning properly. If you perform a scan now, and it doesn't detect anything, here is my recommendation:

1. Open the Malwarebytes app
2. Choose Uninstall from the Help menu within the app
3. Download the latest Malwarebytes installer from here:
   1. https://downloads.malwarebytes.com/file/mb-mac
4. Reinstall Malwarebytes using the newly downloaded installer
5. Be sure you're online, so the database can be updated, and start a scan
6. After these files are detected, restart your computer

Let me know if you run into any problems with any of that.

[mzhang59]

Hi Thomas,

I went ahead and followed your steps, and the issue seems to be resolved! I'm not sure why I didn't pick up those 3 files before, but I found them this time and removed them. Chrome is no longer opening new windows spontaneously (or at least, not yet, though it's been over 24 hours).

Thank you so much for your time and help.

Best,

Mark

[treed]

I'm glad to hear that!