Cleaning Adware from CNET downloads

I happened to download a program on CNET and installed it on my Mac OS X. When I started Google Chrome or opened a new tab I saw the annoying “chrome-extension://icdlfehblmklkikfigmjhbmmpmkmpooj/newtab.html” in the URL.
CNET Malware

This adware also changed the home page and search engine to Yahoo! and additionally installed the following extensions:

  1. Amazon Shopping Assistant.safariextz
  2. Ebay Shopping Assistant.safariextz
  3. ErrorAssistant.crx
  4. Searchme.safariextz
  5. SlickSavings.safariextz
  6. coupons.crx
  7. coupons@mybrowserbar.com.xpi
  8. saamazon.crx
  9. saamazon@mybrowserbar.com.xpi
  10. saebay.crx
  11. saebay@mybrowserbar.com.xpi
  12. searchme@mybrowserbar.com.xpi

In this location:

/Users/<username>/Library/Application Support/Spigot/

I also found the following files:

  1. hbcennhacfaagdopikcegfcobcadeocj.json
  2. icdlfehblmklkikfigmjhbmmpmkmpooj.json
  3. mhkaekfpcppmmioggniknbnbdbcigpkk.json
  4. pfndaklgolladniicklehhancnlgocpp.json

Were added to this location:

/Users/<username>/Library/Application Support/Google/Chrome/External Extensions

To restore Google Chrome back to the way it was, just remove all the above files and the ‘Spigot‘ directory.

That’s it!