Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Bing redirect on the Safari Google Search Bar

When I open Safari and try to search something- anything- my page is redirected through 'search.install.mac' something like that. Its hard to read because it goes by so fast, but after the mac.installer, it takes me straight to a Bing search for the exact same thing I tried searching on Google. Please help me. This problem is extremely frustrating and I'm afraid that the problem could become larger. Thanks

MacBook Pro (13-inch Mid 2012), OS X Mavericks (10.9.1)

Posted on Jan 26, 2014 4:07 PM

Reply
Question marked as Best reply

Posted on Jan 26, 2014 4:33 PM

You installed the "Genieo" scam product. There is an uninstaller, but as the developer is not trustworthy, you shouldn't rely on it. I suggest the tedious procedure below to disable Genieo.

Back up all data. You must know how to restore from a backup even if the system becomes unbootable. If you don't know that, stop here and ask for guidance.


Quit the Genieo application, if it's running. Triple-click anywhere in the line below on this page to select it:


/etc/launchd.conf


Right-click or control-click the line and select

Services Reveal in Finder (or just Reveal)


from the contextual menu.

If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go Go to Folder...

from the menu bar, paste into the box that opens (command-V). You won't see what you pasted because a line break is included. Press return.


A folder may open with a file selected, or the file may be absent, in which case you'll get a message that it doesn't exist. If it does exist, it's a configuration file created or replaced by the Genieo installer. Any software installer that does this should be considered ipso facto malware. Move the file to the Trash. You'll be prompted for your administrator password.

IMPORTANT: If the launchd.conf file exists, you must move it to the Trash it before continuing. Otherwise the systemwill become unbootable. In that case, restore from your backup and start over. That's how badly Genieo has sabotaged your system.


Repeat with each of these lines:



/Applications/Genieo.app
/Applications/Uninstall Genieo.app
/Library/Frameworks/GenieoExtra.framework
/Library/LaunchAgents/com.genieo.engine.plist
/Library/LaunchAgents/com.genieoinnovation.macextension.plist
/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist
/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client
/usr/lib/libgenkit.dylib
/usr/lib/libimckit.dylib
/usr/lib/libimckitsa.dylib


Again, some of these items may be absent, in which case you'll get a message that the file doesn't exist. Skip that item and go on to the next one.

Reboot. Your web browsers should now function normally, and you should be able to reset the home page and search engine. If not, stop here and post your results.

From the Safari menu bar, select

Safari Preferences Extensions

Uninstall any extensions you don't know you need, including one called "Spigot" if it's present. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

The Genieo installer may also install the "Silverlight" web plugin from Microsoft. If you have no use for that plugin, you should remove it according to Microsoft's instructions. Don't remove it if you subscribe to "Netflix."

This procedure may leave a few files behind, but it should deactivate Genieo. Make sure you don't repeat the mistake that led you to install it. Chances are you got it from one of the Internet's open sewers such as "Softonic" or "CNET Download." Never visit either of those sites again.

Finally, be forewarned that when Genieo is mentioned on this site, the developer sometimes shows up under the name "Genieo support." If that happens, don't believe anything he says, but feel free to tell him what you think of his scam.

26 replies
Question marked as Best reply

Jan 26, 2014 4:33 PM in response to KnightRider21

You installed the "Genieo" scam product. There is an uninstaller, but as the developer is not trustworthy, you shouldn't rely on it. I suggest the tedious procedure below to disable Genieo.

Back up all data. You must know how to restore from a backup even if the system becomes unbootable. If you don't know that, stop here and ask for guidance.


Quit the Genieo application, if it's running. Triple-click anywhere in the line below on this page to select it:


/etc/launchd.conf


Right-click or control-click the line and select

Services Reveal in Finder (or just Reveal)


from the contextual menu.

If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go Go to Folder...

from the menu bar, paste into the box that opens (command-V). You won't see what you pasted because a line break is included. Press return.


A folder may open with a file selected, or the file may be absent, in which case you'll get a message that it doesn't exist. If it does exist, it's a configuration file created or replaced by the Genieo installer. Any software installer that does this should be considered ipso facto malware. Move the file to the Trash. You'll be prompted for your administrator password.

