mac os x virus: genio

January 18, 2013 I was hit with a Genio virus application that somehow got onto my Mac OS X 10.6.8 (MBP)

and installed itself into my login startup list.


This virus (we have to call it that as I did not ask for nor authorize it) must have been attached to

something else, though I am unsure how they did this. As a computer scientist and programmer,

I am extremely aware of downloading and running strange applications.


Perhaps the did this through a javascript snippet from a news organization?


It took me a good twenty minutes of concerted work to locate and remove all of the virus applications.

It even appeared that they had an Uninstall app, but I did not trust it. So I removed all I could find,

and proceeded with a few find(1) based searches of the disk to make very sure.


My listing here is done for two reasons: (1) to document that genio is

sending out virus (look up who to complain -- part of it is "orlaith.potter" --

this forum won't let me list it)

and (2) to ask the community for guidance in protecting

my Mac from further Genio (and other similar) intrusions.


I was able to remove the virus application from the /Applications folder, kill all the

Genio processes, and remove the startup commands they added in my login startup area.


However, any comments would be very appreciated.


Regards from me and my laptop.


--jpb


<Emails Edited By Host>

Posted on Jan 19, 2013 6:56 AM

Reply
65 replies

Jul 9, 2014 10:11 PM in response to thomas_r.

I ran Dr.Web on a brand new macbook pro that was un used in a store and it behaved normal, but once i installed genieo and ran it to trash those files Dr Web was working in the background slowing the system to a crawl hogging up all the memory, i shared screenshots here before.


So if you really where concerned about Genieo, apps that re install themselves or leave files or commands in the OS that never go away to intercept passwords, steal data etc etc why are you telling someone to go away if they showed you screen shots like those i did, why not gather all these apps and try to isolate the reasons for their behaviour? is someone here hiding something?

Jul 10, 2014 3:02 AM in response to capnb00b00

I ran Dr.Web on a brand new macbook pro that was un used in a store and it behaved normal, but once i installed genieo and ran it to trash those files Dr Web was working in the background slowing the system to a crawl hogging up all the memory


Okay. So Genieo does something to the system that negatively impacts Dr. Web Light's performance. Genieo does something to the system that negatively impacts Safari, Firefox and Chrome. Does that mean that Apple, Google and Mozilla are all in cahoots with Genieo, or that Genieo is a problem?


This is ridiculous and off-topic. You need to take your issues with Dr. Web Light to Dr. Web, or if you must discuss it here, to another topic.

Sep 11, 2014 4:24 AM in response to thomas_r.

I have been had this this annoying bug for sometime and had several goes at removing it without any real success but have recently loaded the new Avast (free) anti virus software and it picked it up immediately. It hasn't completely got rid of it because it is telling me several times a day that it has moved "MacOS:Genieo-K [pup]" into the chest. It least it's cleaning up the rubbish.

Sep 11, 2014 6:27 AM in response to SiriusStudio

Avast will not properly remove Genieo, and in fact, it installs its own adware as part of the avast! Online Security web browser extension. You should uninstall Avast immediately.


As for properly removing Genieo, that can be tricky. I have manual instructions in my Adware Removal Guide, but in all honesty, I don't recommend following those directions unless you really know what you're doing. There's the potential to crash your machine and render it unable to start up properly. A better approach would be to use my AdMedic program to automatically remove it.


(Fair disclosure: I may receive a form of compensation from links to my site and software, in the form of buttons allowing for donations. Donations are not required to use my site or software.)

Dec 2, 2014 3:27 PM in response to firstbasesoftware

I had Genio attach to a an illustration that was provided by "Just Answers.com" The app was not request yet installed on its own. No terms were attached to the app. I use "Google" as my default search engine. When conducting a search I was transferred to "Bing" a app I absolutely detest. I could not figure out why or how the app swathed because Google was check as my default search engine in Preferences. It took a call to support to fix the issue. So the lesson learned is one, don't use Just Answers.com and two, inform others about my experience.

Dec 17, 2014 3:38 PM in response to firstbasesoftware

I have had terrible experiences with Genio off and on for YEARS. It just turns up like a bad penny every so often. I just started a new job and BAM, Genio on the computer they gave me! I wanted to point out this company is an Israeli company that sold for $34 million this year. These two guys that created it got a payout for just the two of them for $20 million. The rest was in stock in the new company and payouts to their investors. Genio's main job is to mine your activity for info and sell that data to others. So if you have it, don't just let it stay on your computer. Get rid of it at all cost. Don't help these a-holes make another red cent!

Feb 21, 2015 4:06 AM in response to firstbasesoftware

OMG, has this been going on since 2013?! I only just found Geneio (in that spelling) on my iMac a couple of weeks ago, and in my (sorrowful) experience it's much more aggravating and devious that contributors to the discussion so far seem to recognize:


(1) it's worse than so-called adware, a) because it has never inserted any kind of ad on any of my devices, and, b) because it never showed its face at all until I introduced a NetGear extender into my local wi-fi network. Worse yet, it did make itself known, apparently, by hacking itself into the extender, from which it began inserting requests for passwords ⚠ every single time I tried to open a new app, whether on my iPhone, iPadAir, or MacBookPro — whether or not the respective apps were password-protected or not, and for that matter, 'allowed' the app to start irrespective of what I did, including swearing at it. This makes Geniero a PHISH, right?, and PHISHES is what MacKeeper identified it as.


