planeta4166

Q: How can I remove installmac virus from my Mac Pro

Hi everyone, every time I open Chrome the default page is installmac. This virus have been giving me internet connection problems and my computer is also slowing down.

 

Is there any way I can delete this virus?

 

 

Thanks.

Posted on Sep 23, 2013 5:35 AM

Close

Q: How can I remove installmac virus from my Mac Pro

  • All replies
  • Helpful answers

Page 1 of 3 last Next
  • by Carolyn Samit,

    Carolyn Samit Carolyn Samit Sep 23, 2013 5:37 AM in response to planeta4166
    Level 10 (123,701 points)
    Apple Music
    Sep 23, 2013 5:37 AM in response to planeta4166
  • by Linc Davis,

    Linc Davis Linc Davis Sep 23, 2013 8:17 AM in response to planeta4166
    Level 10 (208,037 points)
    Applications
    Sep 23, 2013 8:17 AM in response to planeta4166

    To remove the "InstallMac" spyware, start by following the instructions on this page. Back up all data before making any changes. The instructions may not remove the spyware completely.

    Triple-click anywhere in the line below on this page to select it:

    /Library/Frameworks/GenieoExtra.framework

    Right-click or control-click the line and select

     

    Services Reveal

    from the contextual menu.* A folder should open with an item selected. Move the selected item to the Trash. You may be prompted for your administrator password.

    Repeat with each of these lines:

     

    /Library/LaunchAgents/com.genieoinnovation.macextension.plist

    /Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist

    /Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client

     

    Then reboot.

    From the Safari menu bar, select

            

    Safari Preferences Extensions

         

    Uninstall any extension you don't recognize. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

    *If you don't see the contextual menu item, copy the selected text to the Clipboard (command-C). In the Finder, select

    Go Go to Folder...

    from the menu bar, paste into the box that opens (command-V). You won't see what you pasted because a line break is included. Press return.

  • by planeta4166,

    planeta4166 planeta4166 Sep 23, 2013 9:21 AM in response to Linc Davis
    Level 1 (0 points)
    Sep 23, 2013 9:21 AM in response to Linc Davis

    Thanks, it worked!!!

  • by Hasan Pandor,

    Hasan Pandor Hasan Pandor Dec 24, 2013 6:31 AM in response to Linc Davis
    Level 1 (0 points)
    Dec 24, 2013 6:31 AM in response to Linc Davis

    Thank you ever so much! Quite a relief, since it was decidedly frustrating going through a morning at work with that unwelcome surprise!

  • by thomas_r.,

    thomas_r. thomas_r. Dec 24, 2013 11:29 AM in response to planeta4166
    Level 7 (30,934 points)
    Mac OS X
    Dec 24, 2013 11:29 AM in response to planeta4166

    Note that you probably got InstallMac by downloading something from Softonic. You should avoid that site in the future. See:

     

    Continue to boycott Softonic

     

    Similarly untrustworthy is CNET's Download.com. See:

     

    Boycott CNET’s Download.com

  • by Mr. Game G,

    Mr. Game G Mr. Game G Feb 26, 2014 5:32 AM in response to Linc Davis
    Level 1 (0 points)
    Feb 26, 2014 5:32 AM in response to Linc Davis

    well this did the trick bing search was driving me crazy helpful!

  • by Lorif70,

    Lorif70 Lorif70 Mar 17, 2014 6:37 PM in response to Linc Davis
    Level 1 (0 points)
    Mar 17, 2014 6:37 PM in response to Linc Davis

    I was not successful.  I got my virus by dowloading a font and now I can only search with Bing and I can see InstallMac blip in the search bar and I no longer can search google.  I tried your above instructions with no luck.  Any other ideas for me?

    Thanks!

  • by thomas_r.,

    thomas_r. thomas_r. Mar 17, 2014 6:41 PM in response to Lorif70
    Level 7 (30,934 points)
    Mac OS X
    Mar 17, 2014 6:41 PM in response to Lorif70

    Linc's directions above were posted six months ago. Things have changed a bit since then. You'll find up-to-date removal instructions for the Genieo/InstallMac adware here:

     

    http://www.thesafemac.com/arg-genieo

  • by Lorif70,

    Lorif70 Lorif70 Mar 17, 2014 6:58 PM in response to thomas_r.
    Level 1 (0 points)
    Mar 17, 2014 6:58 PM in response to thomas_r.