IMPORTANT: If the launchd.conf file exists, you must move it to the Trash it before continuing. Otherwise the systemwill become unbootable. In that case, restore from your backup and start over. That's how badly Genieo has sabotaged your system.


Repeat with each of these lines:



/Applications/Genieo.app
/Applications/Uninstall Genieo.app
/Library/Frameworks/GenieoExtra.framework
/Library/LaunchAgents/com.genieo.engine.plist
/Library/LaunchAgents/com.genieoinnovation.macextension.plist
/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist
/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client
/usr/lib/libgenkit.dylib
/usr/lib/libimckit.dylib
/usr/lib/libimckitsa.dylib


Again, some of these items may be absent, in which case you'll get a message that the file doesn't exist. Skip that item and go on to the next one.

Reboot. Your web browsers should now function normally, and you should be able to reset the home page and search engine. If not, stop here and post your results.

From the Safari menu bar, select

Safari Preferences Extensions

Uninstall any extensions you don't know you need, including one called "Spigot" if it's present. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

The Genieo installer may also install the "Silverlight" web plugin from Microsoft. If you have no use for that plugin, you should remove it according to Microsoft's instructions. Don't remove it if you subscribe to "Netflix."

This procedure may leave a few files behind, but it should deactivate Genieo. Make sure you don't repeat the mistake that led you to install it. Chances are you got it from one of the Internet's open sewers such as "Softonic" or "CNET Download." Never visit either of those sites again.

Finally, be forewarned that when Genieo is mentioned on this site, the developer sometimes shows up under the name "Genieo support." If that happens, don't believe anything he says, but feel free to tell him what you think of his scam.

Feb 23, 2014 1:43 PM in response to KnightRider21

I just barely tried to remove the virus by following the steps your provided, and everything seemed to be working, and removing the way you had indicated until I reached the final link, and it would not move to trash. It just sat and span for a long time, so I stopped and tried them all over again. Once I got back to the final link, it gave me the same issue. Except this time when I tried to stop it, my computer froze and is just spinning on the "Moving 'libimcmitsa.dylib' to Trash" I can't even reopen safari or anything. I'm actually posting this from my iPad. I also can't restart my computer, or turn it off. Please help Linc Davis

May 28, 2014 3:32 PM in response to Symonim

Symonim wrote:


I did what Linc suggested

That's the danger in following old instructions. Genieo 2.0 came out after those instructions were posted, so he now has revised instructions elsewhere in the forum.


Rather than searching for them, I recommend you follow the instructions at TheSafeMac Adware Removal Guide : Genieo. It's especially easy if you use his Adware Removal Tool that can be downloaded from there.

Aug 3, 2014 3:06 PM in response to vdotmatrix

I'm not sure what type of adware you have been infected by, but some of us are discussing a new strain of Conduit (which has not yet been documented in TheSafeMac's Adware Removal Guide - Conduit) that modifies the Firefox application itself, which clearly constitutes malware. The question then becomes whether to attempt to remove the infection or just have the user completely replace Firefox.

Aug 3, 2014 6:44 PM in response to vdotmatrix

If it's Genieo then there is much more than a Safari extension involved. A list of all the known files from versions 1 and 2 can be found in TheSafeMac's Adware Removal Guide - Genieo, but the easiest way to remove all currently known adware (except for this latest FireFox invasion) from Safari, Firefox and Chrome is to run the author's Adware Removal Tool which has been used successfully by hundreds of users with no report of issues.

Aug 3, 2014 6:53 PM in response to MadMacs0

OMG....so is a WINDOWS type invasion....in 3 years as a new and releived mac user this is the first time I have ever seen a WINDOWS type of drive by or infection.....this is making me feel really awful. So I wonder what else this thing has done to our computers....I also see that my "X" on my safari tabs have all disappeared......I am going to get the adware removal tool and hope for the best...this is so disappointing but I appreciate we have people on the INSIDE!!!

thank you very much

Bing redirect on the Safari Google Search Bar

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.