I accidentally downloaded something that may be a virus or at least spam.

You installed the "Genieo/InstallMac" rootkit. The product is a fraud, and the developer knowingly distributes an uninstaller that doesn't work. I suggest the tedious procedure below to disable Genieo. This procedure may leave a few small files behind, but it will permanently deactivate the rootkit (as long as you never reinstall it.)

Malware is constantly changing to get around the defenses against it. The instructions in this comment are valid as of now, as far as I know. They won't necessarily be valid in the future. Anyone finding this comment a few days or more after it was posted should look for more recent discussions or start a new one.

Back up all data. You must know how to restore from a backup even if the system becomes unbootable. If you don't know how to do that, or if you don't have any backups, stop here and ask for guidance.

Step 1

In the Applications folder, there may (or may not) be an application named "Genieo". Genieo may be partially installed even if this item is absent. If it's present, select it and open the Finder Info window. If it shows that theVersion is less than 2.0, download and install the current version from the genieo.com website. This may seem paradoxical, since the goal is to remove it, but you'll be saving yourself some trouble as well as the risk of putting the system in an unusable state.

There should be another application in the same folder named "Uninstall Genieo". After updating Genieo, if necessary, launch "Uninstall Genieo" and follow the prompts to remove the "newspaper-style home page." Restart the computer.

This step does not completely inactivate Genieo.

Step 2

Don't take this step unless you completed Step 1, including the restart, without any error messages. If you didn't find the Genieo application, or if you couldn't complete Step 1 for any reason, stop here and ask for instructions.

Triple-click anywhere in the line below on this page to select it:

/Library/Frameworks/GenieoExtra.framework

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.

If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

A folder should open with an item named "GenieoExtra.framework" selected. Move that item to the Trash. You'll be prompted for your administrator password.

Move each of these items to the Trash in the same way:

/Library/LaunchAgents/com.genieo.completer.update.plist
/Library/LaunchAgents/com.genieo.engine.plist
/Library/LaunchAgents/com.genieoinnovation.macextension.plist
/Library/LaunchDaemons/com.genieoinnovation.macextension.client.plist
/Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client
/usr/lib/libgenkit.dylib
/usr/lib/libgenkitsa.dylib
/usr/lib/libimckit.dylib
/usr/lib/libimckitsa.dylib
~/Library/Application Support/com.genieoinnovation.Installer
~/Library/LaunchAgents/com.genieo.completer.download.plist
~/Library/LaunchAgents/com.genieo.completer.update.plist

If there are other items with a name that includes "Genieo" or "genieo" alongside any of those listed above, move them as well. There's no need to restart after each one. Some of these items will be absent, in which case you'll get a message that the file can't be found. Skip that item and go on to the next one.

Restart and empty the Trash. Don't try to empty the Trash until you have restarted.

Step 3

From the Safari menu bar, select

Safari ▹ Preferences... ▹ Extensions

Uninstall any extensions you don't know you need, including ones called "Genieo" or "Omnibar," and any that have the word "Spigot" or "InstallMac" in the description. If in doubt, uninstall all extensions. Do the equivalent for the Firefox and Chrome browsers, if you use either of those.

Your web browser(s) should now be working, and you should be able to reset the home page and search engine. If not, stop here and post your results.

Make sure you don't repeat the mistake that led you to install this software. Chances are you got it from an Internet cesspit such as "Softonic" or "CNET Download." Never visit either of those sites again. You might also have downloaded it from an ad in a page on some other site. The ad has a large green button labeled "Download" or "Download Now" in white letters. The button is designed to confuse people who intend to download something else on the same page. If youever download a file that isn't obviously what you expected, delete it immediately.

You may be wondering why you didn't get a warning from Gatekeeper about installing software from an unknown developer, as you should have. The reason is that the Genieo developer has a codesigning certificate issued by Apple, which causes Gatekeeper to give the installer a pass. Apple could revoke the certificate, but as of this writing, has not done so, even though it's aware of the problem. This failure of oversight is inexcusable and has compromised both Gatekeeper and the Developer ID program. You can't rely on Gatekeeper alone to protect you from harmful software.

Finally, be forewarned that when Genieo is mentioned on this site, the perpetrator of the scam sometimes shows up under the name "Genieo support." He will tell you to run the provided uninstaller. As he knows and intends, the uninstaller does not completely remove the malware.

Sounds like adware, not a virus.

Try: http://thesafemac.com/art

Sounds like you have installed the Genieo adware at a minimum, and very likely may have others as well. The link stevejobsfan0123 gave you will help you remove it.