    Thanks, but unfortunately I don't have any of the folders that you list.  Argh!

  • by thomas_r.,

    thomas_r. thomas_r. Mar 17, 2014 7:02 PM in response to Lorif70
    Level 7 (30,934 points)
    Mac OS X
    Mar 17, 2014 7:02 PM in response to Lorif70

    If you are still seeing searches redirected through InstallMac to Bing, then you still have the adware installed. Pay close attention to the addendum in those instructions. I strongly suspect you are somehow not looking in the right places or have skipped a step somewhere.

  • by Linc Davis,

    Linc Davis Linc Davis Mar 17, 2014 7:03 PM in response to Lorif70
    Level 10 (208,037 points)
    Applications
    Mar 17, 2014 7:03 PM in response to Lorif70

    1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem.

    2. If you don't already have a current backup, back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

    3. Below are instructions to run a UNIX shell script, a type of program. All it does is to collect information about the state of the computer. That information goes nowhere unless you choose to share it. However, you should be cautious about running any kind of program (not just a shell script) at the request of a stranger on a public message board. If you have doubts, search this site for other discussions in which this procedure has been followed without any report of ill effects. If you can't satisfy yourself that the instructions are safe, don't follow them. Ask for other options.

    Here's a summary of what you need to do, if you choose to proceed: Copy a line of text from this web page into the window of another application. Wait for the script to run. It usually takes a few minutes. Then paste the results, which will have been copied automatically, back into a reply on this page. The sequence is: copy, paste, wait, paste again. Details follow.

    4. You may have started the computer in "safe" mode. Preferably, these steps should be taken in “normal” mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual. If you can only test in safe mode, do that.

    5. If you have more than one user, and the one affected by the problem is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

    6. The script is a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, though you may not see all of it in the browser window, and you can then copy it. If you try to select the line by dragging across the part you can see, you won't get all of it.

    Triple-click anywhere in the line of text below on this page to select it:

