My Mum thought she was installing an update for Flash player which has turned out to be something called “Mycouponsmart”. She called me when she received a security alert for allowing this software to control Chrome, which she/I didn’t allow, but it seems at least part of it managed to change some settings or install something else before reaching that stage. Now her Chrome start page is set to a “search” page imitating the Google homepage, somebody in another country tried to access her Apple ID, and she also told me she occasionally notices her screen randomly flash black (similar to how it behaves when connecting a second display or starting a remote screen share).
I’ve changed her Google homepage setting back to it’s default but it keeps changing itself back. I found a few plist files in her library folder for Mycouponsmart as well as something called “secure Mac update” and “Souter” which I have also deleted, but I’m worried something is still on her computer. What other places can I look for files or settings to remove? Normally I would want to format and reinstall macOS but we live in different states so it’s not really an option.
Thanks.
I’ve changed her Google homepage setting back to it’s default but it keeps changing itself back. I found a few plist files in her library folder for Mycouponsmart as well as something called “secure Mac update” and “Souter” which I have also deleted, but I’m worried something is still on her computer. What other places can I look for files or settings to remove? Normally I would want to format and reinstall macOS but we live in different states so it’s not really an option.
Thanks.
