I have OS X version 10.8.5 and have extensively searched for a way to remove this virus from my computer. However, all the discussions seem to recommend that I find certain folders or files in my library, and none of them are even there for me to delete and the problem persists. What do I do to get rid of it?
MacBook Pro with Retina display, OS X Mountain Lion (10.8.5)
Google it.There is a a lot of info there.
Why do you think that you have a virus? it's more likely to be a hoax of a virus than an actual virus.
Are you experiencing a problem? What is it?
Robert
To remove the Conduit spyware, take the steps below.
Triple-click the line below on this page to select it:
~/Library/Application Support/Conduit
Copy the selected text to the Clipboard by pressing the key combination command-C. From the Finder menu bar, select
Go ▹ Go to Folder…
Paste into the box that opens (command-V), then press return. A Finder window should open with a folder named "Conduit" selected. If it does, delete the selected item.
Repeat with this line:
/Applications/Toolbars
Now you're deleting a folder named "Toolbars". You may be prompted for your login password. Next, copy this line:
/Library
I've seen a report that Conduit may be bundled with a scam "utility" called "MacKeeper." If you installed MacKeeper, you should remove it according to the developer's instructions. It's worthless and causes many problems reported on this site.
Thank you for your comments. I searched for the folder
~/Library/Application Support/Conduit
with the instructions you suggested but it tells me it does not exist. I can get to the Application Support folder, but there is no folder within that directory that is called "Conduit". In addition, within the Library direction there is no Applications folder. I tried to find the four points you indicated below that, but again, there are no "Conduit", CTLoader, plist or osax files with those names. So, I can't delete anything because it's either not there or I can't find it. What can I do from here?
Why do you think Conduit is installed?
I foolishly downloaded a picture editing program from the internet and it installed along with it, which changed my homepage and search preferences on both chrome and safari. I fixed the issue on chrome just by deleting the preferences it had changed and getting rid of it's extension, but on safari even though my preferred search engine is google it automatically switches any search I've made to bing instead of Google unless I actually search things from the google homepage. I'd like to get this off my computer as I use it a lot for my work, but I'm not really sure how to do it! Any of your expertise would be very much appreciated!
You installed the "Genieo" scam product. There is an uninstaller, but as the developer is not trustworthy, you shouldn't rely on it. I suggest the tedious procedure below to disable Genieo.
Back up all data. You must know how to restore from a backup even if the system becomes unbootable. If you don't know that, stop here and ask for guidance.
Quit the Genieo application, if it's running. Triple-click anywhere in the line below on this page to select it:
/etc/launchd.conf
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.
If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar, paste into the box that opens (command-V). You won't see what you pasted because a line break is included. Press return.
A folder may open with a file selected, or the file may be absent, in which case you'll get a message that it doesn't exist. If it does exist, it's a configuration file created or replaced by the Genieo installer. Any software installer that does this should be considered ipso facto malware. Move the file to the Trash. You'll be prompted for your administrator password.
IMPORTANT: If the launchd.conf file exists, you must move it to the Trash it before continuing. Otherwise the systemwill become unbootable. In that case, restore from your backup and start over. That's how badly Genieo has sabotaged your system.
Repeat with each of these lines:
/Applications/Genieo.app/Applications/Uninstall Genieo.app/Library/Frameworks/GenieoExtra.framework/Library/LaunchAgents/com.genieo.engine.plist/Library/LaunchAgents/com.genieoinnovation.macextension.plist/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client/usr/lib/libgenkit.dylib/usr/lib/libimckit.dylib/usr/lib/libimckitsa.dylib
Again, some of these items may be absent, in which case you'll get a message that the file doesn't exist. Skip that item and go on to the next one.
Reboot. Your web browsers should now function normally, and you should be able to reset the home page and search engine. If not, stop here and post your results.
From the Safari menu bar, select
Safari ▹ Preferences ▹ Extensions
Uninstall any extensions you don't know you need, including one called "Spigot" if it's present. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
The Genieo installer may also install the "Silverlight" web plugin from Microsoft. If you have no use for that plugin, you should remove it according to Microsoft's instructions. Don't remove it if you subscribe to "Netflix."
This procedure may leave a few files behind, but it should deactivate Genieo. Make sure you don't repeat the mistake that led you to install it. Chances are you got it from one of the Internet's open sewers such as "Softonic" or "CNET Download." Never visit either of those sites again.
Finally, be forewarned that when Genieo is mentioned on this site, the developer sometimes shows up under the name "Genieo support." If that happens, don't believe anything he says, but feel free to tell him what you think of his scam.
Ok, I'll try all of this, but I feel like I should consult about the backing up all data: I have an external hardrive, I can use time machine to back up all data on my computer, but I've never restored anything from a back-up drive before. Any suggestions before I proceed?
I searched high and low for a full day to find the answer. Tried everything that was said in this forum and nothing worked. I had the ****** conduit still hijacking my search on the address bar. And then I found it. Someone on another forum guaranteed that by dowmloading this app it would work in clearing all isues regarding conduit. So I did and IT WORKED!!!
http://www.installmac.com/downloads/Uninstaller.dmg
Thanks madmara1966, this solved it for me.
Note that InstallMac has nothing to do with Conduit. These are two unrelated pieces of adware. Further, note that the InstallMac uninstaller is completely worthless for removing InstallMac, leaving hidden pieces of the adware behind that are kept actively running at all times.
Proper identification and removal of each of these should be done according to the instructions in my Adware Removal Guide.
Removing search conduit