    PATH=/usr/bin:/bin:/usr/sbin:/sbin; clear; Fb='%s\n\t(%s)\n'; Fm='\n%s\n\n%s\n'; Fr='\nRAM details\n%s\n'; Fs='\n%s: %s\n'; Fu='user %s%%, system %s%%'; AC="com.autodesk.AutoCAD  com.google.GoogleDrive"; H='^[[:space:]]*((127\.0\.0\.1|::1|fe80::1%lo0)[[:space:]]+local|(255\.){3}255[[:space:]]*broadcast)host[[:space:]]*$'; NS=networksetup; PB="/usr/libexec/PlistBuddy -c Print"; A () { [[ a -eq 0 ]]; }; M () { find -L "$d" -type f | while read f; do file -b "$f" | egrep -lq XML\|exec && echo $f; done; }; AT () { o=`file -b "$1" | egrep -v '^(A.{16}t$|cann)'`; Ps "${1##*/} format"; }; Pc () { o=`grep -v '^ *#' "$2"`; l=`wc -l <<< "$o"`; [[ l -gt 25 ]] && o=`head -n25 <<< "$o"`$'\n'"[$((l-25)) more line(s)]"; Pm "$1"; AT "$1"; }; Pm () { [[ "$o" ]] && o=`sed -E '/^ *$/d; s/^ */   /;s/[-0-9A-Fa-f]{22,}/UUID/g;s/(ochat)\.[^.]+(\..+)/\1\2/' <<< "$o"` && printf "$Fm" "$1" "$o"; }; Pp () { o=`$PB "$2" | awk -F'= ' \/$3'/{print $2}'`; Pm "$1"; }; Ps () { o=`echo $o`; [[ ! "$o" =~ ^0?$ ]] && printf "$Fs" "$1" "$o"; }; R () { o=; [[ r -eq 0 ]]; }; SP () { system_profiler SP${1}DataType; }; id -G | grep -qw 80; a=$?; A && sudo true; r=$?; t=`date +%s`; clear; { A || echo $'No admin access\n'; A && ! R && echo $'No root access\n'; SP Software | sed -n 's/^ *//;5p;6p;8p'; h=(`SP Hardware | awk '/ Id/{print $3}; /Mem/{print $2}'`); o=$h; Ps "Model"; o=$((h[1]<4?h[1]:0)); Ps "Total RAM (GB)"; o=`SP Memory | sed '1,5d;/[my].*:/d'`; [[ "$o" =~ s:\ [^O]|x([^08]|0[^2]|8[^0]) ]] && printf "$Fr" "$o"; o=`SP Diagnostics | sed '5,6!d'`; [[ "$o" =~ Pass ]] || Pm "POST"; p=`SP Power`; o=`awk '/Cy/{print $NF}' <<< "$p"`; o=$((o>=300?o:0)); Ps "Battery cycles"; o=`sed -n '/Cond.*: [^N]/{s/^.*://p;}' <<< "$p"`; Ps "Battery condition"; for b in FireWire Thunderbolt USB; do o=`SP $b | sed -En '1d;/:$/{s/ *:$//;x;s/\n//p;};/^ *(V.+ [0N]|Man).+ /{s/ 0x.... //;s/[()]//g;s/(.+: )(.+)/ \(\2\)/;H;};/Apple|Genesy|Intel|SMSC/{s/.//g;h;}' | egrep -v '^ *[(]'`; Pm $b; done; o=`pmset -g therm | sed 's/^.*C/C/'`; [[ "$o" =~ No\ th|pms ]] && o=; Pm "Thermal conditions"; o=`pmset -g sysload | grep -v :`; [[ "$o" =~ =\ [^GO] ]] || o=; Pm "System load advisory"; o=`nvram boot-args | awk '{$1=""; print}'`; Ps "boot-args"; a=(/ ""); A=(System User); for i in 0 1; do o=`cd ${a[$i]}L*/Lo*/Diag* || continue; for f in *.{cr,h,pa,s}*; do [[ -f "$f" ]] || continue; d=$(stat -f%Sc -t%F "$f"); [[ "$f" =~ h$ ]] && grep -lq "^Thread c" "$f" && f="$f *"; echo "$d ${f%%_2*} ${f##*.}"; done | sort | tail`; Pm "${A[$i]} diagnostics"; done; grep -lq '*$' <<< "$o" && printf $'\n\t* Code injection\n'; o=`syslog -F bsd -k Sender kernel -k Message CReq 'caug|GPU |hfs: Ru|last value [1-9]|n Cause: -|NVDA\(|pagin|proc: t|Roamed|rror|ssert|Thrott|timed? ?o|WARN' -k Message Ane 'SMC:' | tail -n25 | awk '/:/{$4=""; $5=""};1'`; Pm "Kernel messages"; o=`df -m / | awk 'NR==2 {print $4}'`; o=$((o<5120?o:0)); Ps "Free space (MiB)"; o=$(($(vm_stat | awk '/eo/{sub("\\.",""); print $2}')/256)); o=$((o>=1024?o:0)); Ps "Pageouts (MiB)"; s=( `sar -u 1 10 | sed '$!d'` ); [[ s[4] -lt 85 ]] && o=`printf "$Fu" ${s[1]} ${s[3]}` || o=; Ps "Total CPU usage" && { s=(`ps acrx -o comm,ruid,%cpu | sed '2!d'`); n=$((${#s[*]}-1)); c="${s[*]}"; o=${s[$n]}%; Ps "CPU usage by process \"${c% ${s[$((n-1))]}*}\" with UID ${s[$((n-1))]}"; }; s=(`top -R -l1 -n1 -o prt -stats command,uid,prt | sed '$!d'`); n=$((${#s[*]}-1)); s[$n]=${s[$n]%[+-]}; c="${s[*]}"; o=$((s[$n]>=25000?s[$n]:0)); Ps "Mach ports used by process \"${c% ${s[$((n-1))]}*}\" with UID ${s[$((n-1))]}"; o=`kextstat -kl | grep -v com\\.apple | cut -c53- | cut -d\< -f1`; Pm "Loaded extrinsic kernel extensions"; R && o=`sudo launchctl list | awk 'NR>1 && !