Apple Event: May 7th at 7 am PT
Hi everyone, every time I open Chrome the default page is installmac. This virus have been giving me internet connection problems and my computer is also slowing down.
Is there any way I can delete this virus?
Thanks.
To remove the "InstallMac" spyware, start by following the instructions on this page. Back up all data before making any changes. The instructions may not remove the spyware completely.
Triple-click anywhere in the line below on this page to select it:
/Library/Frameworks/GenieoExtra.framework
Services ▹ Reveal
from the contextual menu.* A folder should open with an item selected. Move the selected item to the Trash. You may be prompted for your administrator password.
Repeat with each of these lines:
/Library/LaunchAgents/com.genieoinnovation.macextension.plist
/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist
/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client
Then reboot.
From the Safari menu bar, select
Safari ▹ Preferences ▹ Extensions
Uninstall any extension you don't recognize. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
*If you don't see the contextual menu item, copy the selected text to the Clipboard (command-C). In the Finder, select
Go ▹ Go to Folder...
from the menu bar, paste into the box that opens (command-V). You won't see what you pasted because a line break is included. Press return.
Thanks, it worked!!!
Thank you ever so much! Quite a relief, since it was decidedly frustrating going through a morning at work with that unwelcome surprise!
Note that you probably got InstallMac by downloading something from Softonic. You should avoid that site in the future. See:
Similarly untrustworthy is CNET's Download.com. See:
well this did the trick bing search was driving me crazy helpful!
I was not successful. I got my virus by dowloading a font and now I can only search with Bing and I can see InstallMac blip in the search bar and I no longer can search google. I tried your above instructions with no luck. Any other ideas for me?
Thanks!
Linc's directions above were posted six months ago. Things have changed a bit since then. You'll find up-to-date removal instructions for the Genieo/InstallMac adware here:
Thanks, but unfortunately I don't have any of the folders that you list. Argh!
If you are still seeing searches redirected through InstallMac to Bing, then you still have the adware installed. Pay close attention to the addendum in those instructions. I strongly suspect you are somehow not looking in the right places or have skipped a step somewhere.
1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem.
2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. There are ways to back up a computer that isn't fully functional. Ask if you need guidance.
3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) at the request of a stranger on a public message board. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.
Here's a summary of what you need to do, if you choose to proceed: Copy a line of text from this web page into the window of another application. Wait for the script to run. It usually takes a few minutes. Then paste the results, which will have been copied automatically, back into a reply on this page. The sequence is: copy, paste, wait, paste again. Details follow.
4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.
5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.
6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.
Triple-click anywhere in the line of text below on this page to select it:
