Cannot find/remove browser hijackers

Solution 1:

In case anyone else gets infected by this, here's what I ultimately discovered:

The virus had installed a local web proxy, and a background service that was constantly monitoring the system's proxy settings and "restoring" them to point to itself. I discovered this when I noticed that Safari was throwing SSL warnings for everything, and that YouTube was returning empty responses and proxy errors trying to watch videos.

The proxy also appears to have been preventing Chrome's sync from working, and preventing me from activating several anti-virus programs that require online activation.

I was able to find it using lsof to see what was listening on the port that kept setting itself up as the local proxy. It had installed a mono application using the Titanium web proxy NuGet package, into /usr/local/srcsrv.

Once I killed that, the behavior of the web browser returned to normal except for the "New Tab" page in Google still pointing to G-Search.pro. I haven't yet tried to delete and reinstall Chrome a second time, but I did add several domains to /etc/hosts to prevent them from phoning home.