After a Mac has been intruded upon with some rogue or unwanted software, what usually happens is that web browsers are taken over. Usually, running MalwareBytes and performing follow-up steps will fix this situation (see our previous post).
But if you use Google Chrome, you may still have trouble. Particularly insidious adware will prevent you from changing the default search engine back to Google, even after the software itself has been removed. Sometimes it will appear to have changed, but nothing actually happens. Here’s how to resolve that.
First, quit Chrome if it is running. Then Open Terminal.
type:
defaults read com.google.Chrome
What will be output is a list of “keys” followed by a list of “values”. You need to remove the keys which are making Chrome misbehave.
In particular, you want to get rid of any dubious-looking URL — if it’s not obvious what it is, you don’t want it. Each URL will have a corresponding key to its left, which here I’ll call UnwantedKeyName.
For each key with a corresponding questionable URL, type:
defaults delete com.google.Chrome UnwantedKeyName
When you’re done, once again type:
defaults read com.google.Chrome
What remains should all be fine — that is, there are no keys that contain unknown URL’s.
At this point, you may Quit Terminal, and re-open Chrome. Go to Preferences, and change your search engine to Google, which should now be unlocked.