PATH=/usr/bin:/bin:/usr/sbin:/sbin; clear; Fb='%s\n\t(%s)\n'; Fm='\n%s\n\n%s\n'; Fr='\nRAM details\n%s\n'; Fs='\n%s: %s\n'; Fu='user %s%%, system %s%%'; AC="com.autodesk.AutoCAD com.google.GoogleDrive"; H='^[[:space:]]*((127\.0\.0\.1|::1|fe80::1%lo0)[[:space:]]+local|(255\.){3}255[[:space:]]*broadcast)host[[:space:]]*$'; NS=networksetup; PB="/usr/libexec/PlistBuddy -c Print"; A () { [[ a -eq 0 ]]; }; M () { find -L "$d" -type f | while read f; do file -b "$f" | egrep -lq XML\|exec && echo $f; done; }; AT () { o=`file -b "$1" | egrep -v '^(A.{16}t$|cann)'`; Ps "${1##*/} format"; }; Pc () { o=`grep -v '^ *#' "$2"`; l=`wc -l <<< "$o"`; [[ l -gt 25 ]] && o=`head -n25 <<< "$o"`$'\n'"[$((l-25)) more line(s)]"; Pm "$1"; AT "$1"; }; Pm () { [[ "$o" ]] && o=`sed -E '/^ *$/d; s/^ */ /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/' <<< "$o"` && printf "$Fm" "$1" "$o"; }; Pp () { o=`$PB "$2" | awk -F'= ' \/$3'/{print $2}'`; Pm "$1"; }; Ps () { o=`echo $o`; [[ ! "$o" =~ ^0?$ ]] && printf "$Fs" "$1" "$o"; }; R () { o=; [[ r -eq 0 ]]; }; SP () { system_profiler SP${1}DataType; }; id -G | grep -qw 80; a=$?; A && sudo true; r=$?; t=`date +%s`; clear; { A || echo $'No admin access\n'; A && ! R && echo $'No root access\n'; SP Software | sed -n 's/^ *//;5p;6p;8p'; h=(`SP Hardware | awk '/ Id/{print $3}; /Mem/{print $2}'`); o=$h; Ps "Model"; o=$((h[1]<4?h[1]:0)); Ps "Total RAM (GB)"; o=`SP Memory | sed '1,5d;/[my].*:/d'`; [[ "$o" =~ s:\ [^O]|x([^08]|0[^2]|8[^0]) ]] && printf "$Fr" "$o"; o=`SP Diagnostics | sed '5,6!d'`; [[ "$o" =~ Pass ]] || Pm "POST"; p=`SP Power`; o=`awk '/Cy/{print $NF}' <<< "$p"`; o=$((o>=300?o:0)); Ps "Battery cycles"; o=`sed -n '/Cond.*: [^N]/{s/^.*://p;}' <<< "$p"`; Ps "Battery condition"; for b in FireWire Thunderbolt USB; do o=`SP $b | sed -En '1d;/:$/{s/ *:$//;x;s/\n//p;};/^ *(V.+ [0N]|Man).+ /{s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ \(\2\)/;H;};/Apple|Genesy|Intel|SMSC/{s/.//g;h;}' | egrep -v '^ *[(]'`; Pm $b; done; o=`pmset -g therm | sed 's/^.*C/C/'`; [[ "$o" =~ No\ th|pms ]] && o=; Pm "Thermal conditions"; o=`pmset -g sysload | grep -v :`; [[ "$o" =~ =\ [^GO] ]] || o=; Pm "System load advisory"; o=`nvram boot-args | awk '{$1=""; print}'`; Ps "boot-args"; a=(/ ""); A=(System User); for i in 0 1; do o=`cd ${a[$i]}L*/Lo*/Diag* || continue; for f in *.{cr,h,pa,s}*; do [[ -f "$f" ]] || continue; d=$(stat -f%Sc -t%F "$f"); [[ "$f" =~ h$ ]] && grep -lq "^Thread c" "$f" && f="$f *"; echo "$d ${f%%_2*} ${f##*.}"; done | sort | tail`; Pm "${A[$i]} diagnostics"; done; grep -lq '*$' <<< "$o" && printf $'\n\t* Code injection\n'; o=`syslog -F bsd -k Sender kernel -k Message CReq 'caug|GPU |hfs: Ru|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|timed? ?o|WARN' -k Message Ane 'SMC:' | tail -n25 | awk '/:/{$4=""; $5=""};1'`; Pm "Kernel messages"; o=`df -m / | awk 'NR==2 {print $4}'`; o=$((o<5120?o:0)); Ps "Free space (MiB)"; o=$(($(vm_stat | awk '/eo/{sub("\\.",""); print $2}')/256)); o=$((o>=1024?o:0)); Ps "Pageouts (MiB)"; s=( `sar -u 1 10 | sed '$!d'` ); [[ s[4] -lt 85 ]] && o=`printf "$Fu" ${s[1]} ${s[3]}` || o=; Ps "Total CPU usage" && { s=(`ps acrx -o comm,ruid,%cpu | sed '2!d'`); n=$((${#s[*]}-1)); c="${s[*]}"; o=${s[$n]}%; Ps "CPU usage by process \"${c% ${s[$((n-1))]}*}\" with UID ${s[$((n-1))]}"; }; s=(`top -R -l1 -n1 -o prt -stats command,uid,prt | sed '$!d'`); n=$((${#s[*]}-1)); s[$n]=${s[$n]%[+-]}; c="${s[*]}"; o=$((s[$n]>=25000?s[$n]:0)); Ps "Mach ports used by process \"${c% ${s[$((n-1))]}*}\" with UID ${s[$((n-1))]}"; o=`kextstat -kl | grep -v com\\.apple | cut -c53- | cut -d\< -f1`; Pm "Loaded extrinsic kernel extensions"; R && o=`sudo launchctl list | awk 'NR>1 && !/0x|com\.