I happened to download a program on CNET and installed it on my Mac OS X. When I started Google Chrome or opened a new tab I saw the annoying “chrome-extension://icdlfehblmklkikfigmjhbmmpmkmpooj/newtab.html” in the URL.
This adware also changed the home page and search engine to Yahoo! and additionally installed the following extensions:
- Amazon Shopping Assistant.safariextz
- Ebay Shopping Assistant.safariextz
- ErrorAssistant.crx
- Searchme.safariextz
- SlickSavings.safariextz
- coupons.crx
- coupons@mybrowserbar.com.xpi
- saamazon.crx
- saamazon@mybrowserbar.com.xpi
- saebay.crx
- saebay@mybrowserbar.com.xpi
- searchme@mybrowserbar.com.xpi
In this location:
/Users/<username>/Library/Application Support/Spigot/ |
I also found the following files:
- hbcennhacfaagdopikcegfcobcadeocj.json
- icdlfehblmklkikfigmjhbmmpmkmpooj.json
- mhkaekfpcppmmioggniknbnbdbcigpkk.json
- pfndaklgolladniicklehhancnlgocpp.json
Were added to this location:
/Users/<username>/Library/Application Support/Google/Chrome/External Extensions |
To restore Google Chrome back to the way it was, just remove all the above files and the ‘Spigot‘ directory.
That’s it!