Here are screenshots showing what the two bad profiles looked like: Then I selected each of them and clicked on the minus sign to remove each one. This Malware had just created two new profiles - one each that modified Safari and Chrome, which you can see if you scroll down to the "DETAILS" section). Here are what the fake profiles looked liked on my laptop, when I opened System Preferences and then Profiles (Normally the Profiles icon is not even listed in System Preferences on my laptop. Be sure to also follow the link in this post to remove fake profiles that are installed, as well.
I then followed the link in Alvarnell's post above, which led to a post in this forum by Treed entitled "How to remove WeKnow malware (and others)". It didn't fix the problem with the hijacked browsers, but I still think they were good measures to take. I entered the six lines into Terminal as suggested by the original poster (tacoma). Thanks a bunch to you guys here for the good advice! I then searched a bunch and eventually found this thread. After restarting though, Safari and Chrome were both still hijacked. It found some bad files that it quarantined that were part of the MyShopcoupon mess, and then required a restart.
In Chrome, it was as shown in the original post - where Google is normally written on the google homepage, instead the word "search" appeared with the letters in Google colors, and with a button for "Smart Search" below it. Then when I opened up Chrome and Safari, they were both taken over by new home pages and weird search engines.
Smart search removal install#
Since I didn't check the Custom Install options, though, my first clue was only when the installer opened a Terminal script window while the installation was in progress.
Smart search removal mac#
It was installing things called MyShopcoupon, WeKnow, and Mac Cleanup Pro: If I had stopped to check the Custom Installation options of this fake Adobe Flash Player, I would have noticed something was wrong. I am attaching some screenshots here that are not in the above posts, so that if someone else is trying to fix their computer, they will know they are on the right track. I have a cold and mistakenly installed a fake Adobe Flash Player (something I normally would never have done.) on my MacBook Air.