/0x|com\.(apple|openssh|vix\.cron)|org\.(amav|apac|calendarse|cups|dove|isc|ntp|openld|post[fg]|x)/{print $3}'`; Pm "Extrinsic daemons"; o=`launchctl list | awk 'NR>1 && !/0x|com\.apple|org\.(x|openbsd)|\.[0-9]+$/{print $3}'`; Pm "Extrinsic agents"; o=`for d in {/,}L*/Lau*; do M; done | egrep -v 'com\.apple\.(CSConfig|server)' | while read f; do ID=$($PB\ :Label "$f") || ID="No job label"; printf "$Fb" "$f" "$ID"; done`; Pm "launchd items"; o=`for d in /{S*/,}L*/StartupItems; do M; done`; Pm "Startup items"; sys=`pkgutil --regexp --only-files --files com.apple.pkg.* | sort | uniq | sed 's:^:/:'`; b=`sed -E '/^.+Lib.+\/Contents\/Info.plist$/!d;s/\/Info.plist$//;/Contents\/./d' <<< "$sys"`; l=`egrep '^/usr/lib/.+dylib$' <<< "$sys"`; [[ "$b" && "$l" ]] && { o=`find -L /S*/L*/{C*/Sec*A,E}* {/,}L*/{A*d,Compon,Ex,In,iTu,Keyb,Mail/B,P*P,Qu*T,Scripti,Sec,Servi,Spo}* -type d -name Contents -prune | grep -Fv "$b" | while read d; do test -f "$d/Info.plist" || continue; ID=$($PB\ :CFBundleIdentifier "$_") || ID="No bundle ID"; printf "$Fb" "${d%/Contents}" "$ID"; done`; Pm "Extrinsic loadable bundles"; o=`find /usr/lib -type f -name *.dylib | grep -Fv "$l"`; Pm "Extrinsic shared libraries"; :; } || echo $'\nReceipts missing'; o=`for e in INSERT_LIBRARIES LIBRARY_PATH; do launchctl getenv DYLD_$e; done`; Pm "Environment"; o=`find -L {,/u*/lo*}/e*/periodic -type f -mtime -10d`; Pm "Modified periodic scripts"; o=`scutil --proxy | grep Prox`; Pm "Proxies"; o=`scutil --dns | awk '/r\[0\] /{if ($NF !~ /^1(0|72\.(1[6-9]|2[0-9]|3[0-1])|92\.168)\./) print $NF; exit}'`; i=`route -n get default | awk '/e:/{print $2}'`; I=`$NS -listnetworkserviceorder | sed -En '/ '$i'\)$/{x;s/^\(.+\) //p;q;};x'`; n=`$NS -getdnsservers "$I" | awk '!/^T/{print "not "}'`; Ps "DNS (${n}from DHCP)"; o=`$NS -getinfo "$I" | awk '/k:/{if ($3 !~ "(255\.){3}0") print $3}'`; Ps "Netmask"; R && o=`sudo profiles -P | grep : | wc -l`; Ps "Profiles"; f=auto_master; [[ `md5 -q /etc/$f` =~ ^b166 ]] || Pc $f /etc/$f; for f in fstab sysctl.conf crontab launchd.conf; do Pc $f /etc/$f; done; f=/etc/hosts; Pc "hosts" <(egrep -v "$H" $f ); AT $f; Pc "User launchd" ~/.launchd*; R && Pc "Root crontab" <(sudo crontab -l); Pc "User crontab" <(crontab -l | sed -E 's:/Users/[^/]+/:/Users/USER/:g'); R && o=`sudo defaults read com.apple.loginwindow LoginHook`; Pm "Login hook"; LD="$(`find /S*/*/F* -type f -name lsregister | head -n1` -dump)"; o=`for ID in $AC; do [[ "$LD" =~ $ID ]] && echo $ID; done`; Pm "Application check"; Pp "Global login items" /L*/P*/loginw* Path; Pp "User login items" L*/P*/*loginit* Name; Pp "Safari extensions" L*/Saf*/*/E*.plist Bundle | sed -E 's/(\..*$|-[1-9])//g'; o=`find ~ $TMPDIR.. \( -flags +sappnd,schg,uappnd,uchg -o ! -user $UID -o ! -perm -600 \) | wc -l`; Ps "Restricted user files"; cd; o=`SP Fonts | egrep 'id: N|te: Y' | wc -l`; Ps "Font problems"; o=`find L*/{Con,Pref}* -type f ! -size 0 -name *.plist | while read f; do plutil -s "$f" >&- || echo $f; done`; Pm "Bad plists"; d=(Desktop L*/Keyc*); n=(20 7); for i in 0 1; do o=`find "${d[$i]}" -type f -maxdepth 1 | wc -l`; o=$((o<=n[$i]?0:o)); Ps "${d[$i]##*/} file count"; done; o=; [[ UID -eq 0 ]] && o=root; Ps "UID"; o=$((`date +%s`-t)); Ps "Elapsed time (s)"; } 2>/dev/null | pbcopy; exit 2>&-
    Copy the selected text to the Clipboard by pressing the key combination command-C.

