You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Fatboy101 Author

Level 1

8 points

I recently updated 'Safari' and now "Installmac" has become my search engine

I recently updated 'Safari' and now "Installmac" has become my search engine....How do I get it back to Google? I already set it to Google by---> (Safari/Preferences/Default Search Engine, Google) but "Installmac" STILL 'takes over' the search...AaaaRghhhhhh >:-/

iMac

Posted on Jun 9, 2013 11:44 AM

48 replies

thomas_r.

Level 7

32,001 points

Jun 12, 2013 4:00 AM in response to andyBall_uk

No, Genieo run installmac

Interesting... Well, I guess we'll have to wait until Fatboy101 gets back to us about what Safari extensions he found. It could be a partner-specific variant of Genieo or it could be something completely different that happens to be made (or owned) by the same people.

Fatboy101 Author

Level 1

8 points

Jun 12, 2013 7:21 PM in response to thomas_r.

Thomas/Andy,

There are NO extensions when I did what you suggested....

Linc Davis

Level 10

209,649 points

Jun 12, 2013 7:29 PM in response to Fatboy101

What happens when you load the Google home page and search? Do you get Google or that other site?

thomas_r.

Level 7

32,001 points

Jun 12, 2013 7:32 PM in response to Fatboy101

What happens if you actually try to go to http://www.google.com and do a search there? Do you get the same behavior, or do you get a Google search results page?

Also, there is an adware program that uses SIMBL to achieve very similar results without an extension. This doesn't sound like the same thing, but may be operating in the same way. See the removal instructions here:

http://www.thesafemac.com/chatzum-adware-added-to-vlc-on-softonic/

Do you see anything similar installed on your system?

Fatboy101 Author

Level 1

8 points

Jun 12, 2013 7:42 PM in response to thomas_r.

If I go to "Google" the way you asked, it's ok, it stays with Google...if I just start a search from the address bar it 're-routes' to that Installmac (Screenshot on 1st page)

Gotta get to work, check with you guys later,

Thanks!

andyBall_uk

Level 7

20,516 points

Jun 12, 2013 7:44 PM in response to Linc Davis

>>PS...This only happens if I search from the address bar at the top of the screen (where I ALWAYS search from) NOT if I go to "Google.com", it will stay with Google if I do it that way...

10 June

I think you were right about Genieo

Linc Davis

Level 10

209,649 points

Jun 12, 2013 7:47 PM in response to Fatboy101

Please read this whole message before doing anything.

This procedure is a diagnostic test. It won’t solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.

Third-party system modifications are a common cause of usability problems. By a “system modification,” I mean software that affects the operation of other software — potentially for the worse. The following procedure will help identify which such modifications you've installed. Don’t be alarmed by the complexity of these instructions — they’re easy to carry out and won’t change anything on your Mac.

These steps are to be taken while booted in “normal” mode, not in safe mode. If you’re now running in safe mode, reboot as usual before continuing.

Below are instructions to enter some UNIX shell commands. The commands are harmless, but they must be entered exactly as given in order to work. If you have doubts about the safety of the procedure suggested here, search this site for other discussions in which it’s been followed without any report of ill effects.

Some of the commands will line-wrap or scroll in your browser, but each one is really just a single line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, and you can then copy it. The headings “Step 1” and so on are not part of the commands.

Note: If you have more than one user account, Step 2 must be taken as an administrator. Ordinarily that would be the user created automatically when you booted the system for the first time. The other steps should be taken as the user who has the problem, if different. Most personal Macs have only one user, and in that case this paragraph doesn’t apply.

Launch the Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.

When you launch Terminal, a text window will open with a line already in it, ending either in a dollar sign (“$”) or a percent sign (“%”). If you get the percent sign, enter “sh” and press return. You should then get a new line ending in a dollar sign.

Step 1

Triple-click the line of text below to select it:

kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}' | open -f -a TextEdit

Copy the selected text to the Clipboard by pressing the key combination command-C. Then click anywhere in the Terminal window and paste (command-V). A TextEdit window will open. Post the contents of that window, if any — the text, please, not a screenshot. You can then close the TextEdit window. The title of the window doesn't matter, and you don't need to post that. No typing is involved in this step.

