I have set my search engine to be Google. Yesterday, I clicked on something that initiated the change. (I couldn't tell you what it was) But it suddenly made Bing my search engine and I can't get rid of it. Please advise how to do this.
iMac (24-inch Early 2008), Mac OS X (10.7.5)
Managed to fix this what the help of Apple Tech Support and and some digging on my own. Apple suggests to start by installing "malwarebytes" (use the mac version) and run it. You will find that it identified and removes (if you tell it to) a good amount of adware.
But that's not the last step to take. Restart and re-scan - if it comes out clean, THEN go to 'Safari' - 'Preferences' and click on the the search icon (magnyifing glass). Type in the search default engine to want (what ever browser you prefer). You will se it was probably set to 'bing'
Hope this helps. It worked for me.
Best, Brian
Do a SMC and PRAM reset (this may take several attempts to "take") then choose your default search engine and re-test. If you have never done these resets instructions are in:
You installed the "Genieo/InstallMac" rootkit. The product is a fraud, and the developer knowingly distributes an uninstaller that doesn't work. I suggest the tedious procedure below to disable Genieo. This procedure may leave a few small files behind, but it will permanently deactivate the rootkit (as long as you never reinstall it.)
Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.
Back up all data. You must know how to restore from a backup even if the system becomes unbootable. If you don't know how to do that, or if you don't have any backups, stop here and ask for guidance.
Step 1
In the Applications folder, there should be an item named "Genieo". Select it and open the Finder Info window. If it shows that the Version is less than 2.0, download and install the current version from the genieo.com website. This may seem paradoxical, since the goal is to remove it, but you'll be saving yourself some trouble as well as the risk of putting the system in an unusable state.
There should be another application in the same folder named "Uninstall Genieo". After updating Genieo, if necessary, launch "Uninstall Genieo" and follow the prompts to remove the "newspaper-style home page." Restart the computer.
This step does not completely inactivate Genieo.
Step 2
Don't take this step unless you completed Step 1, including the restart, without any error messages. If you couldn't complete Step 1, stop here and ask for instructions.
Triple-click anywhere in the line below on this page to select it:
/Library/Frameworks/GenieoExtra.framework
Right-click or control-click the line and select
Services ▹ Reveal in Finder (or just Reveal)
from the contextual menu.
If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.
A folder should open with an item named "GenieoExtra.framework" selected. Move that item to the Trash. You'll be prompted for your administrator password.
Move each of these items to the Trash in the same way:
/Library/LaunchAgents/com.genieo.completer.update.plist
/Library/LaunchAgents/com.genieo.engine.plist
/Library/LaunchAgents/com.genieoinnovation.macextension.plist
/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist
/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client
/usr/lib/libgenkit.dylib
/usr/lib/libgenkitsa.dylib
/usr/lib/libimckit.dylib
/usr/lib/libimckitsa.dylib
~/Library/Application Support/com.genieoinnovation.Installer
~/Library/LaunchAgents/com.genieo.completer.download.plist
~/Library/LaunchAgents/com.genieo.completer.update.plist
If there are other items with a name that includes "Genieo" or "genieo" alongside any of those listed above, move them as well. There's no need to restart after each one. Some of these items will be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.
Restart and empty the Trash. Don't try to empty the Trash until you have restarted.
Step 3
From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall any extensions you don't know you need, including ones called "Genieo" or "Omnibar," and any that have the word "Spigot" or "InstallMac" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.
Your web browser(s) should now be working, and you should be able to reset the home page and search engine. If not, stop here and post your results.
Make sure you don't repeat the mistake that led you to install this software. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad has a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If youever download a file that isn't obviously what you expected, delete it immediately.
You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the Genieo developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. It must be said that this failure of oversight is inexcusable and has seriously compromised the value of Gatekeeper and the Developer ID program. You cannot rely on Gatekeeper alone to protect you from harmful software.
Finally, be forewarned that when Genieo is mentioned on this site, the developer sometimes shows up under the name "Genieo support." If that happens, don't believe anything he says, but feel free to tell him what you think of his scam.
If none of these work, check your extensions.
Safari - Preferences - Extensions
Uninstall any extensions you don't recognize.
I had this problem too, had tried this weird uninstall mac thing and definitely had my default search engine set for Google and not Bing. Nothing was working. But then I went to my extensions and saw some weird extension with a checkbox that said Bing Search Engine. I uninstalled that extension, deleted it, and everything is back to normal!
Hope this helps!
andreahopscotch wrote:
If none of these work, check your extensions.
Safari - Preferences - Extensions
Uninstall any extensions you don't recognize.
Note that this is sufficient for some adware, but not for all. InstallMac/Genieo, for example, may install an extension called Omnibar, but that is the smallest part of the infection. There are many other things installed, some very deeply in your Mac, that must be removed if you don't want this junk remaining active, doing God knows what in the background.
