Malware Removal

Steps 0-2 can and should be done on a booted testing drive/machine, not booted into the customers OS. (Preferably performed with the customer machine in target mode/share disk mode). It can still be done in the customers OS if necessary, but some programs may be more stubborn to remove. Steps 3-6 should be done in the customers OS.
If you suspect malware is running when the user logs in you can start the computer in safe mode to disable auto launch programs. Applications and executables that load from LaunchAgents and LaunchDaemon plist files will be disabled.
Malware can be installed to the system, root user, a user account, as an application or within a browser. There may be more variations such as profiles installed on the user account, or chrome being "managed by an organization." The Library folders are often the first locations to look at because they hold OS and application files used to run programs. 
Library/LaunchAgents and Library/LaunchAgents, either system or user-specific, will hold a plist file pointing to an executable or program that launches at user login. Most programs rely on this to start services, such as Microsoft's background AutoUpdater, Spotify, etc. You can preview or open in TextEdit one of these plist files and determine where the program resides. Using best judgement, either by the naming scheme: com.microsoft.xxx.plist or com.xjffiyc.plist looking suspicious, or the location of the program written in the plist file, you can remove these at your discretion though some programs may break until these are restored. Microsoft Office's background processes complain and do not restore if deleted.
Most executable malware - programs that run on the computer as applications do, are located within Library/Application Support. Having "Show Hidden Files" enabled to see (dot). files and folders can sometimes reveal malware that is hiding as .xjffiyc. Executables should be located within their own folder and will have a black terminal preview image. Names that are unfamiliar can be noted as suspicious but shouldn't be removed by default. Malware often has a suspiciously vague name or some form of identifier that looks different from stock Application Support folder names, and/or executable names.
In most cases executable malware is installed to the user library /Users/<current user>/Library but can be installed to the system's editable library: /Library. The system's non-writable library of /System/Library is generally unaffected unless System Integrity Protection has been disabled, or if it is an older operating system. The root user, seldom affected, has a folder of /private/var/root, with it's own Library folder, which can be checked manually if malware persists after re-login/reboot.
Browsers are the most commonly affected items. Safari is usually safer because it's limited by Apple, in comparison to Chrome or Firefox. As a general checklist: extensions, plugins, startup pages, auto-complete search engines, browser-specific notifications, search history, and proxies, are good settings to check for each browser. Malware programs such as ClamXAV or Malwarebytes typically do not catch browser-specific malware. Extensions usually have a Chrome Web Store link which can be investigated to compare your suspicion to relative downloads, reviews, and ratings. Browsers that support different profiles may require you to check multiple profiles for all of these settings, as malicious settings may be specific to one profile. 
== Step 0: (optional) Use ClamXAV to speed things up a bit. ==
===Install ClamXAV from official website===
*https://www.clamxav.com
**Follow the instructions to add necessary items to security settings, making sure to allow the several entries.
**The program will want to restart a few times during this process, proceed.
*Select Macintosh HD under "drives" in the left-hand pane then click "Scan now"
**Make sure to allow access to specific library/path popups that happen on newer systems while the scan runs
**The scan can take upwards of several hours for disks with more than 300-500gb of data.
**During the scan, you can choose to quarantine or delete the detected files
**At the end of the scan, it's suggested to open the report view and screenshot/take a photo for client purposes.
==Step 1: Clear Malicious Apps==
===Applications (Root)===
*Check for and remove anything weird
**Install Mac
**Webtools
**MacKeeper
**Tune My Mac
**Clean My Mac
===Applications (User)===
*Navigate through Macintosh HD/Users/(user name)/Applications
**Check for and remove anything weird. Remove Chromium and Opera if the customer does not know what those are.
**Delete any MacCleaner type applications
===Shared (User)===
*Navigate through Macintosh HD/Users/Shared
**Check for and remove anything weird. The only typical folders seen here are Adobe and audio libraries.
==Step 2: Clear Directory Remnants==
Finder (If on Sierra or newer use CMD+Shift+Dot to show hidden files, Does not work on El Cap or lower.)
===Library (Root)===
*Internet Plug-Ins
**Do NOT remove these
***Default browser.plugin
***nslQTScriptablePlugin.xpt
**Use best judgment for the rest
*Launch Agents
**Delete all except for Office and music programs. If there are questionable items, talk to the customer. This will only remove them from startup and will not break most programs.
*Launch Daemons
**Delete all except for Office and music programs. If there are questionable items, talk to the customer. This will only remove them from startup and will not break most programs.
*Startup
*Occassionally you will find additional remnants in Application Support files.  Delete any remnants associated with the files you removed but proceed with caution!  
===User Library===
*Note: to access hold option/alt key while under “GO” menu of finder if running newer OS;
Otherwise, navigate through Macintosh HD/Users/(user name)/Library
*Internet plug-ins
**If there are any here they are probably bad
***Use best judgement
*Launch Agents
**Delete all except for Office and music programs. If there are questionable items, talk to the customer. This will only remove them from startup and will not break most programs.
*Launch Daemons
**Delete all except for Office and music programs. If there are questionable items, talk to the customer. This will only remove them from startup and will not break most programs.
*Application Support - Same as library files above.
*Startup
==Step 3: Check Login Items==
*Under system pref->users->login items
**Delete anything that doesn’t need to run at start
==Step 4: Clear Browser(s)==
===Safari: Click Safari under menu. Then select preferences===
*Check home page
**Reset to “google.com” if wonky
**Check browser extensions/ add-ons
***Delete anything suspicious
*Check search engines
**Enable Quick Website Search -> "Manage Websites"
***Delete anything suspicious
===Firefox: Click Firefox finder menu. Then select preferences===
*Check home page
**Reset to “google.com” if wonky
**Check browser extensions
***Click on the button with 3 parallel horizontal bars
***Select add-ons
****Delete anything suspicious
*Check search engines
**Go to settings -> Search
***Search Shortcuts
****Delete anything supicious
===Chrome: Click Chrome from finder menu. Then select preferences===
*Under Appearance, make sure home page set to “google.com”
*Click Extensions (top left)
**Delete anything suspicious or anything non-google
**At bottom of page click “Get more extensions”
**See Cleaning Policies For Chrome for additional assistance if needed
*Check search engines
**Settings -> Search Engine -> Manage Search engines
***Investigate Search Engines and Site Search
=== All Browsers: Verify history when typing search ===
* If the malware was redirecting to a fake "search" website, the search history may be compromised.
** Scenario: customer searches by typing "search" in the address bar, but instead of google, anysearch appears from history.
** You might opt to wipe the search history, or search through history for keyword "search" which will help identify the malware
** If you see a suspicious website, you can then filter history by the website and remove all entries
==Step 5: Check System Preferences==
*Verify that no additional profiles have been added
*If a profile has been added, remove it directly from system preferences. If unable to remove from system preferences, refer to Google search.
*Check network settings to make sure there aren't any weird connections/devices/VPNs/proxies.
==Step 7: Check Notifications!==
*Some websites (legitimate and not) add annoying notifications. Often customers will click ok and add them without knowing. Clean notifications from browsers and/or talk to customers about turning off notifications in System Preferences for the browsers.
==Step 6: Empty Trash and TEST!==
*Reboot and recheck all browsers. They should have a legitimate home page and when using the search bar, should return a major search engine directly, like google.