    7. Launch the built-in Terminal application in any of the following ways:

    ☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

    ☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

    ☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.

    Click anywhere in the Terminal window and paste (command-V). The text you pasted should vanish immediately. If it doesn't, press the return key.

    8. If you see an error message in the Terminal window such as "syntax error," enter

    exec bash

    and press return. Then paste the script again.

    9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. In most cases, the difference is not important. If you don't know the password, or if you prefer not to enter it, press the key combination control-C or just press return three times at the password prompt. Again, the script will still run.

    If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

    10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, there will be nothing in the Terminal window and no indication of progress. Wait for the line

    [Process completed]

    to appear. If you don't see it within half an hour or so, the test probably won't complete in a reasonable time. In that case, close the Terminal window and report the results. No harm will be done.

    11. When the test is complete, quit Terminal. The results will have been copied to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

    If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

    12. When you post the results, you might see the message, "You have included content in your post that is not permitted." It means that the forum software has misidentified something in the post as a violation of the rules. If that happens, please post the test results on Pastebin, then post a link here to the page you created.

    Note: This is a public forum, and others may give you advice based on the results of the test. They speak only for themselves, and I don't necessarily agree with them.

     

    ________________________________

      
    Copyright © 2014 by Linc Davis. As the sole author of this work, I reserve all rights to it except as provided in the Terms of Use of the Apple Support Communities website ("ASC"). Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.
  • by Lorif70,

    Lorif70 Lorif70 Mar 18, 2014 5:05 PM in response to Linc Davis
    Level 1 (0 points)
    Mar 18, 2014 5:05 PM in response to Linc Davis

    System Version: OS X 10.8.4 (12E55)

    Kernel Version: Darwin 12.4.0

    Boot Mode: Normal

     

     

    Model: MacBookPro10,1

     

     

    Kernel messages

     

     

       Mar 12 06:59:45   PM notification timeout (pid 234, Adobe CEF Helper)

       Mar 15 19:33:20   PM notification timeout (pid 202, Creative Cloud)

       --- last message repeated 1 time ---

       Mar 15 22:22:48   wl0: Roamed or switched channel, reason #8, bssid 00:1d:d3:0c:57:00

       --- last message repeated 2 times ---

       Mar 16 15:28:35   PM notification timeout (pid 202, Creative Cloud)

       Mar 16 17:52:24   wl0: Roamed or switched channel, reason #2, bssid 00:1d:d3:0c:57:00

       Mar 16 18:01:19   wl0: Roamed or switched channel, reason #8, bssid 00:1d:d3:0c:57:00

       --- last message repeated 3 times ---

       Mar 16 18:16:19   PM notification timeout (pid 202, Creative Cloud)

       --- last message repeated 1 time ---

       Mar 16 20:09:50   wl0: Roamed or switched channel, reason #8, bssid 00:1d:d3:0c:57:00

       Mar 16 20:46:43   PM notification timeout (pid 202, Creative Cloud)

       Mar 16 21:09:48   wl0: Roamed or switched channel, reason #2, bssid 00:1d:d3:0c:57:00

       Mar 16 21:33:03   PM notification timeout (pid 202, Creative Cloud)

       Mar 17 20:59:02   wl0: Roamed or switched channel, reason #8, bssid 00:1d:d3:0c:57:00

       --- last message repeated 20 times ---

       Mar 17 22:28:28   PM notification timeout (pid 182, HP Device Monito)

