Managed by your organization hijacker

[mrssevage]

Hi,

 

I have personal macbook air that has managed by your organisation hijacker on google chrome. I have tried every possible way to remove it but still no luck. Did you come across it and resolve it? Can you advise? User is a games and possibly downloaded something by accident when installing extension for a game. Last item installed was Discord.

Here is what i have done so far:

1. Checked profiles (there were no suspicious profiles just mail user profile)

2. I have checked installed programs and there are no suspicious programs that i can see

3. deleted chrome preference file

4. There is ExtensionInstallForcelist policy that I am not able to remove (How to remove it)

5. Reinstalled chrome

Thank you,

[h=2]M[/h]

Edited June 29, 2021 by mrssevage

[ThatBoringBloke]

Are you by any chance signed into Chrome with an organisation email address?

[mrssevage]

Hi,

 

No, I have reinstalled chrome as well.

[mrssevage]

Are you by any chance signed into Chrome with an organisation email address?

 

Here is what i have done so far:

1. Checked profiles (there were no suspicious profiles just mail user profile)

2. I have checked installed programs and there are no suspicious programs that i can see

3. deleted chrome preference file

4. There is ExtensionInstallForcelist policy that I am not able to remove (How to remove it)

5. Reinstalled chrome

[Koldov]

Not really up on Macs so hopefully someone will be along to chip in...

 

But, do you know if your Mac or indeed Chrome is 'managed' in any way, shape or form? I know you say it is a personal device but... all my teachers think their laptops are personal...

 

When a Google Chrome extension says that it's “Installed by Enterprise Policy,” “Installed by Your Administrator,” or “Managed by Your Organization,” all it means is that when the extension is installed, it was done so with elevated permissions and can't be removed in the standard way.

 

If not, here is some reading about the extension, maybe you can see how the policy is enforced on your machine:

 

https://macsecurity.net/view/492-extensioninstallforcelist-chrome-policy-mac

[mrssevage]

Not really up on Macs so hopefully someone will be along to chip in...

 

But, do you know if your Mac or indeed Chrome is 'managed' in any way, shape or form? I know you say it is a personal device but... all my teachers think their laptops are personal...

 

When a Google Chrome extension says that it's “Installed by Enterprise Policy,” “Installed by Your Administrator,” or “Managed by Your Organization,” all it means is that when the extension is installed, it was done so with elevated permissions and can't be removed in the standard way.

 

If not, here is some reading about the extension, maybe you can see how the policy is enforced on your machine:

 

https://macsecurity.net/view/492-extensioninstallforcelist-chrome-policy-mac

 

 

Hi,

 

Thank you for the link. I have seen this page but I am not that confident with mac myself specially when its not my own.

 

It is definitely personal laptop (Christmas gift).

 

I am lost with it

 

M

[tmoon-mint]

Do you know where the laptop was purchased from? Just wondering if it is possible that the company that sold it failed to release it from DEP and it is still enrolled in MDM. If you open system preferences and profiles is there anything in there relating to an MDM?

[mrssevage]

Do you know where the laptop was purchased from? Just wondering if it is possible that the company that sold it failed to release it from DEP and it is still enrolled in MDM. If you open system preferences and profiles is there anything in there relating to an MDM?

Hi,

 

No other profiles than user's and guest that is not active. This is very odd and absolutely drives me mad. No idea where they have purchased it from but I think it was brand new.

[Sonic007]

If all data is backed up have you tried re-installing MacOS?

[mrssevage]

If all data is backed up have you tried re-installing MacOS?

 

Well to be honest I was trying to avoid this. Only been given this today. Nothing is backed up at the moment. I will take it home and back it up and if I wont find any other solution I will have to do re install

[tg12]

Take a look in System Preferences on the Mac, you might see a section called Profiles on there, if so, click on it and see if there are any Profiles in place that could be enforcing Chrome to do this. If so, remove them (ordinary users are very unlikely to need profiles on a Mac)

[tg12]

Someone has also created a script that will remove these policies (make sure Chrome is completely closed before running) https://www.google.com/appserve/mkt/p/AFnwnKU65a9Qk779T1Zm9jJbvBr_Lv2gcNjgA7-zGqX4oYSdZOZpS5MAQOjddJmIOq_ViZG5W7vGeq4HeN3oD_V3WpCf3jT_nS57nd-v5lx6zpw9_7mqAMIp1S1UPocjt9uYjLQS8_8I-VLUTD1CiekJnz_PYISg3CSPhP6N7c4qQQ5W

 

The creator did mention to check for profiles before running this first too.

[mrssevage]

Take a look in System Preferences on the Mac, you might see a section called Profiles on there, if so, click on it and see if there are any Profiles in place that could be enforcing Chrome to do this. If so, remove them (ordinary users are very unlikely to need profiles on a Mac)

 

Yes you are right. There are no profiles at all. I was referring to an account sorry

[mrssevage]

Someone has also created a script that will remove these policies (make sure Chrome is completely closed before running) https://www.google.com/appserve/mkt/p/AFnwnKU65a9Qk779T1Zm9jJbvBr_Lv2gcNjgA7-zGqX4oYSdZOZpS5MAQOjddJmIOq_ViZG5W7vGeq4HeN3oD_V3WpCf3jT_nS57nd-v5lx6zpw9_7mqAMIp1S1UPocjt9uYjLQS8_8I-VLUTD1CiekJnz_PYISg3CSPhP6N7c4qQQ5W

 

The creator did mention to check for profiles before running this first too.

Thank you for this. I have tried this but it didn't work. Message I got was "this software needs to me updated. contact the developer". I did run it on my old mac and it worked so i think mac that i am working on is to new

[mrssevage]

So... I run this in terminal defaults delete com.google.Chrome plus policy name. It worked! Until i have restarted the mac that is.... Issue came back This must mean that whatever is causing this is installed on the mac but I have no idea how to find it. I will have start uninstalling programs one by one to see what the issue is unless someone has got other ideas.

[tg12]

I would suggest Malwarebytes and running a scan. We used it often when on the Genius Bar.

[mrssevage]

I would suggest Malwarebytes and running a scan. We used it often when on the Genius Bar.

 

Already done. Run Avast and Malwarebytes scans. Nothing came up

[mrssevage]

Could antivirus be doing it?

[tg12]

One thing I would also check, under System Preferences > Users, click the logon items for the user, see if there is anything on that list. If so, remove it with the minus button, log out and back in then try the command again to remove it in Terminal.

[tg12]

I would also check out folders like /Library/LaunchAgents, ~/Library/LaunchAgents, /Library/Application Support and /Library/LaunchDaemons for anything suspicious and remove them. If any malicious software is running to do this, it's likely to be in there.

[mrssevage]

One thing I would also check, under System Preferences > Users, click the logon items for the user, see if there is anything on that list. If so, remove it with the minus button, log out and back in then try the command again to remove it in Terminal.

 

Done that. no luck

 

- - - Updated - - -

 

I would also check out folders like /Library/LaunchAgents, ~/Library/LaunchAgents, /Library/Application Support and /Library/LaunchDaemons for anything suspicious and remove them. If any malicious software is running to do this, it's likely to be in there.

 

Will try this next. Thank you!

[JJonas]

Here is a guide. Step 6 onwards

 

and another guide

Edited July 1, 2021 by JJonas