Apple Event: May 7th at 7 am PT
After downloading mackeeper and reading horror story reviews and warnings about the product i imediatley un-instaled it and then emptied my 'trash' on my macbook pro. Is this enough to un-do any damage mackeeper may have done to my new computer? If it has already done damage to my computer is there any way to rectify this? I am extremely worried, after spending a lot of money on a new computer, of the potential damage this software could cause.
MacBook Pro
MacKeeper, while junk, is not malware as some people are fond of calling it. If you uninstalled it properly (by dragging it to the trash and then allowing it to remove itself when asked), then all components should be gone.
As to damage to your system, did you allow it to do any "cleaning?" If so, it's possible it could have removed something important. Using "cleaning" utilities incurs that risk. If you're not having any problems, I wouldn't worry about it.
At most, you would probably just need to reinstall the system, which can be done on top of the current system. This replaces any potentially damaged or missing components with new ones, and leaves all your data alone, so ideally you wouldn't notice any difference. I don't believe that this should be necessary, but if you do have issues and decide to reinstall, just be sure to make a good set of backups in case something goes wrong.
Thank you. I did follow this article and removed those items. Yet when I ran bitdefender it found more files not listed. I don't know if Genieo has evolved or was changed since the article was written. I'm still struggling to rectify this insidious adware.
RevoltAnon wrote:
Thank you. I did follow this article and removed those items. Yet when I ran bitdefender it found more files not listed. I don't know if Genieo has evolved or was changed since the article was written.
Perhaps it found the installer which is not specifically listed as something that should be trashed. The article was up-to-date as of late last week, but you are correct that it has evolved to version 2.0. I'm not certain that thomas_r. has had a chance to fully analyze it yet, I'll need to ask. He did find a new version of Go.Photo.it which includes both Genieo and a VSearch components today, so watch for that update.
I found this file in launch agents
com.genieo.completer.update.plist
is it safe to delete or move to trash?
I moved it to trash and empied trash already, I also found the launcher for Mackeeper still in there and did the same, I hope I don't mess up my computer...
is this safe it's Nexdef software launcher... com.mlbam.nexdef.core.NexdefLoader.plist
Message was edited by: RevoltAnon
btw. This is what bitdefender found and deleted...
| Adware.MAC.OSX.Genieo.A | Deleted | /Users/mikewoltmann/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/Resources/Applica tion.app/Contents/Frameworks/gen_ext_bundle.framework/Versions/A/gen_ext_bundle |
| Adware.MAC.OSX.Genieo.A | Deleted | /Users/mikewoltmann/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/Resources/Applica tion.app/Contents/Frameworks/gen_ext_bundle.framework/Versions/A/Resources/gen_e xt_bundle_stub.bundle/Contents/MacOS/gen_ext_bundle_stub |
| Adware.MAC.OSX.Genieo.A | Deleted | /Users/mikewoltmann/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/Resources/Applica tion.app/Contents/Library/LaunchServices/com.genieoinnovation.macextension.clien t |
| Adware.MAC.OSX.Genieo.A | Deleted | /Users/mikewoltmann/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/Resources/Applica tion.app/Contents/MacOS/Application |
| Adware.MAC.OSX.Genieo.A | Deleted | /Users/mikewoltmann/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/Resources/Applica tion.app/Contents/Resources/en.lproj/com.genieoinnovation.macextension.plist |
| Adware.MAC.OSX.Genieo.A | Deleted | /Users/mikewoltmann/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/Resources/Applica tion.app/Contents/Resources/Payload.bundle/Contents/MacOS/Payload |
| Adware.MAC.OSX.Genieo.A | Deleted | /Users/mikewoltmann/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/Resources/libimck it.dylib.png |
| Adware.MAC.OSX.Genieo.A | Deleted | /Users/mikewoltmann/Library/Application Support/com.genieoinnovation.Installer/Completer.app/Contents/Resources/libimck itsa.dylib.png |
Message was edited by: RevoltAnon
RevoltAnon wrote:
I found this file in launch agents
com.genieo.completer.update.plist
is it safe to delete or move to trash?
Yes, that should be fine.
I also found the launcher for Mackeeper still in there and did the same, I hope I don't mess up my computer
From what I remember about MacKeeper, it may have been difficult to remove everything, but at least there was no danger of getting locked out of one's computer. The same thing cannot be said for Genieo if the /etc/launchd.conf file isn't removed before the .dylib files.
LaunchAgents are OK and removal will probably speed up your login by a millisecond or so.
RevoltAnon wrote:
is this safe it's Nexdef software launcher... com.mlbam.nexdef.core.NexdefLoader.plist
I'm going to have to look into that. Are you thinking you don't need NexDef any more? It would appear to be associated with watching MLB games so it that's something you do I would hang onto it.
Thanks for the BitDefender update. It would appear that Genieo has just moved the files to a more conventional location. Probably trying to keep Apple from revoking their Apple Developer ID.
Thanks again. Bitdefender has been running for over 8 hours scanning all externals. I don't know why it's scanning my backup drive and backups. Ran a scan of running programs and no malware was detected.
Also I got rid of that chrome notification bell in menu bar since it annoyed me.
Thanks for all your help. Genieo has really stressed me out. Never download anything from Cnet in my humble opinion. Live and learn. I just hope system restarts okay tomorrow after all these changes. Thought I fixed the Genieo thing until I ran bitdefender and it found more files. Made me nervous and I already am OCD about my computer. Lol
Btw. I can't believe Apple gave them an Apple Developer ID. Such a vicious program. In my opinion
RevoltAnon wrote:
Bitdefender has been running for over 8 hours scanning all externals. I don't know why it's scanning my backup drive and backups.
That usually happens when you scan your entire hard drive and it gets to the invisible /Volumes/ directory (folder) where it finds a mount point for all mounted hard drives. Hopefully your backup drive is locked so as not to allow BitDefender to move or delete anything it finds as that will probably corrupt your backup, making it useless. TimeMachine volumes are locked in my experience.
Thanks again for posting those new file locations. I've passed it on to thomas_r. and expect him to have updated instructions available in a day or so.
RevoltAnon wrote:
I can't believe Apple gave them an Apple Developer ID.
Anybody with $99 gets can get a Apple Developer ID whether they ever develop anything or not. So far I know of two that distributed what was clearly malware, resulting in their certification being pulled. Some folks have been partitioning Apple to do the same with Genieo, but so far they apparently don't agree. It took awhile before the A-V folks came around to identify it as adware, so hopefully they will change their mind soon and save us all from this aggravation. If you feel moved to give them your opinion, feel free to visit Apple Product Security and send them a note.
RevoltAnon wrote:
I don't know if Genieo has evolved or was changed since the article was written.
It would appear that there is a variant out there that I haven't seen. The new adware installer I found yesterday, which MadMacs0 was talking about, does not install this Completer.app. Do you have any idea where you might have downloaded this from?
I can't remember what site it was but I was trying to download app zapper and just Googled it clicked a link it said download app zapper but when it downloaded it was only Genieo and I was ignorant and figured that was just name of company that made it so I installed it still not thinking it was malware or adware I completely installed and opened it that's when I was like what did I just do. I am sorry I don't know the url.
Mackeeper