       Mar 18 19:48:40   Sound assertion in AppleHDAController at line 5066

       Mar 18 19:48:40   Sound assertion in IOHDACodecDevice at line 161

       Mar 18 19:48:41   Sound assertion in AppleHDAController at line 5066

       Mar 18 19:48:41   Sound assertion in IOHDACodecDevice at line 161

       Mar 18 19:48:41   Sound assertion in AppleHDAFunctionGroup at line 1104

       Mar 18 19:48:41   Sound assertion in AppleHDADriver at line 3181

       Mar 18 19:48:41   Sound assertion in AppleHDADriver at line 3135

     

     

    Loaded extrinsic kernel extensions

     

     

       com.rim.driver.BlackBerryUSBDriverInt (0.0.68)

     

     

    Extrinsic daemons

     

     

       com.zeobit.MacKeeper.plugin.AntiTheft.daemon

       com.smithmicro.vzwwirelessd

       com.oracle.java.Helper-Tool

       com.microsoft.office.licensing.helper

       com.fitbit.galileod

       com.adobe.SwitchBoard

       com.adobe.fpsaud

     

     

    Extrinsic agents

     

     

       com.wacom.pentablet

       com.oracle.java.Java-Updater

       com.hp.messagecenter.launcher

       com.hp.devicemonitor

       com.adobe.AdobeCreativeCloud

       com.zeobit.MacKeeper.Helper

       com.macpaw.CleanMyMac2Helper.trashWatcher

       com.macpaw.CleanMyMac2Helper.scheduledScan

       com.macpaw.CleanMyMac2Helper.diskSpaceWatcher

       com.google.keystone.user.agent

       com.adobe.ARM.UUID

     

     

    launchd items

     

     

       /Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist

                 (com.adobe.AAM.Startup-1.0)

       /Library/LaunchAgents/com.adobe.AdobeCreativeCloud.plist

                 (com.adobe.AdobeCreativeCloud)

       /Library/LaunchAgents/com.hp.devicemonitor.plist

                 (com.hp.devicemonitor)

       /Library/LaunchAgents/com.hp.messagecenter.launcher.plist

                 (com.hp.messagecenter.launcher)

       /Library/LaunchAgents/com.oracle.java.Java-Updater.plist

                 (com.oracle.java.Java-Updater)

       /Library/LaunchAgents/com.wacom.pentablet.plist

                 (com.wacom.pentablet)

       /Library/LaunchDaemons/com.adobe.fpsaud.plist

                 (com.adobe.fpsaud)

       /Library/LaunchDaemons/com.adobe.SwitchBoard.plist

                 (com.adobe.SwitchBoard)

       /Library/LaunchDaemons/com.fitbit.galileod.plist

                 (com.fitbit.galileod)

       /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist

                 (com.microsoft.office.licensing.helper)

       /Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist

                 (com.oracle.java.Helper-Tool)

       /Library/LaunchDaemons/com.smithmicro.vzwwirelessd.plist

                 (com.smithmicro.vzwwirelessd)

       /Library/LaunchDaemons/com.zeobit.MacKeeper.plugin.AntiTheft.daemon.plist

                 (com.zeobit.MacKeeper.plugin.AntiTheft.daemon)

       Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist

                 (com.adobe.AAM.Scheduler-1.0)

       Library/LaunchAgents/com.adobe.ARM.UUID.plist

                 (com.adobe.ARM.UUID)

       Library/LaunchAgents/com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID. plist

                 (com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.UUID)

       Library/LaunchAgents/com.google.keystone.agent.plist

                 (com.google.keystone.user.agent)

       Library/LaunchAgents/com.macpaw.CleanMyMac2Helper.diskSpaceWatcher.plist

                 (com.macpaw.CleanMyMac2Helper.diskSpaceWatcher)

       Library/LaunchAgents/com.macpaw.CleanMyMac2Helper.scheduledScan.plist

                 (com.macpaw.CleanMyMac2Helper.scheduledScan)

       Library/LaunchAgents/com.macpaw.CleanMyMac2Helper.trashWatcher.plist

                 (com.macpaw.CleanMyMac2Helper.trashWatcher)

       Library/LaunchAgents/com.zeobit.MacKeeper.Helper.plist

                 (com.zeobit.MacKeeper.Helper)

     

     

    Extrinsic loadable bundles

     

     

