cjlinstrum

Q: A nasty thing called "install.mac" has hijacked my Safari address bar search...

Yesterday I started trying to install Internet Explorer and a thing called DJVu in order to download a washing machine manual (I know...) and now my Safari and Firefox have both been hijacked by 'Install.mac' which I believe is a Genieo product.  When I type a search into the address bar of either Safari or Firefox it automatically redirects to an Install.mac results page rather than Google.  I can't find any evidence of either install.mac or Genieo anywhere on my mac in order to uninstall it.  It seems to be hiding somewhere.  Has anyone had the same experience and managed to get rid of the unwelcome guest?

iMac (24-inch Early 2009), Mac OS X (10.7.5)

Posted on Jul 20, 2013 1:49 AM

Close

Q: A nasty thing called "install.mac" has hijacked my Safari address bar search...

  • All replies
  • Helpful answers

Page 1 of 6 last Next
  • by Dr.Mac.,

    Dr.Mac. Dr.Mac. Jul 20, 2013 4:15 AM in response to cjlinstrum
    Level 3 (636 points)
    Jul 20, 2013 4:15 AM in response to cjlinstrum

    How to  remove "InstallMac" from Safari's homepage and default search

    First you must uninstall it. <This link is a direct download>

    Please read carefully  the following step by step  tutorials:

    1. Click on Safari, located in the upper left hand corner of your screen.
    2. When the drop-down menu appears click on Preferences....
    3. Safari's General Preferences should now be displayed, overlaying your browser window.
      To modify the address of your home page, enter the desired URL in the edit field provided. To modify the search click on Default search Engine.
    4. If you would like to set the current Web page as your home page, click on the button labeled Set to Current Page.

    SAF.png

    To remove from Firefox and to change the default search please follow these instructions:

    1. Type "about:config" into the address bar and click "Enter".
    2. Click the "I'll be careful, I promise!" button.
    3. Type "keyword.URL" into the search box that appears.
    4. Right-click on the "keyword.URL" entry and click "Modify"
    5. Delete the text in the box and click "OK"
  • by cjlinstrum,

    cjlinstrum cjlinstrum Jul 20, 2013 4:03 AM in response to Dr.Mac.
    Level 1 (0 points)
    Jul 20, 2013 4:03 AM in response to Dr.Mac.

    HI Dr Mac,

     

    Thanks for that but I'd already tried it.  The home page on Safari is fine - set to Google - and the address bar suggests that it's going to search in Google:

    Address bar 1.jpg

     

    But when I typein asearch text such as "apple discussions:

     

    Address bar 2.jpg

     

    I get this:

     

    Address bar 3.jpg

     

    and my page of results isn't a Google page but is instead like this:

     

    Results page.jpg

    I've reset Safari and looked for extensions but there aren't any.

     

    It's not the most important thing in the world but it's bugging me.

  • by Dr.Mac.,Solvedanswer

    Dr.Mac. Dr.Mac. Jul 20, 2013 4:58 AM in response to cjlinstrum
    Level 3 (636 points)
    Jul 20, 2013 4:58 AM in response to cjlinstrum

    You must try to uninstall it. <direct download>

     

    Download the file above and run.

     


     


     


  • by WZZZ,

    WZZZ WZZZ Jul 20, 2013 5:03 AM in response to cjlinstrum
    Level 6 (13,112 points)
    Mac OS X
    Jul 20, 2013 5:03 AM in response to cjlinstrum

    http://www.thesafemac.com/more-details-on-genieo-adware/

     

    Search for "genieo," "install.mac" or anything else that might identify it with FindAnyFile.

     

    http://apps.tempel.org/FindAnyFile/index.php

     

    Use the Option key with Find.

  • by cjlinstrum,

    cjlinstrum cjlinstrum Jul 20, 2013 5:08 AM in response to Dr.Mac.
    Level 1 (0 points)
    Jul 20, 2013 5:08 AM in response to Dr.Mac.

    Hurrah!  Thanks - it worked.  I was too scared to download anything else from Genieo but this did the trick.

     

    Thanks.

