A nasty thing called "install.mac" has hijacked my Safari address bar search...

How to remove "InstallMac" from Safari's homepage and default search

First you must uninstall it. <This link is a direct download>

Please read carefully the following step by step tutorials:

1. Click on Safari, located in the upper left hand corner of your screen.
2. When the drop-down menu appears click on Preferences....
3. Safari's General Preferences should now be displayed, overlaying your browser window.
   To modify the address of your home page, enter the desired URL in the edit field provided. To modify the search click on Default search Engine.
4. If you would like to set the current Web page as your home page, click on the button labeled Set to Current Page.

To remove from Firefox and to change the default search please follow these instructions:

1. Type "about:config" into the address bar and click "Enter".
2. Click the "I'll be careful, I promise!" button.
3. Type "keyword.URL" into the search box that appears.
4. Right-click on the "keyword.URL" entry and click "Modify"
5. Delete the text in the box and click "OK"

You must try to uninstall it. <direct download>

Download the file above and run.

http://www.thesafemac.com/more-details-on-genieo-adware/

Search for "genieo," "install.mac" or anything else that might identify it with FindAnyFile.

http://apps.tempel.org/FindAnyFile/index.php

Use the Option key with Find.

as Dr Mac says - you must use the uninstaller, which may remove the search redirection, but leave other components behind...

yes - definitely nasty stuff

"find any file" help me to find the stuff and delete

thanks

Can you walk me through how to get rid of the unistall.mac thing... I downloaded "Find any file" I need to know what to do next.

THANKS!

I was a little hesitant to run the uninstaller. I tried to do a search, but I don't know what's up with the Mac search function - maybe I don't know how to use it.

But, USUALLY, these types of things hide out in the Launch Agents and Launch Daemons folders. Looking into them specifically I found:

Macintosh HD/Library/LaunchAgents/com.genieoinnovation.macextension.client.plist

Macintosh HD/Library/LaunchDaemons/com.genieoinnovation.macextension.plist

These two files may be reversed - that is, in the other folder

One more in the USER Library (this is hidden in Lion and Mt. Lion - so Use the "Go" menu item in Finder and hold down the Option key to get "Library" to show up. The file path is:

Macintosh HD/Users/<<username>>/Library/Preferences/com.genieoinnovation.macextension.pli st.

You'll need administrator credentials to trash the first two files. I emptied the trash - restarted and it appears to be working.

I also noticed that if you change the search engine from Google to, say, Bing, and then back to Google, the proper search window opens - that is, the Google search window. But that may only be a temporary solution - I suspect the malware will resurface later.

Hope this helps.

I have done all of these things, including going into the terminal and getting rid of stuff--nothing is working. I use Chrome, but have Safari somewhere because something I use requires it. Do I need to go in and make changes in Safari, even though it hasn't been open since I installed a new hard drive in April? Do I need to check it on all my browsers, even the ones I don't use regularly? This is started to **** me off!!

Works great for me!

Even after running the UnInstaller it still left the library items. Make sure you remove these too!

I did. As I mentioned, I did everything I could find in every list in every question asked about this. I've even been in contact with one of the bloggers who provided some of the info. He's as flumoxed as I am.

thx for taking the time to post this - finally got rid of problem thx to tcsadmininstructions