       /System/Library/Extensions/2.2.0/Belcarra.USBLAN_netpart.kext

                 (com.Belcarra.iokit.USBLAN_netpart)

       /System/Library/Extensions/2.2.0/Belcarra.USBLAN_usbpart.kext

                 (com.Belcarra.iokit.USBLAN_usbpart)

       /System/Library/Extensions/2.2.0/RemoteControl.USBLAN_usbpart.kext

                 (com.RemoteControl.USBLAN.usbpart)

       /System/Library/Extensions/3.1.1/Belcarra.USBLAN_netpart.kext

                 (com.Belcarra.iokit.USBLAN_netpart)

       /System/Library/Extensions/3.1.1/Belcarra.USBLAN_usbpart.kext

                 (com.Belcarra.iokit.USBLAN_usbpart)

       /System/Library/Extensions/3.1.1/RemoteControl.USBLAN_usbpart.kext

                 (com.RemoteControl.USBLAN.usbpart)

       /System/Library/Extensions/Belcarra.USBLAN_netpart.kext

                 (com.Belcarra.iokit.USBLAN_netpart)

       /System/Library/Extensions/Belcarra.USBLAN_usbpart.kext

                 (com.Belcarra.iokit.USBLAN_usbpart)

       /System/Library/Extensions/LGEMobileSolutionFamily.kext

                 (com.lge.driver.LGEMobilSolutionFamily)

       /System/Library/Extensions/NovatelWirelessWWAN.kext

                 (com.novatelwireless.kext.wwan)

       /System/Library/Extensions/Pen Tablet.kext

                 (com.wacom.kext.pentablet)

       /System/Library/Extensions/PTRayUSBFamily.kext

                 (com.pantech.driver.PTRayUSBFamily)

       /System/Library/Extensions/PTUMWDrv.kext

                 (com.vaultmicro.driver.PTUMWDrv)

       /System/Library/Extensions/RemoteControl.USBLAN_usbpart.kext

                 (com.RemoteControl.USBLAN.usbpart)

       /System/Library/Extensions/RIMBBUSB.kext

                 (com.rim.driver.BlackBerryUSBDriverInt)

       /System/Library/Extensions/RIMBBVSP.kext

                 (com.rim.driver.BlackBerryUSBDriverVSP)

       /System/Library/Extensions/SierraDevSupport.kext

                 (com.sierrawireless.driver.SierraDevSupport)

       /System/Library/Extensions/SierraFSCSupport.kext

                 (com.sierrawireless.driver.SierraFSCSupport)

       /System/Library/Extensions/SierraFSRSupport.kext

                 (com.sierrawireless.driver.SierraFSRSupport)

       /System/Library/Extensions/SierraHSRSupport.kext

                 (com.sierrawireless.driver.SierraHSRSupport)

       /System/Library/Extensions/SMSIWirelessModem.kext

                 (com.smithmicro.driver.SMSIWirelessModem)

       /System/Library/Extensions/TabletDriverCFPlugin.bundle

                 (No bundle ID)

       /System/Library/Extensions/ZTEUSBCDCACMData.kext

                 (com.ZTE.driver.ZTEUSBCDCACMData)

       /Library/Audio/Plug-Ins/Components/Flip4Mac WMA Import.component

                 (net.telestream.wmv.import)

       /Library/Internet Plug-Ins/AdobeAAMDetect.plugin

                 (com.AdobeAAMDetectLib.AdobeAAMDetect)

       /Library/Internet Plug-Ins/AdobePDFViewer.plugin

                 (com.adobe.acrobat.pdfviewer)

       /Library/Internet Plug-Ins/AdobePDFViewerNPAPI.plugin

                 (com.adobe.acrobat.pdfviewerNPAPI)

       /Library/Internet Plug-Ins/Flash Player.plugin

                 (com.macromedia.Flash Player.plugin)

       /Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin

                 (net.telestream.wmv.plugin)

       /Library/Internet Plug-Ins/JavaAppletPlugin.plugin

                 (com.oracle.java.JavaAppletPlugin)

       /Library/Internet Plug-Ins/net.juniper.DSSafariExtensions.plugin

                 (net.juniper.DSSafariExtensions.plugin)

       /Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin

                 (com.microsoft.sharepoint.browserplugin)

       /Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin

                 (com.microsoft.sharepoint.webkitplugin)