Note that anti-virus software would probably not have protected you against this, as many variants of Genieo are detected by only a very few anti-virus apps. It's far more important to learn how to protect yourself. See my Mac Malware Guide.

(Fair disclosure: The Safe Mac is my site, and contains a Donate button, so I may receive compensation for providing links to The Safe Mac. Donations are not required.)

Mr Davis:

For the past 2 days I have not been able to open Safari (6.1.4) on my 27" iMac OSX 10.8.5. Every openning began with the Spinning

Beach Ball (SBB) and the warning box "The last time you opened Safari, it was force quit while reopening windows. Do you want to try to reopen its windows

again?", showing button choices Don't Reopen" and "Reopen". I could not choose either because of the SBB, the Safari Dock icon read a grayed-out

"Application not Responding", and I always had to Force Quit. I'm replying to offer you another data point and maybe help some other soul similarly situated.

I have been using a Mac since 1985, and know that even though the problems different people have may seem the same, the solutions may vary

from person to person. Before 2 days ago, I last used Safari about 3 weeks ago; over 99% of the time I use Firefox, but I wanted to import my FF bookmarks so

I could sync my iPad. So all these problems started Friday, when I couldn't open Safari in the face of the constant SBB.

I googled "Safari application not responding OSX Mountain Lion", and other similar words ("Safari won't open OSX 10.8, etc.)

and found various suggestions in the Apple Support Communities and elsewhere on the web. To the best of my knowledge, I wasn't running any

anti-virus, internet security or torrent software, or cleaning apps. Everything I tried, I started and ended with a computer restart:

1. Repaired Permissions Did Not Work ("DNW").

2. Verify Disk Done & OK DNW

3. Download latest Onynx app and cleaned & maintained DNW

4. Hold down Shift and try to open Safari DNW

5. Turn off Firewall in Sys Prefs - Sec & Privacy (Ms. Samit in one of your threads) DNW

6. In Safari, open Prefs, turn off Extensions and add in one at a time (Ms. Samit #25355405) DNW SBB prevents any opening

7. Comm-r, reinstall 10.8.5 (with Safari), then immediately go to Software Update, install if any, restart, etc. DNW !

8. Finally I read your comment in Thread #6423159: "If reinstalling [OSX] in place doesn't work - you have to erase the startup volume,

install OSX & restore your other data from a backup." I faced this grim prospect (even though I have several desk (Superduper) and online

cloud backups), but it beat lugging this big iMac to the local Apple store and have someone tell me the same thing. But for some

reason I decided to just go to the latest Apple Support discussions on only "Safari" and try to find some help one last time, and I came

upon this thread #6419692. Several phrases struck me: MackyKat says "my home page is now Bing"; that's exactly what happened

to me early last week on my opening Firefox page, after I thought I was downloading the latest version of some type of java script.

Then you wrote: "Chance are you got [this malware] from . . . 'CNET Download.'" Yep, CNET Download was the site. You then say:

"The ad has a large green button labeled 'Download' or 'Download Now' . . . " and once again, I remembered clicking on that huge green

flashing button. And although a search of my computer did not come up with any "genieo", you mention that that name may not appear.

I did not suspect adware because several weeks ago I downloaded a free app called "Ad Removal Tool 2", which I used everyday

and which kept pronouncing my computer as clean of adware. However, in this thread, one is directed to the web site the safemac.com

hosted by "thomas_r.", who also comments on this page.

Bottom line: I downloaded the "TSM Adware Removal Tool" from this site, used it, watched it come up with Downlite and another spam --

which I trashed, restarted the computer, and Safari started right up (with no Extensions listed under its Preferences). And I trashed the Ad Removal

Tool 2, which not only was useless, but which may or may not be a Trojan horse.

Anyway, thanks so much for helping me and all others in the Apple Community; you're a Level 100 in my book, as is Mr. Reed and his

TSM Adware Removal Tool.

DEB

Thanks for the kind words!

If that "Ad Removal Tool 2" was BitDefender's Adware Removal Tool, then that's legit, although not much use. It only removes one adware program - Genieo.

I'm unable to find anything precisely called "Ad Removal Tool 2," however, so if that's the exact name of what you found and it's not associated with BitDefender, I'd love to find out where you found it!

It was Bitdefender's Adware Removal Tool 2; I'm glad it's legit, and thanks for your fantastic creation of TSM Adware Removal Tool, which saved me when every other possible solution out there did not work. DEB

Thomas

➕🙂➕➕