(2) it's insidious in the extreme. MacKeeper detected and subsequently deleted six files on my iMac>user>library folder identified as phishes, as well as a Geneiro installer package lying in my download folder. I suppose I had somehow mistakenly downloaded that installer by accident, or else it snuck in some other manner, but I definitely did NOT ever operate the installer package by clicking on it and moving the resulting icon into my applications folder. Nor was there a Geneiro.app anywhere, though there was a Geneiro-uninstaller, I don't remember where — which I, like others, did not trust and deleted by hand. The evidence I offer for the assertion that the G-phish had hacked itself from my main computer into the NetGear extender is a) the fact that the latter did not behave as it was supposed to by creating a new extended local network with _EXT added on the end, but rather invented an entirely different _EXT network name which I was invited to join, and stupidly did — (this I have discussed with NetGear support and they have confirmed that the extender should not have done so), but also b) because SafeMac's AdwareMedic advised me that hacked extenders could very well be the locus of the problem, and c) because the problem disappeared once I had disconnected the extender and reconnected all my devices to my original local network.


(3) Worst of all, Geneio's insidiousness continues.

Feb 21, 2015 4:22 AM in response to tomfrombålsta

Actually, MacKeeper is much more insidious than Genieo ever will be. It will definitely do more harm than good and slow your computing experience in the process. Search the forum and see for yourself what others have experienced with it.


Genieo was founded in 2008, but the current adware infections started to show up in downloads near the end of 2012.


To understand why this happened and how to avoid such things in the future read John Galt's How to install adware.

Feb 21, 2015 4:45 AM in response to firstbasesoftware

OMG, has this been going on since 2013?! I only just found Geneio (in that spelling) on my iMac a couple of weeks ago, and in my (sorrowful) experience it's much more aggravating and devious that contributors to the discussion so far seem to recognize:


(1) it's worse than so-called adware, a) because Genieo has never inserted any kind of ad on any of my devices, and, b) because it never showed its face at all until I recently introduced a NetGear extender into my local wi-fi network. Worse yet, it did make itself known, apparently, by hacking itself into the extender, from which it began inserting requests for passwords ⚠ every single time I tried to open a new app, whether on my iPhone, iPadAir, or MacBookPro, though not on my iMac — whether or not the respective apps were password-protected or not, and for that matter, 'allowed' the app to start irrespective of what I did, including swearing at it. This makes Geniero a PHISH, right?, and PHISHES is what MacKeeper identified it as.


(2) it's insidious in the extreme. MacKeeper detected and subsequently deleted six files on my iMac>user>library folder identified as phishes, as well as a Geneiro installer package lying in my download folder. I suppose I had somehow mistakenly downloaded that installer by accident, or else it snuck in some other manner, but I definitely did NOT ever operate the installer package by clicking on it and moving the resulting icon into my applications folder. Nor was there a Geneiro.app anywhere, though there was a Geneiro-uninstaller, I don't remember where — which I, like others, did not trust and deleted by hand. The evidence I offer for the assertion that the G-phish had hacked itself from my main computer into the NetGear extender is a) the fact that the latter did not behave as it was supposed to by creating a new extended local network with _EXT added on the end, but rather invented an entirely different _EXT network name which I was invited to join, and stupidly did — (this I have discussed with NetGear support and they have confirmed that the extender should not have done so), but also b) because SafeMac's AdwareMedic advised me that hacked extenders could very well be the locus of the problem, and c) because the problem disappeared once I had disconnected the extender and reconnected all my devices to my original local network.


(3) Worst of all, Geneio's insidiousness continues: a) I find that the Genieo installation .dmg, which MacKeeper deleted yesterday, as re-duplicated itself and has once again placed itself in my download folder, from which it resists dragging to the trash, reduplicates itself again and again, and also resists, up to an extent, secure emptying of the trash! MacKeeper informed me, in a banner, that Genieo cannot be deleted because of a permissions problem (apparently it's read-only) but only quarantined, and iMac's finder (in Yosemite) went so far — yesterday but so far not today — as to identify the installer as a separate device, not on my computer but on equal footing with it. Needless to say, I resisted the temptation to click on that icon.


(4) Finally, it's mendacious. Though I have never to my recollection opened the website identified as 'Geneio — your newspaper style homepage' (though I suppose I may have done so, originally; maybe that's how the whole thing started), Safari's history menu routinely falsely lists that link as one which I have visited, just daring me, so to speak, to go there. (My iPhone 6's Safari history menu contains the same false listing).


I could add that I have been experiencing a serious problem with Word 2011 during the same period of time, though it could be unrelated. Word refuses to allow me to close about three files that I opened weeks ago, closing itself down instead and then re-opening with the same problem. Apple should be well aware of the problem by now since it's been reported umpteen times, but nothing seems to help.

Feb 21, 2015 5:18 AM in response to tomfrombålsta

Genieo does not infect wireless hardware. However, many Netgear routers have a long-standing, known vulnerability that can allow a remote attacker to take control of them. This has been happening a lot lately, and is undoubtedly what happened for you. If this Netgear device is new, I'd see if it can be returned and buy something else.


You do not have to visit Genieo's website to download its installer... it is packaged in all manner of downloads all over the web, on bad websites. The fact that you have this installer, coupled with the fact that the Gemieo home page is in your browser history, means it's likely you have installed this. For removal instructions, see:


http://www.thesafemac.com/arg-genieo


Finally, you mention that you have MacKeeper installed. This is very bad software from highly unethical developers, and that is often found being distributed along with adware like Genieo. It should be removed immediately. For more info, see:


Ongoing MacKeeper fraud


(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com.)

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

mac os x virus: genio

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.