       /Library/Internet Plug-Ins/WacomNetscape.plugin

                 (com.wacom.tabletplugin)

       /Library/Internet Plug-Ins/WacomTabletPlugin.plugin

                 (com.WacomTabletPluginLib.WacomTabletPlugin)

       /Library/PreferencePanes/Flash Player.prefPane

                 (com.adobe.flashplayerpreferences)

       /Library/PreferencePanes/Flip4Mac WMV.prefPane

                 (net.telestream.wmv.prefpane)

       /Library/PreferencePanes/JavaControlPanel.prefPane

                 (com.oracle.java.JavaControlPanel)

       /Library/PreferencePanes/PenTablet.prefPane

                 (com.wacom.PenTabletSettingsPrefPane)

       /Library/QuickTime/Flip4Mac WMV Advanced.component

                 (net.telestream.wmv.advanced)

       /Library/QuickTime/Flip4Mac WMV Export.component

                 (net.telestream.wmv.export)

       /Library/QuickTime/Flip4Mac WMV Import.component

                 (net.telestream.wmv.import)

       /Library/ScriptingAdditions/Adobe Unit Types.osax

                 (No bundle ID)

       Library/Internet Plug-Ins/WebEx64.plugin

                 (com.cisco_webex.plugin.gpc64)

     

     

    DNS (from DHCP): 72.240.13.7

     

     

    User login items

     

     

       iTunesHelper

       Fitbit Connect Menubar Helper

     

     

    Safari extensions

     

     

       Omnibar

     

     

    Restricted user files: 41

     

     

    Font problems: 26

     

     

    Desktop file count: 38

     

     

    Elapsed time (s): 51

  • by Linc Davis,

    Linc Davis Linc Davis Mar 18, 2014 5:20 PM in response to Lorif70
    Level 10 (208,037 points)
    Applications
    Mar 18, 2014 5:20 PM in response to Lorif70

    From the Safari menu bar, select

            

    Safari Preferences... Extensions

         

    Delete the "Omnibar" extension.

     

    Although they're not related to your problem, you've also installed the "CleanMyMac" and "MacKeeper" scam "utilities." Both should be removed. You need to become much more selective about installing software, and less responsive to Internet marketing hype.

    Remove "CleanMyMac" by following the first set of instructions on this page. If you have a different version of the product, the procedure may be different. Do not drag the CleanMyMac application to the Trash.

    Remove "MacKeeper" as follows.

    "MacKeeper" has only one useful feature: it deletes itself.

    Note: These instructions apply to the version of the product that I downloaded and tested in early 2012. I can't be sure that they apply to other versions.

    IMPORTANT: "MacKeeper" has what the developer calls an “encryption” feature. In my tests, I didn't try to verify what this feature really does. If you used it to “encrypt” any of your files, “decrypt” them before you uninstall, or (preferably) restore the files from backups made before they were “encrypted.” As the developer is not trustworthy, you should assume that the "decrypted" files are corrupt unless proven otherwise.

    In the Finder, select

    Go Applications

    from the menu bar, or press the key combination shift-command-A. The "MacKeeper" application is in the folder that opens. Quit it if it's running, then drag it to the Trash. You'll be prompted for your login password. Click the Uninstall MacKeeper button in the dialog that appears. All the functional components of the software will be deleted. Reboot.

    Quit MacKeeper before dragging it to the Trash.

    Don't empty the Trash. Let MacKeeper delete itself.

    Don't try to drag the MacKeeper Dock icon to the Trash.

    Back up all data before making any changes.

  • by Lorif70,

    Lorif70 Lorif70 Mar 18, 2014 6:34 PM in response to Linc Davis
    Level 1 (0 points)
    Mar 18, 2014 6:34 PM in response to Linc Davis

    Thanks, I will try this once Maverick is finished downloading (I was hoping this might solve it!?).  It's interesting but the CleanMyMac is what actually caused this, I think.  I downloaded a font and this is what launched instead of the font folder.  When I double clicked the downloaded font folder, this program launched and took over!  I never downloaded this and actually thought I deleted all of the files once I realized this is what happened.  UGH!  I did download the MacKeeper in hopes of helping solve this, but apparently that didn't help!  Stay tuned.

Page 1 of 3 last Next