A nasty thing called "install.mac" has hijacked my Safari address bar search...

Glad to hear you got it resolved!

It's really critical that the removal instructions are followed to the letter, as Genieo installs some stuff in a dangerous way. Improper removal - such as emptying the trash at the wrong time - can cause serious problems. That's why I was careful in the instructions to point out not to empty the trash until the end.

I have gone through several revisions of those instructions, but just added another precautionary note at the beginning, in hopes of preventing future problems like this.

How do I remove InstallMac from my browser's homepage and default search?

• Remove from Safari
  Home page removal instructions here
  If you wish to remove InstallMac from the Safari default Search provider please follow these instructions:
  1. From the menu bar choose "Safari" and then choose “Preferences”.
  2. From the prefernces window, choose the “extensions” tab.
  3. Locate the "Omnibar " extension and uncheck "Unable Omnibar" box.
  If the extension is missing, or If the box was already unchecked, and InstallMac is still set as your default search provider, please try going through the following steps:
  1. In your Safari, change the default search from Google to Bing (or Yahoo) (see example).
  2. Run a search and see if it goes to Bing or Yahoo's search results page.
  3. Return to your "preferences" window and change it back to Google.
  4. Try again.
• Remove from Chrome
  
  • Home page removal instructions here
  • Default Search provider removal instructions here
• Remove from Firefox
  
  • Home page removal instructions here
  • Default Search provider removal instructions here
  • If you wish to reset your Firefox entirely, please follow these instructions:
    1. Type “about:support” into the Firefox address bar and click “Enter”.
    2. Locate and click on the “Reset Firefox" button on the top right corner of the page.

We created a simple tool that will help you with the removal of InstallMac. Please download and run the uninstall tool, available here

That uninstaller does nothing but remove the obvious evidence that Genieo is installed. It leaves behind all the components of the adware, which remain actively running - including the deceptively-named "Application" process, which is kept running constantly by a LaunchAgent, even after "uninstalling."

Do not trust this uninstaller. For proper removal instructions, see the Genieo removal page in my Adware Removal Guide.

https://discussions.apple.com/thread/5580977?answerId=23851370022#23851370022

« Please go to http://www.installmac.com/downloads/Uninstaller.dmg and run the application to revert all your browsers settings back to default.

If this did not work,

Please go to your browser settings (cmd+,) and change the default homepage and search to match your decision manualy.

How to change Home page in Safari:

http://browsers.about.com/od/safar1/ss/safarihomepage_3.htm

How to change Search provider in Safari:

Please open your safari settings menu (CMD+,),

Remove all extensions

Make a search,

Change the search provider to any other on the list,

Make a search to verify it was changed,

Open your safari settings menu again,

Change the search provider to the one you want »

As has already been pointed out, those instructions don't work properly. See my previous response.

You're quite right, of course : and if the system didn't already have genieo software, it certainly would after using the installmac uninstaller.

Thanks. I was able to get this to work for the first search I do in Safari but the next search goes right back to the Bing Search page using the InstallMac in the search bar. Any ideas? I've ran this uninstall twice now and it continues to do the same thing – works once then goes back to the virus.

TCSAdmin you are right on the money. I did just what you said. My Safari is back to normal. I tried the holding the Option key and Go but did not work. I just the used the Path icon in the Finder and everything went smoothly. Folks you just have to restart your computer. Thanks for all the help/solutions to the Apple computer owners and of course to you, TCSadmin.

I read all these answers and then after I did other things like download more stupid software to get rid of stupid software I just went to the computer search (the little magnifying glass in upper right hand corner) and searched uninstall and clicked on it and it straight up just asked me if I want to uninstall the evil thing known as installmac and voila! and now I'm thinking... That's what the first reply says (that's what HE-assuming here that Dr. Mac is a male lol- said). This was frustrating beyond belief.... but now my google search is running really slow, Bing was fast lol...... ugh! I am going to restart and see if that helps.

After 8 hours straight of following every step on this form, I realized I need to restart after each of what seem to be 3 major steps: Uninstallation, deletion, manually search and delete.

Only after doing this process did it finally work for me on Safari.

Thank you for the help people🙂

Thank you for your info on this, this malware hijacked my computer when trying the picresize website. Is this a platform for this malware? If so, people need to be very wary about using their product. Your instructions removed the add-on and I was leary at first to try it. Also, it was able to gain access to my browser without needing a password for download into my computer.

Unfortunately, you picked an incomplete solution for this problem. Had you kept reading you would have found that the uninstaller provided by Genieo only removes the most obvious signs of it's existence, leaving a few files and at least one active process behind which may continue to cause problems for you going forward. To be doubly sure that you have removed it most of us recommend the use of the Adware Removal Tool which removes all currently known adware.

Is this a platform for this malware?

Probably not. After almost a year now, only a few of those that originally visited the discussion are still monitoring it along with users such as yourself looking for solutions. It's not really malware in that it doesn't do anything malicious to your Mac, it's just annoying and intrusive.

it was able to gain access to my browser without needing a password for download into my computer.

The most common way this adware is installed is through the use of installers for other third party software, especially if downloaded from sites such as C|Net's download.com or Softonics. During the installation of the software you intended to download, there is a short dialog telling you that it also includes InstallMac along with a checkbox that you must uncheck to avoid it. Always download your software from the AppStore or the developer's web site and avoid the two sites mentioned. I also use MacUpdate when I have to as they don't include such things, yet. So you did give it permission and perhaps even entered your password, but this type of installation does not require admin passwords to install such extensions in your browser.

Thank you for your reply, thorough recommendation and the link to uninstall, plus the admonitions for going forward to not have this happen again. I did run the script as my security settings for the app did not let me use the app. The script did find another piece of the adware and it landed in the trash. I am happy to report there was no other issues and am very grateful to get an unsolicited response to this issue. 🙂

golda g wrote:

I did run the script as my security settings for the app did not let me use the app.

Glad that helped.

One more tip. I'm pretty sure this was mentioned in that article I linked you to, but the next time you run into an app that isn't signed but you trust it to be OK is to right-click / <Control>-click on the app and select "Open" from the pop-up menu. That will give you a dialog that allows you to open it without even having to change your security settings.

Thank you again, too many mac and devices, new and older running various os's and it is hard to keep straight what works on which machine.😁