  • by andyBall_uk,

    andyBall_uk andyBall_uk Jul 20, 2013 5:08 AM in response to Dr.Mac.
    Level 7 (20,495 points)
    Jul 20, 2013 5:08 AM in response to Dr.Mac.

    as Dr Mac says - you must use the uninstaller, which may remove the search redirection, but leave other components behind...

  • by hygom163,

    hygom163 hygom163 Aug 7, 2013 2:41 PM in response to WZZZ
    Level 1 (0 points)
    Aug 7, 2013 2:41 PM in response to WZZZ

    yes - definitely nasty stuff

     

    "find any file" help me to find the stuff and delete

     

    thanks

  • by smjames31,

    smjames31 smjames31 Aug 26, 2013 5:43 PM in response to cjlinstrum
    Level 1 (0 points)
    Aug 26, 2013 5:43 PM in response to cjlinstrum

    Can you walk me through how to get rid of the unistall.mac thing... I downloaded "Find any file" I need to know what to do next.

     

    THANKS!

  • by tcsadmin,Helpful

    tcsadmin tcsadmin Aug 27, 2013 10:51 AM in response to cjlinstrum
    Level 1 (30 points)
    Aug 27, 2013 10:51 AM in response to cjlinstrum

    I was a little hesitant to run the uninstaller. I tried to do a search, but I don't know what's up with the Mac search function - maybe I don't know how to use it.

     

    But, USUALLY, these types of things hide out in the Launch Agents and Launch Daemons folders. Looking into them specifically I found:

     

    Macintosh HD/Library/LaunchAgents/com.genieoinnovation.macextension.client.plist

    Macintosh HD/Library/LaunchDaemons/com.genieoinnovation.macextension.plist

     

    These two files may be reversed - that is, in the other folder

     

    One more in the USER Library (this is hidden in Lion and Mt. Lion - so Use the "Go" menu item in Finder and hold down the Option key to get "Library" to show up. The file path is:

     

    Macintosh HD/Users/<<username>>/Library/Preferences/com.genieoinnovation.macextension.pli st.

     

    You'll need administrator credentials to trash the first two files. I emptied the trash - restarted and it appears to be working.

     

    I also noticed that if you change the search engine from Google to, say, Bing, and then back to Google, the proper search window opens - that is, the Google search window. But that may only be a temporary solution - I suspect the malware will resurface later.

     

    Hope this helps.

  • by cjlinstrum,

    cjlinstrum cjlinstrum Aug 27, 2013 11:06 AM in response to tcsadmin
    Level 1 (0 points)
    Aug 27, 2013 11:06 AM in response to tcsadmin

    I used the uninstaller which seemed to work but it was good to find these other locations - i.e. launch agents, launchdaemons and library preferences to make sure that the uninstaller had really got rid of the thing.  And it had.

     

    Thanks for the extra help, tcsadmin.

  • by Sasay,

    Sasay Sasay Sep 11, 2013 3:34 PM in response to cjlinstrum
    Level 1 (28 points)
    iPhone
    Sep 11, 2013 3:34 PM in response to cjlinstrum

    I have done all of these things, including going into the terminal and getting rid of stuff--nothing is working. I use Chrome, but have Safari somewhere because something I use requires it. Do I need to go in and make changes in Safari, even though it hasn't been open since I installed a new hard drive in April? Do I need to check it on all my browsers, even the ones I don't use regularly? This is started to **** me off!!

  • by isaiasneto,

    isaiasneto isaiasneto Sep 24, 2013 12:42 PM in response to tcsadmin
    Level 1 (0 points)
    Sep 24, 2013 12:42 PM in response to tcsadmin

    Works great for me!

  • by BrentVMedia,

    BrentVMedia BrentVMedia Oct 3, 2013 7:09 AM in response to tcsadmin
    Level 1 (0 points)
    Oct 3, 2013 7:09 AM in response to tcsadmin

    Even after running the UnInstaller it still left the library items. Make sure you remove these too!

  • by Sasay,

    Sasay Sasay Oct 3, 2013 7:18 AM in response to BrentVMedia
    Level 1 (28 points)
    iPhone
    Oct 3, 2013 7:18 AM in response to BrentVMedia

    I did. As I mentioned, I did everything I could find in every list in every question asked about this. I've even been in contact with one of the bloggers who provided some of the info. He's as flumoxed as I am.

Page 1 of 6 last Next