How to remove Chrome Malware/Virus like GlobalLetterSearch From MAC


While surfing the internet you might have downloaded suspicious files which can install virus/ spam / malware in your system. Once these virus have access to your Macbook (macOS Mojave/ Catalina) they may create a lot or spamming, malfunctioning in your system. These malware/Virus can even steal your information.
One such common malware / virus in MAC is “GlobalSearchLetter”/” AdminPrefs“  malware which is really annoying as this virus will affect your Google Chrome setting and will change default search engine to its own version. Commonly these malware will cause Yahoo controlling search engine issue and will in the Chrome setting it will look like : search28374278-a.akamaihd.net



 Changes made by this malware in Chrome/Mac can’t be changed from Chrome Setting meaning you can’t update/change the default search engine on Chrome settings. You might even see error message in Chrome setting “ERR_BLOCKED_BY_ADMINISTRATOR"

Please read below if you are can't change my default search engine in chrome

Why I am not able to change Default search engine on Google Chrome:



The reason is malware like GlobalSearchLetter/ AdminPref will make system level changes in your mac. They won’t just get directly installed in your mac but gets their place in system files and change Chrome setting from by creating Profiles in Mac Setting which eventually changes the Chrome settings.

Recommendation: Turn on Firewall Setting
As these malware like GlobalSearchLetter cause internet to steal information from your MAC. To avoid such issues you should always turn ON the firewall from Mac Settings. This will block access of unknown apps to network.



What to do if I am unable to change default Search Engine in Chrome


This is more like a workaround but is a quick fix. Simply open System Preferences (Setting)  in your Mac and scroll down and look for Profile icon. Click on this you can see All the profiles in your Mac, Delete the suspicious Profile which contains details like  Chrome Setting, default search Engine,


1.      From Mac->System Preferences->. Click Profiles.
2.   The list will include an item “AdminPrefs“ Or check Name of the profile and note its name  we will use it below to permanently remove this malware from Mac, it will look like AdminPrefs or GlobalSearchLetter etc.
3.   Select this and click the remove “–” button in the lower left corner.

But this is just a workaround and after some time the issue may reappearGo to System Preferences.  For a permanent fix please go through following example.


How to remove Google Chrome Virus/Malware GlobalSearchLetter permanently:



To Remove the Chrome malware Global search letter please follow below steps:
Remove the Chrome malware from Starting Apps
1.    Remove Global Search letter/ Virus from startup  daemons.
2.   To do that Go to Finder-> Under Go-> Open Library (press cmd if you don’t see it in first place)

3.   This will open the library folder. Now open ->Launch Daemon/ Launch Agents


4.    Search for the .plist file for Global Search letter like com.GlobalLetterSearch.plist or AdminPref.plist

5.    Open this file, here you can see where this file is actually saved.
/Users/xxxxxxxxx/Library/Application Support/com.GlobalLetterSearch/GlobalLetterSearch
6.   Delete the .plist file first and executable folder from Application Support/com.GlobalLetterSearch/GlobalLetterSearch
7.    This will remove the malware .app file from your mac.

How to delete Delete Malware from mac using Terminal:

If you are still facing any issues do a global search in your mac for the Virus:

1.    Make sure to give full Disk Access to terminal. Go to System Preferences-> Security and Privacy

2.   Restart Terminal in Mac and type command
sudo find / -iname *GlobalLetterSearch*
This will display all the places where this file is.
3.   You should see result like below
Library/Application Support/com.GlobalLetterSearchDaemon



/Library/Application Support/com.GlobalLetterSearchDaemon/GlobalLetterSearch
            /Library/LaunchDaemons/com.GlobalLetterSearchDaemon.plist

 /Library/LaunchDaemons/com.GlobalLetterSearchP.plist
4.   Delete all folder /files in Application Support related to the virus.


Hope this helped to fix the malware issue in Chrome and MAC system. Please let us know in comment section.


Comments