(apple|openssh|vix\.cron)|org\.(amav|apac|calendarse|cups|dove|isc|ntp|openld|post[fg]|x)/{print $3}'`; Pm "Extrinsic daemons"; o=`launchctl list | awk 'NR>1 && !/0x|com\.apple|org\.(x|openbsd)|\.[0-9]+$/{print $3}'`; Pm "Extrinsic agents"; o=`for d in {/,}L*/Lau*; do M; done | egrep -v 'com\.apple\.(CSConfig|server)' | while read f; do ID=$($PB\ :Label "$f") || ID="No job label"; printf "$Fb" "$f" "$ID"; done`; Pm "launchd items"; o=`for d in /{S*/,}L*/StartupItems; do M; done`; Pm "Startup items"; sys=`pkgutil --regexp --only-files --files com.apple.pkg.* | sort | uniq | sed 's:^:/:'`; b=`sed -E '/^.+Lib.+\/Contents\/Info.plist$/!d;s/\/Info.plist$//;/Contents\/./d' <<< "$sys"`; l=`egrep '^/usr/lib/.+dylib$' <<< "$sys"`; [[ "$b" && "$l" ]] && { o=`find -L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo}* -type d -name Contents -prune | grep -Fv "$b" | while read d; do test -f "$d/Info.plist" || continue; ID=$($PB\ :CFBundleIdentifier "$_") || ID="No bundle ID"; printf "$Fb" "${d%/Contents}" "$ID"; done`; Pm "Extrinsic loadable bundles"; o=`find /usr/lib -type f -name *.dylib | grep -Fv "$l"`; Pm "Extrinsic shared libraries"; :; } || echo $'\nReceipts missing'; o=`for e in INSERT_LIBRARIES LIBRARY_PATH; do launchctl getenv DYLD_$e; done`; Pm "Environment"; o=`find -L {,/u*/lo*}/e*/periodic -type f -mtime -10d`; Pm "Modified periodic scripts"; o=`scutil --proxy | grep Prox`; Pm "Proxies"; o=`scutil --dns | awk '/r\[0\] /{if ($NF !~ /^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./) print $NF; exit}'`; i=`route -n get default | awk '/e:/{print $2}'`; I=`$NS -listnetworkserviceorder | sed -En '/ '$i'\)$/{x;s/^\(.+\) //p;q;};x'`; n=`$NS -getdnsservers "$I" | awk '!/^T/{print "not "}'`; Ps "DNS (${n}from DHCP)"; o=`$NS -getinfo "$I" | awk '/k:/{if ($3 !~ "(255\.){3}0") print $3}'`; Ps "Netmask"; R && o=`sudo profiles -P | grep : | wc -l`; Ps "Profiles"; f=auto_master; [[ `md5 -q /etc/$f` =~ ^b166 ]] || Pc $f /etc/$f; for f in fstab sysctl.conf crontab launchd.conf; do Pc $f /etc/$f; done; f=/etc/hosts; Pc "hosts" <(egrep -v "$H" $f ); AT $f; Pc "User launchd" ~/.launchd*; R && Pc "Root crontab" <(sudo crontab -l); Pc "User crontab" <(crontab -l | sed -E 's:/Users/[^/]+/:/Users/USER/:g'); R && o=`sudo defaults read com.apple.loginwindow LoginHook`; Pm "Login hook"; LD="$(`find /S*/*/F* -type f -name lsregister | head -n1` -dump)"; o=`for ID in $AC; do [[ "$LD" =~ $ID ]] && echo $ID; done`; Pm "Application check"; Pp "Global login items" /L*/P*/loginw* Path; Pp "User login items" L*/P*/*loginit* Name; Pp "Safari extensions" L*/Saf*/*/E*.plist Bundle | sed -E 's/(\..*$|-[1-9])//g'; o=`find ~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \) | wc -l`; Ps "Restricted user files"; cd; o=`SP Fonts | egrep 'id: N|te: Y' | wc -l`; Ps "Font problems"; o=`find L*/{Con,Pref}* -type f ! -size 0 -name *.plist | while read f; do plutil -s "$f" >&- || echo $f; done`; Pm "Bad plists"; d=(Desktop L*/Keyc*); n=(20 7); for i in 0 1; do o=`find "${d[$i]}" -type f -maxdepth 1 | wc -l`; o=$((o<=n[$i]?0:o)); Ps "${d[$i]##*/} file count"; done; o=; [[ UID -eq 0 ]] && o=root; Ps "UID"; o=$((`date +%s`-t)); Ps "Elapsed time (s)"; } 2>/dev/null | pbcopy; exit 2>&-
7. Launch the built-in Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.
Click anywhere in the Terminal window and paste (command-V). The text you pasted should vanish immediately. If it doesn't, press the return key.
8. If you see an error message in the Terminal window such as "syntax error," enter
exec bash
and press return. Then paste the script again.
9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.