Also, note that the InstallMac/Genieo uninstaller is known not to work. These installers do not remove all components of the adware. In fact, the InstallMac uninstaller in particular has been observed to install components that were not actually present!
Use Linc's instructions above... they're still valid at this time.
This was the immediate fix! Thank you! I uninstalled and feel much better now. That Bing is creepy!!!! Made me so mad that it just took over like that. Thanks again!!!!!
is this still relevant, or do i go through other steps
I had the same problem, but your (albeit tedious) process led me to all the offensive files which I trashed. I think everything's cool again.
I'm left with two questions..
We all know that MS is on its last legs, but this is really going over the edge!
...PS I confess to having used CNET and Softonic before, which may be how I "inherited" this problem. In the past when Googling my way to a free utility somewhere that I know I'm only going to need once or twice, I've been directed to one of those as top picks in Google.
I guess I've learned my lesson. So, how is the general public supposed to know that sites like CNET and Softonic are full of malware? Any others that we should be aware of?
PPS... I now see that I've ended up in a Mac OS Lion discussion section. Let me say that the same solution works for Yosemite and Safari 8.0, which is what I am running. Now I'm even more amazed that Apple hasn't patched this security breach by now.
Charles Whaley wrote:
Why hasn't Apple closed this security breach?
Excellent question. I can only guess that this is because Genieo aka InstallMac is still considered by many to be nothing worse than a "PUA" (Potentially Unwanted Application). After all, you agreed to its installation when you ran some installer downloaded from the wrong place. You probably didn't notice what you agreed to, but you did nonetheless.
I still believe that this adware, and the Israeli company behind it, needs to be squashed like the annoying mosquito that it has so much in common with. But Apple seems unwilling to cross that line yet.
Why is Microsoft so desperate to win Bing converts that they have to hire hackers to go to this extent to switch over the Safari search setting?
This isn't so much something that Microsoft is doing... it's just an effect of the Bing associate program, which I believe pays for referrals to Bing. This is how the adware makers get paid. They direct users to Bing, then Bing pays them for the referrals.
Of course, the fact that Microsoft seems unable to get the Bing affiliate program cleaned up, by terminating relationships with these unethical affiliates, means you probably shouldn't be using Bing even after you get this problem fixed.
Irritating Bing search engine extensions: Safari quit, Next thing I know … bing is set as my search engine AGAIN!
first it was the Goldenboy extension, that I never installed.
now it is Oliverto Safari browser extension another Bing search thing?
what is this Genieo thing?
René O'Deay wrote:
what is this Genieo thing?
Genieo is adware, and the browser extensions you're seeing are only the tip of the iceberg. There's more installed behind the scenes. See my Genieo removal instructions:
http://www.thesafemac.com/arg-genieo
Also, note that if you have been getting infected repeatedly, you need to be more careful about what you're downloading and from where. See:
(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com.)
You installed a variant of the "InstallMac" trojan. Take the steps below to disable it.
The criminal behind this attack tries to make the malware hard to remove by varying the names of the files it installs. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.
Back up all data before continuing.
1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination command-C:
~/Library/LaunchAgents
In the Finder, select
Go ▹ Go to Folder...
from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return. A folder named "LaunchAgents" will open.
2. Inside the folder you just opened, there may files with a name of the form
something.download.plist
something.ltvbit.plist
something.update.plist
where something is usually a meaningless string, such as "InKeepr," "Listchack," "Oliverto," or "Texiday." It could be anything. The point is that the same string will appear in the name of three files.
You could have more than one copy of the malware, with different values of something.
Move all such items to the Trash. There may not be any other files in the LaunchAgents folder; in that case, you can delete the folder, but otherwise don't delete it. Other files in the folder are not necessarily malicious (though they could be, if you also installed some other kind of malware.)
Log out or restart the computer. The trojan will now be inactive, but there are a few more components of it that should be cleaned up.
3. Open this folder in the same way as above:
~/Library/Application Support
and move to the Trash any subfolders named with the same something you found in Step 2.
Don't move the Application Support folder or anything else inside it.
4. Open the Applications folder. If there is an item with the same name as in Step 3, or any of the other names listed in Step 2, drag it to the Trash.
If in doubt, press the key combination option-command-4 to arrange the apps by date added. Look at the apps that have been added since you first noticed the problem. If there is one you don't recognize, drag it to the Trash.
Empty the Trash.
If you get an alert that the application is in use, force it to quit.
5. From the Safari menu bar, select
Safari ▹ Preferences... ▹ Extensions
Uninstall all extensions you don't know you need. If in doubt, remove all of them. None is required for normal operation. Do the equivalent in the Chrome and Firefox browsers, if you use either of those.
6. Reset the home page in each of your browsers, if it was changed. In Safari, first load the home page you want, then select
Safari ▹ Preferences... ▹ General
and click
Set to Current Page
Bing search engine has taken over my Safari Browser