Step 2

Repeat with this line:

{ sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix)|org\.(amav|apac|cups|isc|ntp|postf|x)/{print $3}'; sudo defaults read com.apple.loginwindow LoginHook; } | open -f -a TextEdit

This time you'll be prompted for your login password, which you do have to type. Nothing will be displayed when you type it. Type it carefully and then press return. You may get a one-time warning to be careful. Heed that warning, but don't post it. If you see a message that your username "is not in the sudoers file," then you're not logged in as an administrator.

Note: If you don’t have a login password, you’ll need to set one before taking this step. If that’s not possible, skip to the next step.

Step 3

launchctl list | sed 1d | awk '!/0x|com\.apple|org\.(x|openbsd)/{print $3}' | open -f -a TextEdit

Step 4

ls -1A /e*/mach* {,/}L*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/Bu,P*P,Priv,Qu,Scripti,Servi,Spo,Sta}* L*/Fonts 2> /dev/null | open -f -a TextEdit

Important: If you formerly synchronized with a MobileMe account, your me.com email address may appear in the output of the above command. If so, anonymize it before posting.

Step 5

osascript -e 'tell application "System Events" to get name of every login item' | open -f -a TextEdit

Remember, steps 1-5 are all copy-and-paste — no typing, except your password. Also remember to post the output.

You can then quit Terminal.

Fatboy101 Author

Level 1

8 points

Jun 13, 2013 1:13 PM in response to Fatboy101

Well....I don't know what/how it happened but I'm back to normal....The power went out last nite so I had to re-start my machine....I searched for something the way I had done it in the past, from the address bar (guess I was tired & forgot to go to Google.com) HOWEVER, it stayed with Google & Installmac didn't "take over" :-)

Maybe because the computer was restarted?

Whatever, it's fixed....for now anyway,

Thanks to all those who tried to help!

andyBall_uk

Level 7

20,516 points

Jun 13, 2013 1:38 PM in response to Fatboy101

On 10 June, Linc suggested that you remove Genieo, and you responded 'Nope....still does the same thing' - meaning that you did have Genieo installed ?; was this the first restart ?.

Jul 31, 2013 8:51 AM in response to Linc Davis

I hav the same problem, and here are the output for each steps.

Step 1 Output:

com.squirrels.driver.AirParrotSpeakers (1.7)

com.squirrels.airparrot.framebuffer (3)

com.zeobit.kext.AVKauth (2.3.3)

com.zeobit.kext.Firewall (2.3.3)

Step 2 Output:

com.zeobit.MacKeeper.plugin.AntiTheft.daemon

com.zeobit.MacKeeper.AntiVirus

com.wyse.PocketCloud

com.oracle.java.Helper-Tool

com.google.keystone.daemon

com.genieoinnovation.macextension.client

com.adobe.SwitchBoard

com.adobe.fpsaud

Step 3 Output:

com.fiplab.MemoryCleanHelper

com.oracle.java.Java-Updater

com.google.keystone.system.agent

com.genieoinnovation.macextension

com.adobe.AdobeCreativeCloud

com.zeobit.MacKeeper.Helper

com.facebook.videochat.ejery.updater

com.BlueStacks.AppPlayer.UpdaterAgent

com.BlueStacks.AppPlayer.UninstallAgent

com.BlueStacks.AppPlayer.Service

com.BlueStacks.AppPlayer.LogRotator

com.adobe.ARM.202f4087f2bbde52e3ac2df389f53a4f123223c9cc56a8fd83a6f7ae

com.adobe.AAM.Scheduler-1.0

Step 4 Output:

/Library/Components:

/Library/Extensions:

/Library/Frameworks:

AEProfiling.framework

AERegistration.framework

AudioMixEngine.framework

GenieoExtra.framework

NyxAudioAnalysis.framework

OSXFUSE.framework

PluginManager.framework

iTunesLibrary.framework

/Library/Input Methods:

/Library/Internet Plug-Ins:

AdobeAAMDetect.plugin

AdobeExManDetect.plugin

AdobePDFViewer.plugin

AdobePDFViewerNPAPI.plugin

Flash Player.plugin

JavaAppletPlugin.plugin

Quartz Composer.webplugin

QuickTime Plugin.plugin

flashplayer.xpt

googletalkbrowserplugin.plugin

npgtpo3dautoplugin.plugin

nsIQTScriptablePlugin.xpt

o1dbrowserplugin.plugin

/Library/Keyboard Layouts:

/Library/LaunchAgents:

com.adobe.AAM.Updater-1.0.plist

com.adobe.AdobeCreativeCloud.plist

com.genieoinnovation.macextension.plist

com.google.keystone.agent.plist

com.oracle.java.Java-Updater.plist

/Library/LaunchDaemons:

com.adobe.SwitchBoard.plist

com.adobe.fpsaud.plist

com.genieoinnovation.macextension.client.plist

com.google.keystone.daemon.plist

com.oracle.java.Helper-Tool.plist

com.wyse.PocketCloud.plist

com.zeobit.MacKeeper.AntiVirus.plist

com.zeobit.MacKeeper.plugin.AntiTheft.daemon.plist

/Library/PreferencePanes:

Flash Player.prefPane

JavaControlPanel.prefPane

OSXFUSE.prefPane

/Library/PrivilegedHelperTools:

Google Drive Icon Helper

com.genieoinnovation.macextension.client

/Library/QuickLook:

iBooksAuthor.qlgenerator

iWork.qlgenerator

/Library/QuickTime:

AppleIntermediateCodec.component

AppleMPEG2Codec.component

/Library/ScriptingAdditions:

Adobe Unit Types.osax

/Library/Spotlight:

Microsoft Office.mdimporter

iBooksAuthor.mdimporter

iWork.mdimporter

/Library/StartupItems:

HWNetMgr

HWPortDetect

/etc/mach_init.d:

/etc/mach_init_per_login_session.d:

/etc/mach_init_per_user.d:

com.adobe.SwitchBoard.monitor.plist

Library/Address Book Plug-Ins:

SkypeABDialer.bundle

SkypeABSMS.bundle

Library/Fonts:

CALIBRI.TTF

CALIBRIB.TTF

CALIBRII.TTF

CALIBRIZ.TTF

Library/Frameworks:

SamsungKiesFoundation.framework

SamsungKiesSerialPort.framework

Library/Input Methods:

.localized

Library/Internet Accounts:

Library/Internet Plug-Ins:

BlueStacks Install Detector.plugin

FacebookVideoCalling.bundle

Picasa.plugin

Library/Keyboard Layouts:

Library/LaunchAgents:

com.BlueStacks.AppPlayer.LogRotator.plist

com.BlueStacks.AppPlayer.Service.plist

com.BlueStacks.AppPlayer.UninstallAgent.plist

com.BlueStacks.AppPlayer.UpdaterAgent.plist

com.adobe.AAM.Updater-1.0.plist

com.adobe.ARM.202f4087f2bbde52e3ac2df389f53a4f123223c9cc56a8fd83a6f7ae.plist

com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.9EB15121-97D8-43E6-8649-9EC 8C0EFAEF8.plist

com.apple.FolderActions.enabled.plist

com.apple.FolderActions.folders.plist

com.facebook.videochat.ejery.plist

com.zeobit.MacKeeper.Helper.plist

Library/PreferencePanes:

HyperDock.prefpane

Launchpad-Control.prefPane

Library/QuickTime:

Library/Services:

Step 5 Output:

iTunesHelper, uHD-Agent, SpeechSynthesisServer, HyperDock Helper, Google Drive, AdobeResourceSynchronizer, fuspredownloader

thomas_r.

Level 7

32,001 points

Jul 31, 2013 12:05 PM in response to Jerry Ubin

You have installed the Genieo malware. See:

Malicious Genieo installers persist

Also, I see that you have installed MacKeeper, which is junk and should be removed.

Jul 31, 2013 7:02 PM in response to thomas_r.

How to remove this thing (this malicious genieo)?

thomas_r.

Level 7

32,001 points

Aug 1, 2013 4:01 AM in response to Jerry Ubin

Read the information at the link I gave you. It includes some removal instructions.

Aug 1, 2013 5:34 AM in response to thomas_r.

Step 1: Open Terminal

Step 2: sudo rm -f /Library/LaunchAgents/com.genieoinnovation.macextension.plist

Step 3: sudo rm -f /Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist

Step 4: sudo rm -f /Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client

Step 5: Restart

Step 6: sudo rm -rf /Library/Frameworks/GenieoExtra.framework

thomas_r.

Level 7

32,001 points

Aug 1, 2013 12:08 PM in response to Jerry Ubin

Those are not the removal instructions from the link I provided, and neither are they appropriate removal instructions. Those steps will leave many things still installed. As I said, you need to follow the instructions at the link I provided.

I recently updated 'Safari' and now "Installmac" has become my search engine