GSearch.live (GSearch) is a Mac OS X browser hijacker. GSearch.live browser hijacker changes the search engine and homepage of Safari and Google Chrome on Mac OSX.
GSearch.live is regularly offered on the internet as a convenient homepage. However, in reality, this is a browser hijacker that collects all kinds of data from your browser.
The data collected by GSearch.live is used for advertising purposes. The data is sold to advertising networks. Because GSearch.live collects data from your browser, GSearch.live is also classified as a malware program for Mac.
GSearch browser extension will install itself in the Google Chrome and Safari browser only on Mac OS X. Neither Apple of any browser developer yet notices this browser hijacker as unwanted.
If your home page has changed to GSearch.live and the GSearch browser extension has been installed, remove the GSearch extension as soon as possible using this GSearch removal instruction.
Please follow all steps in the correct order!
Step 1 – Remove LiveInfoUpdates folder
This is an important step!
Open Finder, and open the applications folder on your Mac, find a folder with the name “LiveInfoUpdates” and remove it. Next, click on “Date modified” column and sort applications by the installation date. Remove any recently installed applications or unknown applications. You can also use Anti-malware to identify unknown applications.
Step 2 – Remove unwanted profile from your Mac
First, you need to remove unwanted profiles from your Mac, follow the steps.
Click the Apple symbol () in the top left corner on Mac OS X, click on “Preferences” in the menu bar, and select “Profiles”. If profiles don’t exist you do not have any malicious profile installed on your Mac.
Select the “AdminPrefs“, “Chrome Profile“, or “Safari profile” and delete it.
Step 3 – Uninstall “GSearch extension 1.0” from Safari for Mac
Open the Safari browser. In the left top corner click on Safari.
In the Safari menu click on Preferences. Open the “Extensions” tab.
Click on the “GSearch extension 1.0” extension and click Uninstall. Make sure to check any installed Safari extension, and click on “Uninstall”.
Step 4 – Uninstall “GSearch extension 1.0” from Google Chrome for Mac
Open the Google Chrome browser on Mac. In the address bar type: chrome://extensions/.
Remove “GSearch extension 1.0” extension from Google Chrome.
Some malware programs create policy’s to prevent users from resetting browser configurations such as the web browser’s homepage and the search engine. If you cannot change your homepage or search engine in the Google Chrome browser you might want to remove the policies created by the malware to restore the browser’s configurations.
Next, you need to check if there are policies created for Google Chrome. Open the Chrome browser, in the address bar type: chrome://policy.
If there are policies loaded into the Chrome browser, follow the steps below to remove the policies.
Download Chrome Policy Remover for Mac. If you cannot open the policy remover tool. Click on the Apple icon in the top left corner. Click on System preferences. Click on Privacy and Security. Click the lock icon, enter your password and click on “Open Anyway”. Make sure to bookmark this page in a text file, Google chrome is shutdown!
Go back to the search engine settings in Google Chrome in the address bar type: chrome://settings/searchEngines find the “GSearch (default)” and click on the three dots on the right and click Remove.
Continue with the next step.
On the Applications folder on your Mac, go to Utilities and Open the Terminal application.
Enter each line, do not copy all lines, copy and paste line by line in the Terminal application, press ENTER after each command.
defaults write com.google.Chrome HomepageIsNewTabPage -bool false defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/" defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/" defaults delete com.google.Chrome DefaultSearchProviderSearchURL defaults delete com.google.Chrome DefaultSearchProviderNewTabURL defaults delete com.google.Chrome DefaultSearchProviderName defaults delete com.google.Chrome ExtensionInstallSources
Step 5 – Remove “Managed by your Organization” from Google Chrome on Mac
Some adware and malware on Mac force the browser’s homepage and search engine using a setting known as “Managed by your organization”. If you see the browser extension or settings in Google chrome is forced using the “Managed by your organization” setting, follow the steps below.
Make sure to bookmark this webpage and open it in another web browser, you need to Quit Google Chrome.
On the Applications folder on your Mac, go to Utilities and Open the Terminal application.
Enter each line, do not copy all lines, copy and paste line by line in the Terminal application, press ENTER after each command.
defaults write com.google.Chrome BrowserSignin defaults write com.google.Chrome DefaultSearchProviderEnabled defaults write com.google.Chrome DefaultSearchProviderKeyword defaults delete com.google.Chrome HomePageIsNewTabPage defaults delete com.google.Chrome HomePageLocation defaults delete com.google.Chrome ImportSearchEngine defaults delete com.google.Chrome NewTabPageLocation defaults delete com.google.Chrome ShowHomeButton defaults delete com.google.Chrome SyncDisabled
Restart Google Chrome when you are done.
Step 6 – Reset Sync on Google Chrome
In the address bar type: https://chrome.google.com/sync and click the Reset Sync button.
Step 7 – Reset Google Chrome settings
In the address bar type: chrome://settings/resetProfileSettings and click Reset.
Step 8 – Remove GSearch.live adware with Anti-malware
- Scan for malware.
- Then goto Optimization > Launch Agents and remove any launch agent you do not know or trust, it’s up to you to identify the agents as they vary by name.
- Then goto uninstaller, remove any unknown recently installed application.
Download Anti-malware and learn how to remove Mac malware with Anti-malware.
Step 9 – Remove GSearch.live adware program with Malwarebytes for Mac
In this optional step for Mac, you need to remove adware that is accountable for the GSearch.live malware using Malwarebytes for Mac. Malwarebytes is the most reliable software to remove unwanted programs, adware, and browser hijacker from your Mac. Malwarebytes is free to detect and remove malware on your Mac computer.
Download Malwarebytes (Mac OS X)
You can find the Malwarebytes installation file in the Downloads folder on your Mac. Double click the installation file to begin.
Follow instructions in the Malwarebytes installation file. Click the Get Started button.
Where are you installing Malwarebytes on a personal computer or on a work computer? Make your choice by clicking any of the buttons.
Make your choice to either use the Free version of Malwarebytes or the Premium version. The premium versions include protection against ransomware and offer real-time protection against malware.
Both Malwarebytes free and premium are able to detect and remove malware from your Mac.
Malwarebytes needs “Full Disk Access” permission in Mac OS X to scan your harddisk for malware. Click Open Preferences.
In the left panel click on “Full Disk Access”. Check the Malwarebytes Protection and close the settings.
Go back to Malwarebytes and click the Scan button to begin scanning your Mac for malware.
Click on the Quarantine button to delete the found malware.
Reboot your Mac to complete the malware removal process.