If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.
10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line
[Process completed]
to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.
11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.
If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.
12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.
Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.
________________________________
System Version: OS X 10.8.4 (12E55)
Kernel Version: Darwin 12.4.0
Boot Mode: Normal
Model: MacBookPro10,1
Kernel messages
Mar 12 06:59:45 PM notification timeout (pid 234, Adobe CEF Helper)
Mar 15 19:33:20 PM notification timeout (pid 202, Creative Cloud)
--- last message repeated 1 time ---
Mar 15 22:22:48 wl0: Roamed or switched channel, reason #8, bssid 00:1d:d3:0c:57:00
--- last message repeated 2 times ---
Mar 16 15:28:35 PM notification timeout (pid 202, Creative Cloud)
Mar 16 17:52:24 wl0: Roamed or switched channel, reason #2, bssid 00:1d:d3:0c:57:00
Mar 16 18:01:19 wl0: Roamed or switched channel, reason #8, bssid 00:1d:d3:0c:57:00
--- last message repeated 3 times ---
Mar 16 18:16:19 PM notification timeout (pid 202, Creative Cloud)
--- last message repeated 1 time ---
Mar 16 20:09:50 wl0: Roamed or switched channel, reason #8, bssid 00:1d:d3:0c:57:00
Mar 16 20:46:43 PM notification timeout (pid 202, Creative Cloud)
Mar 16 21:09:48 wl0: Roamed or switched channel, reason #2, bssid 00:1d:d3:0c:57:00
Mar 16 21:33:03 PM notification timeout (pid 202, Creative Cloud)
Mar 17 20:59:02 wl0: Roamed or switched channel, reason #8, bssid 00:1d:d3:0c:57:00
--- last message repeated 20 times ---
Mar 17 22:28:28 PM notification timeout (pid 182, HP Device Monito)
Mar 18 19:48:40 Sound assertion in AppleHDAController at line 5066
Mar 18 19:48:40 Sound assertion in IOHDACodecDevice at line 161
Mar 18 19:48:41 Sound assertion in AppleHDAController at line 5066
Mar 18 19:48:41 Sound assertion in IOHDACodecDevice at line 161
Mar 18 19:48:41 Sound assertion in AppleHDAFunctionGroup at line 1104
Mar 18 19:48:41 Sound assertion in AppleHDADriver at line 3181
Mar 18 19:48:41 Sound assertion in AppleHDADriver at line 3135
Loaded extrinsic kernel extensions
com.rim.driver.BlackBerryUSBDriverInt (0.0.68)
Extrinsic daemons
com.zeobit.MacKeeper.plugin.AntiTheft.daemon
com.smithmicro.vzwwirelessd
com.oracle.java.Helper-Tool
com.microsoft.office.licensing.helper
com.fitbit.galileod
com.adobe.SwitchBoard
com.adobe.fpsaud
Extrinsic agents
com.wacom.pentablet
com.oracle.java.Java-Updater
com.hp.messagecenter.launcher
com.hp.devicemonitor
com.adobe.AdobeCreativeCloud
com.zeobit.MacKeeper.Helper
com.macpaw.CleanMyMac2Helper.trashWatcher
com.macpaw.CleanMyMac2Helper.scheduledScan
com.macpaw.CleanMyMac2Helper.diskSpaceWatcher
com.google.keystone.user.agent
com.adobe.ARM.UUID
launchd items
/Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist
(com.adobe.AAM.Startup-1.0)
/Library/LaunchAgents/com.adobe.AdobeCreativeCloud.plist
(com.adobe.AdobeCreativeCloud)
/Library/LaunchAgents/com.hp.devicemonitor.plist
(com.hp.devicemonitor)
/Library/LaunchAgents/com.hp.messagecenter.launcher.plist
(com.hp.messagecenter.launcher)
/Library/LaunchAgents/com.oracle.java.Java-Updater.plist
(com.oracle.java.Java-Updater)
/Library/LaunchAgents/com.wacom.pentablet.plist
(com.wacom.pentablet)
/Library/LaunchDaemons/com.adobe.fpsaud.plist
(com.adobe.fpsaud)
/Library/LaunchDaemons/com.adobe.SwitchBoard.plist
(com.adobe.SwitchBoard)
/Library/LaunchDaemons/com.fitbit.galileod.plist
(com.fitbit.galileod)
/Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist
(com.microsoft.office.licensing.helper)
/Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist
(com.oracle.java.Helper-Tool)
/Library/LaunchDaemons/com.smithmicro.vzwwirelessd.plist
(com.smithmicro.vzwwirelessd)
