The "InstallMac" search software was unintentionally downloaded to OS 10.7.5. I've followed all the removal instructions from their site but can't seem to get it taken care of. It opens a new tab in chrome to the installmac home page every time i open chrome. Any thoughts?
Thanks,
Will
MacBook Pro, Mac OS X (10.7.5)
Remove the "InstallMac" spyware by following the instructions on this page. Back up all data before making any changes.
Neither of these options work. Is there anything out there that actually works to get this off of a MAC, and doesn't focus on SAFARI?
Howdie do fellow friends,
I was struck with this invasive search InstallMac engine as well,
I just came back to share the method that worked for me!!
Because I tried restarting Safari and clearing history and resetting preferences and quitting but my top right search bar was still not going to Google, in fact even the bing search engine stopped.
Ok I went to HOME folder tab, on the left sidebar in Finder,
Then I went to LIBRARY
from there go to PREFERENCES,
then in that folder i found a few 'plist' files, but mainly I was looking for anything that said InstallMac,
I deleted one file in abbreviated form that looked like InstlMc or something, then two more that said InstallMac something plist.
So i deleted three files, reset Safari, and my search bar works and automatically defaulted back to Google!
So i guess that worked, I hope the same method works for anyone trying to remove this satanic entity,
Also don't download any software removal tools, Obbvviously, I consider them in the same pile as this crap InstallMac software.
Anyways Goodluck!
Hope it helps 😀
HerbToast, thank you very much for posting your solution, it solved it for me! I believe Installmac got into my Mac when I downloaded an add-on called Menubar that was supposed to restore the old black Google nav bar. Grrrrrr!
I'll try this solution thanking you. Because Safari is behaving "normally" does it mean the spyware is gone, thanks
I never saw this before, but note that a LOT has changed since this topic began. The InstallMac uninstaller definitely should not be used, as it has been documented to actually install components of this software that were not already present! Further, the symptoms can be removed without actually removing all of the sneaky components running in the background.
For proper removal, see:
I have no files with anything related to InstallMac or Genieo but yet that's what's coming up in my search bar. Has anyone seen anything like this? Help!
Lorif70 wrote:
I have no files with anything related to InstallMac or Genieo but yet that's what's coming up in my search bar.
And you followed all of thomas_r.'s instructions http://www.thesafemac.com/arg-genieo/?
What do you have enabled in Safari Preferences->Extensions.
Did you change your search engine by clicking the triangle next to the InstallMac icon in your search bar?
Yes, unfortunately I've tried this twice and I don't have any of the files. I thought I had it fixed but I do 2 searches and it's back. Do I need to reinstall my OS?
Please give us a list of all the Safari Extensions you have.
A simple way to do that is for you download and install EtreCheck from http://etresoft.com/etrecheck
Run EtreCheck and publish report here
Allan
The instructions I posted here seven months ago are inaccurate. Below are updated instructions.
Back up all data. You must know how to restore from a backup even if the system becomes unbootable. If you don't know how to do that, or if you don't have any backups, stop here and ask for guidance.
Step 1
Triple-click anywhere in the line below on this page to select it:
/etc/launchd.conf
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.
If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar, paste into the box that opens (command-V). You won't see what you pasted because a line break is included. Press return.
A folder may open with a file selected, or the file may not exist, in which case you'll get a message that it can't be found. If it does exist, it's a configuration file created or replaced by the Genieo installer. Any software installer that does this should be considered ipso facto malware. Move the file to the Trash. You'll be prompted for your administrator password. Then restart, empty the Trash, and continue as below.
IMPORTANT: If the launchd.conf file exists, you must move it to the Trash and restart before continuing. Otherwise the system may become unbootable. In that case, restore from your backup and start over. That's how badly Genieo has sabotaged your system. If you're not completely sure you can complete this step, stop here and ask for guidance.
Some variants of Genieo don't include the launchd.conf file. The absence of that file doesn't mean that Genieo is not installed.
Step 2
Quit the Genieo application, if it's running. Force quit if necessary.
Move each of these items to the Trash in the same way as above:
/Applications/Genieo.app
/Applications/Uninstall Genieo.app
/Library/Frameworks/GenieoExtra.framework
/Library/LaunchAgents/com.genieo.engine.plist
/Library/LaunchAgents/com.genieoinnovation.macextension.plist
/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist
/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client
/usr/lib/libgenkit.dylib
/usr/lib/libgenkitsa.dylib
/usr/lib/libimckit.dylib
/usr/lib/libimckitsa.dylib
There's no need to restart after each one. Again, some of these items may be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
Restart and empty the Trash. Don't try to empty the Trash until you have restarted.
Your web browser(s) should now function normally, and you should be able to reset the home page and search engine. If not, stop here and post your results.
Step 3
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including ones called "Genieo" or "Omnibar," and any that have the word "Spigot" or "InstallMac" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
This procedure may leave a few files behind, but it should deactivate Genieo. Make sure you don't repeat the mistake that led you to install it. Chances are you got it from one of the Internet's open sewers such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site.
Finally, be forewarned that when Genieo is mentioned on this site, the developer sometimes shows up under the name "Genieo support." If that happens, don't believe anything he says, but feel free to tell him what you think of his scam.
Thanks, unfortunately I tried this and didn't have any of these files 😟
So helpful. Thank you, thank you so much!
Please help me remove InstallMac malware from my computer.