I am working on a computer (Windows 7 Home Premium x64) that was hit with a number of viruses. I've cleaned it up (Malwarebytes, SuperAntiSpyware, TDSSKiller, Housecall, Hitman) but am stuck on one part of it.
In Google Chrome (45.0.2454.85 m), the default search engine is set as SafeSearch (URL includes safesear.ch) and I've been unable to change that. When I go into Settings (in Chrome) to change it, it is listed as "This setting is enforced by the administrator" and won't let me change it.
Some of what I have done is:
Uninstall any programs that seemed "suspicious". SafeSearch was not in the list.
Removed Extensions that weren't familiar to me. All that are left are Google Docs and other Google extensions.
Looked at the properties of the icon to run Chrome, nothing odd there.
Looked in the registry for HKCU and HKLM\software\policies\Google\Chrome. It doesn't exist (...\Chrome didn't exist) on this computer or on any of three other computers (Windows 7, 8, and 10) on which I've checked. From what I've read, these keys are no longer used by Chrome.
I was going to run gpedit.msc, but it doesn't exist on this computer (Home version). I've seen info about how to install it but don't intend to go down that path (license issues as well as whether or not it actually works).
Searched the registry for safesea and deleted everything that references it. There weren't any keys that I'd relate to Chrome that contained that.
Created a new Windows user; same issue.
Uninstalled Chrome, removed the folder for it in AppData, reinstalled it.
Browsed to chrome://policy where there are several of policies relevant to this problem. All have "Applies to" set to "Machine" and "Level" is "Mandatory". I don't see how to change them there.
Searched the computer for files containing "safesea" in the name but didn't find any.
How do I get around the "... enforced by the administrator" message? Where does Chrome keep this information.