/Library/LaunchDaemons/com.zeobit.MacKeeper.plugin.AntiTheft.daemon.plist
(com.zeobit.MacKeeper.plugin.AntiTheft.daemon)
Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist
(com.adobe.AAM.Scheduler-1.0)
Library/LaunchAgents/com.adobe.ARM.UUID.plist
(com.adobe.ARM.UUID)
Library/LaunchAgents/com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID. plist
(com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID)
Library/LaunchAgents/com.google.keystone.agent.plist
(com.google.keystone.user.agent)
Library/LaunchAgents/com.macpaw.CleanMyMac2Helper.diskSpaceWatcher.plist
(com.macpaw.CleanMyMac2Helper.diskSpaceWatcher)
Library/LaunchAgents/com.macpaw.CleanMyMac2Helper.scheduledScan.plist
(com.macpaw.CleanMyMac2Helper.scheduledScan)
Library/LaunchAgents/com.macpaw.CleanMyMac2Helper.trashWatcher.plist
(com.macpaw.CleanMyMac2Helper.trashWatcher)
Library/LaunchAgents/com.zeobit.MacKeeper.Helper.plist
(com.zeobit.MacKeeper.Helper)
Extrinsic loadable bundles
/System/Library/Extensions/2.2.0/Belcarra.USBLAN_netpart.kext
(com.Belcarra.iokit.USBLAN_netpart)
/System/Library/Extensions/2.2.0/Belcarra.USBLAN_usbpart.kext
(com.Belcarra.iokit.USBLAN_usbpart)
/System/Library/Extensions/2.2.0/RemoteControl.USBLAN_usbpart.kext
(com.RemoteControl.USBLAN.usbpart)
/System/Library/Extensions/3.1.1/Belcarra.USBLAN_netpart.kext
(com.Belcarra.iokit.USBLAN_netpart)
/System/Library/Extensions/3.1.1/Belcarra.USBLAN_usbpart.kext
(com.Belcarra.iokit.USBLAN_usbpart)
/System/Library/Extensions/3.1.1/RemoteControl.USBLAN_usbpart.kext
(com.RemoteControl.USBLAN.usbpart)
/System/Library/Extensions/Belcarra.USBLAN_netpart.kext
(com.Belcarra.iokit.USBLAN_netpart)
/System/Library/Extensions/Belcarra.USBLAN_usbpart.kext
(com.Belcarra.iokit.USBLAN_usbpart)
/System/Library/Extensions/LGEMobileSolutionFamily.kext
(com.lge.driver.LGEMobilSolutionFamily)
/System/Library/Extensions/NovatelWirelessWWAN.kext
(com.novatelwireless.kext.wwan)
/System/Library/Extensions/Pen Tablet.kext
(com.wacom.kext.pentablet)
/System/Library/Extensions/PTRayUSBFamily.kext
(com.pantech.driver.PTRayUSBFamily)
/System/Library/Extensions/PTUMWDrv.kext
(com.vaultmicro.driver.PTUMWDrv)
/System/Library/Extensions/RemoteControl.USBLAN_usbpart.kext
(com.RemoteControl.USBLAN.usbpart)
/System/Library/Extensions/RIMBBUSB.kext
(com.rim.driver.BlackBerryUSBDriverInt)
/System/Library/Extensions/RIMBBVSP.kext
(com.rim.driver.BlackBerryUSBDriverVSP)
/System/Library/Extensions/SierraDevSupport.kext
(com.sierrawireless.driver.SierraDevSupport)
/System/Library/Extensions/SierraFSCSupport.kext
(com.sierrawireless.driver.SierraFSCSupport)
/System/Library/Extensions/SierraFSRSupport.kext
(com.sierrawireless.driver.SierraFSRSupport)
/System/Library/Extensions/SierraHSRSupport.kext
(com.sierrawireless.driver.SierraHSRSupport)
/System/Library/Extensions/SMSIWirelessModem.kext
(com.smithmicro.driver.SMSIWirelessModem)
/System/Library/Extensions/TabletDriverCFPlugin.bundle
(No bundle ID)
/System/Library/Extensions/ZTEUSBCDCACMData.kext
(com.ZTE.driver.ZTEUSBCDCACMData)
/Library/Audio/Plug-Ins/Components/Flip4Mac WMA Import.component
(net.telestream.wmv.import)
/Library/Internet Plug-Ins/AdobeAAMDetect.plugin
(com.AdobeAAMDetectLib.AdobeAAMDetect)
/Library/Internet Plug-Ins/AdobePDFViewer.plugin
(com.adobe.acrobat.pdfviewer)
/Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin
(com.adobe.acrobat.pdfviewerNPAPI)
/Library/Internet Plug-Ins/Flash Player.plugin
(com.macromedia.Flash Player.plugin)
/Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin
(net.telestream.wmv.plugin)
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin
(com.oracle.java.JavaAppletPlugin)
/Library/Internet Plug-Ins/net.juniper.DSSafariExtensions.plugin
(net.juniper.DSSafariExtensions.plugin)
/Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin
(com.microsoft.sharepoint.browserplugin)
/Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin
(com.microsoft.sharepoint.webkitplugin)
/Library/Internet Plug-Ins/WacomNetscape.plugin
(com.wacom.tabletplugin)
/Library/Internet Plug-Ins/WacomTabletPlugin.plugin
(com.WacomTabletPluginLib.WacomTabletPlugin)
/Library/PreferencePanes/Flash Player.prefPane
(com.adobe.flashplayerpreferences)
/Library/PreferencePanes/Flip4Mac WMV.prefPane
(net.telestream.wmv.prefpane)
/Library/PreferencePanes/JavaControlPanel.prefPane
(com.oracle.java.JavaControlPanel)
/Library/PreferencePanes/PenTablet.prefPane
(com.wacom.PenTabletSettingsPrefPane)
/Library/QuickTime/Flip4Mac WMV Advanced.component
(net.telestream.wmv.advanced)
/Library/QuickTime/Flip4Mac WMV Export.component
(net.telestream.wmv.export)
/Library/QuickTime/Flip4Mac WMV Import.component
(net.telestream.wmv.import)
/Library/ScriptingAdditions/Adobe Unit Types.osax
(No bundle ID)
Library/Internet Plug-Ins/WebEx64.plugin
(com.cisco_webex.plugin.gpc64)
DNS (from DHCP): 72.240.13.7
User login items
iTunesHelper
Fitbit Connect Menubar Helper
Safari extensions
Omnibar
Restricted user files: 41
Font problems: 26
Desktop file count: 38
Elapsed time (s): 51
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Delete the "Omnibar" extension.
Although they're not related to your problem, you've also installed the "CleanMyMac" and "MacKeeper" scam "utilities." Both should be removed. You need to become much more selective about installing software, and less responsive to Internet marketing hype.
Remove "CleanMyMac" by following the first set of instructions on this page. If you have a different version of the product, the procedure may be different. Do not drag the CleanMyMac application to the Trash.
Remove "MacKeeper" as follows.
"MacKeeper" has only one useful feature: it deletes itself.
Note: These instructions apply to the version of the product that I downloaded and tested in early 2012. I can't be sure that they apply to other versions.
IMPORTANT: "MacKeeper" has what the developer calls an “encryption” feature. In my tests, I didn't try to verify what this feature really does. If you used it to “encrypt” any of your files, “decrypt” them before you uninstall, or (preferably) restore the files from backups made before they were “encrypted.” As the developer is not trustworthy, you should assume that the "decrypted" files are corrupt unless proven otherwise.
In the Finder, select
Go ▹ Applications
from the menu bar, or press the key combination shift-command-A. The "MacKeeper" application is in the folder that opens. Quit it if it's running, then drag it to the Trash. You'll be prompted for your login password. Click the Uninstall MacKeeper button in the dialog that appears. All the functional components of the software will be deleted. Reboot.
☞ Quit MacKeeper before dragging it to the Trash.
☞ Don't empty the Trash. Let MacKeeper delete itself.
☞ Don't try to drag the MacKeeper Dock iconto the Trash.
Back up all data before making any changes.
Thanks, I will try this once Maverick is finished downloading (I was hoping this might solve it!?). It's interesting but the CleanMyMac is what actually caused this, I think. I downloaded a font and this is what launched instead of the font folder. When I double clicked the downloaded font folder, this program launched and took over! I never downloaded this and actually thought I deleted all of the files once I realized this is what happened. UGH! I did download the MacKeeper in hopes of helping solve this, but apparently that didn't help! Stay tuned.
Unfortunately I don't have the CleanMyMac app as I trashed it (not knowing I needed it to uninstall). When I do a search for it nothing comes up. Is there a way to wipe it without the app?
How can I remove installmac virus from my Mac Pro
